On 6 July, the FCA announced it wants expanded regulatory powers to oversee AI in retail financial services, specifically citing the rise of consumer chatbots dispensing money advice. The watchdog is right to be concerned, but not because chatbots are inherently dangerous. The real issue is that most mid-market regulated firms have bolted AI onto existing workflows without building the governance architecture the Consumer Duty PS22/9 and PRA SS1/23 actually demand. A chatbot that generates advice without audit trails, without control over its training data, and without human sign-off isn't an AI tool—it's a compliance liability. The FCA's call for an expanded regulatory perimeter and tighter oversight of autonomous AI models is code for: we will hold you accountable for what your systems say, whether or not you intended it.

This story sits within a broader pattern. Over the past 18 months, consultancies and tech vendors have sold regulated firms on the dream of autonomous AI agents—systems that would reduce overhead, cut turnaround times, and free up fee-earners. The reality in most deployments has been messier. Systems like Harvey and Legora generate plausible-sounding output that looks credible but often lacks verifiable grounding in source materials. Generic enterprise AI tools like Microsoft Copilot, when pointed at confidential client data, create data governance nightmares. And worse, many firms have implemented these tools without mechanisms to prove to their regulator (or to themselves) what the AI actually did, why it did it, and whether it met the firm's duty of care. The FCA's intervention is a watershed moment: the era of experimental, lightly-governed AI deployment in financial services is over. Regulatory oversight will intensify across the ICO UK GDPR framework, the incoming EU AI Act compliance requirements, and FCA-specific conduct rules.

Here is Trovix's honest read: if your firm is currently using a generic chatbot to interact with clients or to generate advice, or if you have deployed any autonomous AI system without a parallel governance and audit capability, you are now in a higher-risk position than you were six months ago. The path forward is not to abandon AI—that train left the station—but to implement AI with true transparency and control. That means: source-verified outputs (not hallucinations dressed as facts), documented decision chains, real-time compliance scoring, and audit trails that survive a regulator's scrutiny. This is not what most off-the-shelf solutions offer. Trovix Reach is built on the principle that client-facing AI must be traceable and confined—it outputs only what it can verify against your firm's actual knowledge base, and every interaction is logged and auditable. Trovix Audit gives you the governance dashboard regulators will expect to see: what prompts were sent, what guardrails were hit, where humans intervened, where the AI stayed in lane. This is the infrastructure the FCA's new rules will require.

For a mid-market law firm, insurer, financial services firm, or accountancy practice, the immediate action is not to wait for new rules to be published. Start now: audit every AI system in live use and ask yourself: can I prove to the FCA what this system said to a client, why it said it, and whether it breached any duty? If the answer is no, you have a remediation task. If you are still in the buying phase, reject any AI product that does not offer built-in audit, source attribution, and real-time compliance signals. The cost of retrofitting governance into uncontrolled AI is far higher than building it in from the start. The FCA has signaled its direction. Regulated firms that move ahead of the rule-write rather than behind it will have competitive advantage and lower regulatory friction when the perimeter formally expands.

Source: City AM