Nikhil Rathi's July warning was not just another regulatory speech. The FCA CEO publicly acknowledged that traditional rulemaking cycles—measured in years—cannot keep pace with AI systems that evolve in weeks. This is not a problem the regulator will solve by issuing another policy statement. It is a confession that the existing framework is structurally broken for the pace of AI change. For mid-market legal practices, insurers, financial services firms and accountancies, this matters immediately: the regulatory ground beneath you is shifting from fixed rules to what the FCA now calls 'adaptive oversight'. That means you cannot rely on a rule book written six months ago. You must demonstrate real-time governance—not next year, but now.

This story is part of a larger pattern. The EU AI Act creates broad risk categories but defers specifics to future secondary regulation. The PRA's SS1/23 framework asks firms to manage AI risks but does not specify exactly how. The FRC's ISA UK standards require auditors to address AI in audit evidence, but the bar keeps moving. Meanwhile, vendors like Harvey and Luminance are shipping agentic AI systems into law firms and financial services faster than regulators can assess them. The gap between innovation and oversight is not closing—it is widening. Firms that wait for perfect regulatory clarity will lose competitive ground to firms that build governance as a capability, not a compliance checkbox. The message from regulators is clear: you must become your own risk committee for AI.

At Trovix, we believe the real problem is not that AI is moving too fast. It is that most firms are implementing AI without the governance infrastructure to track what it is actually doing. Many organisations treat AI as a tools-and-features problem—drop in Copilot, add a chatbot like Trovix Reach, deploy a document tool like Trovix Sift—and assume the regulatory risk is solved because a vendor told them it is 'compliant'. That is exactly backwards. Compliance is not a product feature. It is a practice. The FCA's shift towards adaptive oversight means you need continuous visibility into how AI systems perform, fail, and affect clients or markets. You need an audit trail. You need to know when a generative model hallucinates on a contract term, when an extraction tool misses a disclosure obligation, when a client-facing AI system gives inconsistent advice. Generic vendor compliance documentation will not meet this standard. You need Trovix Audit—a governance dashboard that shows you what your AI is doing across your firm, in real time, so you can prove it to regulators, not just assert it.

Here is what to do Monday morning. First: do an honest inventory of every AI system in use—including spreadsheet macros, no matter how dumb they seem, and shadow IT tools your teams have adopted. Second: for each system, document the business decision it influences and the regulatory risk it carries. A chatbot summarising case law carries different risk than one making fee recommendations. Third: build a simple AI governance committee with representation from risk, compliance, and the business. Fourth: implement continuous monitoring on your highest-risk AI systems. The FCA Consumer Duty PS22/9 already requires you to act in customers' interests and to monitor outcomes. The SRA Code demands solicitors remain personally responsible even when delegating to AI. You cannot meet these obligations without visibility. Trovix Audit exists precisely for this—not to generate a report for your filing cabinet, but to give you the operational transparency regulators now expect. Fifth: stop waiting for the regulator to finish writing the rule. They have told you they cannot. Your job is to demonstrate you can govern AI responsibly even as it changes.

Source: CNBC