Andrew Bailey's warning to G20 finance ministers on 31 August was not about AI itself—it was about AI without guardrails. The Financial Stability Board identified AI-enabled cyberattacks as the immediate threat, but also something quieter and more damaging: stretched valuations and rising debt fuelling reckless deployment. For UK regulated firms—law practices, insurers, financial advisers, accountants—this matters urgently. The FCA Consumer Duty PS22/9, PRA SS1/23, and SRA Code all now assume firms understand their tech stack. A breach caused by a rushed AI implementation is a breach the regulator will trace directly to governance failure, not vendor failure.
The pattern is now clear. Firms are adopting AI products (Harvey for legal document review, Luminance for contract intelligence, Microsoft Copilot for general office work, or generic LLM integrations) without first asking: what does our risk appetite actually permit? What data leaves our network? Who controls the model outputs? The FSB's warning shows what happens when that question goes unasked at scale—interconnected financial infrastructure becomes vulnerable to the one thing AI does very well: automating at speed without human pause. The industry is racing to deploy AI for cost savings and competitive speed. The regulator is now saying that race has created systemic risk.
Trovix's position is this: governance must come before tools. Not alongside. Before. The firms that will survive regulatory scrutiny—and cyber risk—are those building an AI governance layer first: clarity on what data can flow where, what models can be used (proprietary vs. third-party), how outputs are validated, who owns the decision, and how breaches are detected. This is not about blocking AI. It is about controlling it. Products like Harvey or Copilot are useful. But they are only safe inside a firm that has already decided its own AI rules. Many mid-market firms have not. They have installed the tool and hoped governance would follow. It will not. The regulator will ask for your AI governance policy before it asks about your AI performance.
Do this immediately: audit your current AI use (including shadow AI—the tools people use without IT approval). Map where data flows. Write down which models are being used and by whom. If you cannot answer those questions in writing, pause new AI deployment until you can. Use Trovix Audit to document what you are actually running and track compliance against PRA SS1/23, SRA Code, and the ICO's UK GDPR AI guidance. Then use Trovix Watch to monitor the regulatory changes coming from the EU AI Act (which will shape UK FCA and PRA practice). The firms that treated the FSB warning as a PR story will be the ones writing incident reports in 2027. The firms that treated it as a governance deadline will be building defensible AI stacks now.
Source: CNN