Bank of America's 200,000 employees generating 400,000 AI prompts daily across 300 use cases — including 114 generative AI cases — looks impressive in a headline. For UK regulated firms in legal, insurance, financial services and accountancy, it should be a wake-up call, not a roadmap. BofA's story is one of scale; it tells us nothing about governance, audit trail integrity, or PRA SS1/23 compliance. The FCA's Consumer Duty (PS22/9) and the incoming EU AI Act create specific liability for firms that deploy AI without demonstrable control. Running 400,000 daily prompts without proportionate governance infrastructure isn't innovation — it's a compliance incident waiting to happen.

What we're seeing across the financial services sector is a two-speed AI adoption curve. Tier-1 banks like BofA can absorb AI failures because they have the capital and legal teams to manage downstream consequences. Mid-market firms cannot. The pattern is clear: banks are treating AI as a productivity play, measuring success by prompt volume and use case count. They measure output; they measure velocity; they do not yet measure risk properly. The SRA Code of Conduct, ICO UK GDPR obligations, and ISO 42001 frameworks require the opposite approach — governance first, then expansion. The firms winning this year will not be the ones with the most use cases. They will be the ones that can prove they know exactly what their AI systems are doing, why they are doing it, and how it complies with nine different regulatory regimes.

Here is Trovix's honest position: there is no correlation between the number of approved use cases and the quality of AI governance. BofA's 34 fully implemented cases may be excellent; they may also be a sample size masking dozens of others in pilot limbo. The real question is operability under pressure. When the FCA opens a skilled person review of your AI controls, or when an ICO GDPR audit begins, can you produce an audit trail for every decision made by every AI system? Can you demonstrate that your AI was built with compliance requirements front-loaded, not bolted on afterwards? Tools like Trovix Audit exist precisely because generic AI platforms — Copilot, ChatGPT, even purpose-built legal AI like Harvey or Luminance — operate under the assumption that the user will handle governance. That assumption breaks at scale. It breaks under regulatory scrutiny. It breaks when your AI recommends a claim denial that turns out to be wrongful.

If you are a mid-market regulated firm, do not copy BofA's deployment strategy. Instead: audit your current AI usage right now. Ask yourself which systems are business-critical, which hold client data, which make or support material decisions. Map those to your regulatory obligations — FCA Handbook, SRA Code, PRA rules, ICO GDPR, ISO 42001. Build your governance layer before you expand use cases. This is not a technology problem; it is a control problem. Trovix Watch can help you track regulatory changes that affect your AI scope; Trovix Audit can help you build the governance dashboard you will need when the regulator asks for it. The firms that will dominate regulated AI over the next two years are not the ones deploying fastest. They are the ones that can prove they deployed smartest.

Source: CIO Dive