The New Statesman has documented something that regulators should find alarming: AI text composed by large language models now appears in Acts of Parliament, including the June 2025 Spending Review which allocated £2bn to AI development based on AI-analysed funding bids. For mid-market law firms, insurers, financial services firms and accountancy practices, this creates an acute problem. You are regulated under frameworks — FCA Consumer Duty PS22/9, SRA Code of Conduct, PRA SS1/23, FRC ISA UK standards — that assume human decision-making and traceable reasoning. When the laws themselves are drafted by systems with no audit trail, your compliance obligations become impossible to fully satisfy. You cannot comply transparently with legislation you cannot fully understand.

This is part of a wider pattern. Since 2023, the push to deploy LLMs in high-stakes environments has prioritised speed and cost reduction over accountability. Tools like GPT-4 and Claude have become the default choice for content generation precisely because they are cheap and fast. But fast and cheap are not attributes that belong in legislative drafting, regulatory interpretation, or policy impact assessment. The EU AI Act recognises this: high-risk AI systems require documented governance, human oversight and impact assessment before deployment. The UK, for all its AI cheerleading, has no equivalent requirement. So civil servants and ministers use whatever generative model is available, ask it to synthesise departmental bids or draft statutory language, and move on. No one is recording what the system was told, what it generated, how much was edited, or why.

Here is what Trovix believes matters: regulated firms need to treat algorithmic legislation the same way they treat algorithmic decision-making in their own operations. The ICO UK GDPR guidance and ISO 42001 framework both require organisations to document the logic, training and outputs of AI systems that affect individuals or stakeholders. Parliament should meet that standard too — and until it does, your firm cannot assume that laws affecting you were drafted rationally or lawfully. This is not a problem that Harvey, Legora, Luminance or Microsoft Copilot can solve for you, because these tools were designed to help you comply with law, not to audit how law was made. You need something different: continuous monitoring of how legislative and regulatory decisions affecting your sector are being shaped by AI, combined with governance dashboards that flag algorithmic risk in policy-making. Trovix Audit was built for exactly this: to track where AI is being used in decision-making and to surface the gaps in transparency that create compliance risk.

Act now. First, document which recent legislation and regulatory guidance affecting your firm may have been AI-drafted. Reach out to your professional body — the Law Society, FCA, ABI, ICAEW — and ask for clarity on which statutory instruments, guidance documents and policy analyses were composed or significantly shaped by AI. Second, establish a regulatory monitoring practice that looks beyond the text of law to the process behind it. If a new FCA rule or SRA guidance emerges, ask who drafted it and whether AI was used. Third, build risk assumptions into your compliance model: assume that some recent law may have logical inconsistencies or unintended consequences because it was written at speed by systems without domain expertise. That is not paranoia. It is prudent risk management. Fourth, use your professional body's consultation responses to push for mandatory AI impact assessment before parliamentary and regulatory drafting. The Framework for Responsible AI in the Public Service exists — it just needs teeth.

Source: New Statesman