On 3 July, the FCA's Nikhil Rathi said something uncomfortable but true: traditional regulation cannot keep pace with AI development, particularly as agentic AI accelerates. This is not theoretical concern. It means that right now, mid-market UK legal, insurance, financial services and accountancy firms are deploying AI tools—from document automation to client communication—into regulatory frameworks designed for 2020, not 2026. The gap between your AI capability and your governance readiness is real, measurable, and the FCA is watching. Firms are not breaking rules yet. They are moving faster than the rules assume they should.

This story reveals a pattern that has been hiding in plain sight. The financial services industry adopted GenAI—particularly large language models and RAG-based assistants—without first building the governance layer. We saw it with Microsoft Copilot roll-outs in law firms that lacked proper data handling protocols. We saw it with Harvey and Legora building impressive legal AI without forcing clients to solve the custody and audit problem first. We saw it with Luminance deploying document intelligence at scale while compliance teams scrambled to document what the tool was actually doing. The pattern is consistent: capability led. Governance followed. Now regulators are saying that pattern has to reverse. That is not a regulation. That is a fundamental reset of how responsible firms should approach AI deployment.

Trovix's view is blunt: if you have not built governance first, your AI deployment is premature, regardless of whether it is technically compliant today. The tools matter less than the structure around them. A RAG assistant like Trovix Aria without proper governance is just expensive risk. A document extraction tool like Trovix Sift without audit trails and access controls is a compliance liability. This is why we built Trovix Audit first—as a governance and compliance dashboard that sits above the AI layer, not beneath it. You need to know what your AI is doing, why it is doing it, and whether it is drifting. Tools like Microsoft Copilot and Harvey are not bad. But they are being deployed into governance vacuums. That is the real problem. Regulators are not warning about AI. They are warning about unmanaged AI.

If you are a mid-market firm, here is what you do right now. Pause new AI deployments that lack clear audit trails and human-in-the-loop validation. Conduct an honest review of existing tools: can you explain to the FCA, PRA, SRA or ICO exactly what each AI tool does, what data it sees, who has access, and how decisions are logged? If the answer is no, you have a compliance gap. Start building governance frameworks that reference real standards—ISO 42001, the EU AI Act, FCA Consumer Duty PS22/9, SRA Code requirements for technology oversight. Do not wait for new regulation to clarify the gap. Use existing frameworks. Then deploy AI into that framework. That is the sequence that regulators are quietly asking for.

Source: CNBC