The University of Cambridge report published this week confirms what we already knew: the financial services industry is accelerating agentic AI deployment while supervisory frameworks remain dangerously thin. The FCA, PRA and ICO are still mapping out governance approaches; meanwhile, mid-market financial services firms, law practices, insurers and accountancy businesses are already running autonomous systems that execute transactions, make underwriting decisions and process client data. The gap between capability and oversight is not a minor timing issue. Under FCA Consumer Duty PS22/9, firms remain liable for outcomes their AI systems produce, regardless of how sophisticated those systems claim to be. Under PRA SS1/23 and the ICO's evolving GDPR guidance, the legal responsibility for AI failures belongs to the regulated firm, not the vendor.

This story is symptomatic of a wider failure in how regulated industries have approached generative AI. Firms spent 2023 and 2024 playing with ChatGPT and marketing glossy copilot interfaces. The reality is different. Agentic AI — systems that operate autonomously, make decisions, and execute actions without human intervention in every transaction — demands a fundamentally different risk architecture. Harvey, Luminance, and other legal-focused AI vendors have built strong products for document review and knowledge work, but those remain fundamentally supervised tools. Agentic systems are not. The financial services sector is now moving into territory where the difference between 'AI assistant' and 'autonomous agent' matters more than it ever has.

Trovix's position is simple: autonomous AI deployment without proper governance infrastructure is malpractice. We do not believe firms should wait for regulators to write the rules before embedding controls. The controls must exist first. This means audit trails that are immutable and independently verifiable, decision explainability that meets ISO 42001 standards, and human-in-loop checkpoints at material decision points — not as optional nice-to-haves, but as embedded requirements. We have deliberately avoided building pure agentic systems that promise to eliminate human judgment. Instead, Trovix Sift and Trovix Brief are designed to accelerate decision-making and data processing while keeping the decision-maker accountable and visible. That is a harder engineering problem, but it is the correct one.

For a mid-market insurance firm, accountancy practice, or financial services business, the immediate action is not to rush toward agentic AI adoption. The immediate action is to audit your current AI use, map it against PRA SS1/23, FCA Consumer Duty PS22/9, and your own SRA or FRC code obligations, and identify where autonomous decision-making is happening without sufficient oversight. Then build the governance first. Only then deploy additional AI capability. The firms that will succeed in this space are not those that move fastest — they are those that move most carefully, with proper accountability built in from day one. The Cambridge report should trigger not excitement about AI capability, but urgency about governance maturity.

Source: CNN