The Cambridge Judge data is stark and troubling. Eighty-one percent of surveyed financial services firms are using AI at some level, but only 40% have achieved 'advanced' adoption. More worrying: fintechs are 47% advanced while traditional incumbents sit at 30%. This looks like momentum. It is actually fragmentation. The FCA has made clear in recent guidance that AI use in regulated activities triggers Consumer Duty requirements under PS22/9 and operational resilience expectations under SS1/23. Yet the report shows that 78% of regulators view AI as merely 'significant or transformative' by 2030—meaning today, most regulators are still learning what firms are actually doing. For mid-market UK practices in law, insurance, financial services and accountancy, this asymmetry creates acute risk. You could deploy a large language model tomorrow and operate within regulatory grey space for months before anyone notices. That does not make it safe.

This story is part of a pattern we see across regulated sectors: first-mover pressure overwhelms governance discipline. Firms see competitors using Harvey, Luminance, or generic Microsoft Copilot instances and feel compelled to follow. Fintechs—which operate with lighter regulation and higher appetite for failure—race ahead. But traditional regulated firms (insurers, law firms, accountancies) operate under different constraints: client confidentiality, claims liability, audit trails, data subject rights under UK GDPR, and PRA operational risk frameworks. The Cambridge data conflates all these contexts under 'advanced adoption' without asking whether the adoption is safe or compliant. It is not. Most mid-market firms adopting AI today are doing so without documented data processing agreements, without model audit capacity, without understanding their own training data provenance, and without genuine human oversight—exactly the conditions that triggered the ICO's recent enforcement focus and the FRC's tightening of ISA UK audit standards around AI reliance.

Trovix's view: adoption without governance is debt. The firms winning long-term are not the fastest adopters; they are the ones who implement AI within a compliance frame from day one. This means three things. First, you need visibility into what AI systems are actually running and what data they are processing—which requires a proper audit layer. Tools like Trovix Audit exist precisely because generic LLMs and off-the-shelf AI do not give you the governance dashboard that regulated firms need. Second, you need to distinguish between AI that is subject to direct regulatory oversight (client-facing advice, underwriting decisions, legal analysis) and AI that is internal (summarisation, research, document triage). This distinction matters for PRA SS1/23 operational resilience and for SRA Code compliance around professional judgment. Tools like Trovix Aria are built to sit in the 'internal assistant' lane—supporting fee-earners with research and knowledge without replacing professional judgment. Third, any client-facing or output-critical AI deployment must be auditable in real time. The firms getting this right are not using generic ChatGPT for client communication; they are using purpose-built tools with human-in-loop architecture and compliance logging.

What should a mid-market firm do right now? Do not treat the 81% adoption figure as pressure to move faster. Instead, audit what you are already running: who has deployed what, where is sensitive data going, what is the liability exposure if a model makes a mistake? Then build a three-tier AI strategy aligned to PRA SS1/23 and FCA expectations: (1) internal research and knowledge tools with strong governance, (2) human-supervised client-facing tools with real-time audit logging, (3) no autonomous decision-making in regulated activities without explicit sign-off from a qualified person. The firms that will survive the next regulatory tightening—and there will be one—are those that treat AI governance as a compliance discipline today, not a tick-box exercise tomorrow.

Source: Cambridge Judge Business School