When the FCA's CEO tells you that AI is evolving in weeks while rulemaking takes months, she is telling you something important — but not what most firms think. Yes, the regulators are scrambling. Yes, the EU AI Act and UK AI Framework are playing catch-up. But the real problem for mid-market law firms, insurers, financial advisers and accountancies is not regulatory lag. It is your own operational lag. You cannot move fast with AI if you do not know what you are running, why you are running it, or what happens when it fails. The FCA's shift away from detailed rulebooks towards collaborative oversight (as seen in PRA SS1/23 and the FCA's AI and machine learning approach) is not permission to deploy at pace. It is a warning that you must govern harder internally, because external permission structures are dissolving.

This story sits at the intersection of three colliding realities. First: vendors like Harvey, Legora and Luminance are shipping production-grade legal and financial AI systems that genuinely work, and they work faster than your review cycles. Second: the ICO, FCA, SRA Code, FRC ISA UK and Lloyd's Blueprint Two all now expect you to hold AI accountable regardless of regulatory clarity — that is the Consumer Duty PS22/9 logic applied to technology. Third: most mid-market firms are still buying AI like it is software — drop it in, tick the box, move on. The gap between what the market can build and what your governance can sustain is widening, not closing. The regulators know this. That is why they are moving from 'we will tell you what to do' to 'we expect you to tell us how you are managing it'.

Here is our view: the pace problem is not about regulators or vendors. It is about you. A generic LLM wrapper will fail faster than a generic chatbot, because the consequences are heavier. Putting Copilot or an off-the-shelf RAG system in front of your fee-earners without governance looks responsive until it is not — until it hallucinates a clause, misses a duty disclosure, or strips client privilege from a document. The difference between a Trovix Aria installation that works and one that becomes a liability is not the model. It is the governance layer. You need to know what your AI is trained on, what it can and cannot do in your specific workflows, how it degrades under load, and how you audit it. Trovix Audit exists precisely because this is where the regulatory conversation is actually going — not 'do you use AI?' but 'prove that you know what your AI does and does not do'. That requires architecture, not just adoption.

What you should do now: Stop asking vendors whether their AI is 'compliant'. Start asking them whether their AI is auditable. Can you see the training data lineage? Can you test it against your specific risk profile? Can you explain its decisions to the FCA or your insurance broker? If you are deploying Trovix Reach or Trovix Sift or any other AI system in a regulated context, the FCA's message is: you need documented risk assessment, transparent model behaviour, human oversight at decision points, and the ability to show all three. Not because the FCA told you to. Because the alternative is deploying something faster than you can manage it, and that is a choice, not a necessity.

Source: CNBC