The FCA and ECB have stopped pretending they have the answer. In early July, they admitted what practitioners already know: AI systems move faster than rulebooks. The FCA's CEO stated plainly that traditional rulemaking cycles measured in years cannot compete with technologies that evolve in weeks. The ECB's Christine Lagarde was blunter still—AI poses systemic risks and the defence mechanisms do not yet exist. For mid-market law firms, insurers, financial services firms and accountancy practices operating under the SRA Code, FCA Consumer Duty PS22/9, PRA SS1/23 and the incoming EU AI Act, this is not abstract regulatory theatre. It means the compliance frameworks you are relying on to justify your AI implementation decisions may be obsolete before they are published. You are being asked to operate in a gap that regulators themselves now acknowledge cannot be closed by traditional methods.

This admission reveals a deeper truth: the industry has been building AI tools faster than it can govern them, and neither the vendors nor the firms deploying them have honest answers about what happens when regulation arrives late. We have seen this pattern before. Large language model vendors like OpenAI and Anthropic have moved faster than the ICO could define UK GDPR compliance for generative AI. Document intelligence platforms like Luminance and Harvey have marketed their capabilities to legal and professional services firms with minimal sector-specific governance frameworks to test against. Meanwhile, mid-market practices have adopted these tools into core workflows—contract review, due diligence, risk assessment—without clear line-of-sight to how regulators will measure compliance. The gap between deployment and governance is widening, and regulators are finally saying: that is our problem too.

Trovix's approach to this risk is deliberate: we do not assume the rulebook will be complete when you deploy. Instead, we build for continuous regulatory adaptation. Where tools like Microsoft Copilot or generic RAG assistants offer general-purpose AI capabilities and leave compliance questions to the user, Trovix Watch monitors regulatory change in real time—not after publication, but during consultation phases—so you can adjust implementation before enforcement begins. Our document intelligence and data extraction products, including Trovix Sift, are designed with auditability and traceability as non-negotiable requirements, not add-ons. That is not theoretical compliance theatre. It means your AI outputs can be forensically examined by auditors and regulators under ISO 42001, the ICO's AI principles, and emerging FCA guidance on algorithmic accountability. When the FCA's rulebook finally catches up, you will not be scrambling to retrofit governance into tools that were never built for it.

What you should do now: first, map your current AI deployments—spreadsheets and vendor promises do not count. Document what data these systems process, what decisions they inform, and what regulatory standards apply (Consumer Duty, SRA principles, PRA expectations around model risk management). Second, do not wait for new rules before auditing vendor claims. If a tool claims to do contract analysis or risk assessment, test it against a sample of real work and measure accuracy, hallucination rate, and bias. Third, establish a regulatory monitoring cadence. The FCA, PRA, ICO and Lloyd's (via Blueprint Two) are all publishing guidance in fragments. Missing a consultation phase or early warning could cost you months of remediation later. Most mid-market firms do not have the bandwidth to track this alone—that is what Trovix Watch is built for. Fourth, treat vendor selection as a governance decision, not just a capability decision. A platform vendor who tells you they are 'still working on compliance' is telling you they will make you work on it later.

Source: CNBC