When the FCA's Nikhil Rathi says traditional rulemaking cycles don't work with fast-moving AI, he is describing the core problem facing every UK legal, insurance, financial services and accountancy firm: the compliance frameworks you built to satisfy Consumer Duty PS22/9, SRA Code requirements, PRA SS1/23 and FRC ISA UK were designed for a stable technological landscape. They are not designed for systems that learn, adapt and make autonomous decisions in real time. The EU AI Act attempts to fix this with risk-based classification, but classification alone is not enforcement. What Rathi is signalling is that regulators will need to move toward continuous dialogue with firms on financial crime, model drift, and AI-driven harm—not annual compliance ticking boxes. This is not a future state. It begins now.

The pattern is clear across regulated sectors: early AI implementations—particularly large language models deployed in document review, contract analysis and regulatory monitoring—revealed a fundamental mismatch between AI capability and compliance capability. Tools like Harvey in legal, Luminance in document intelligence, and general-purpose Copilot implementations in financial crime teams showed what AI could do. But they also showed what regulators could not easily measure: model reliability, bias, drift over time, and the audit trail required under ICO UK GDPR and ISO 42001. The result is not that AI is too risky to use. The result is that static compliance frameworks create a false sense of security. Agentic AI—systems that make decisions and take actions autonomously—will make this gap intolerable within months, not years. Regulators know this. They are preparing to shift from rule-based compliance to outcome-based, real-time risk management. Firms that do not shift with them will either face enforcement action or be forced into retrofit compliance at far higher cost.

Here is Trovix's position: the firms winning with AI in regulated sectors are not those buying the cleverest models. They are those building transparent, measurable control architectures around those models. This means three things. First, you need continuous visibility into what your AI systems actually do—not just at deployment, but in production, with audit logs and decision traces that satisfy both internal risk teams and regulators. Second, you need to be able to explain and justify every material decision an AI system makes, particularly in financial crime, underwriting, and legal advisory contexts. Third, you need monitoring that is not a quarterly compliance report but a live feed of model performance, data drift, and regulatory risk. Tools like Trovix Watch are built for this specific problem: they feed you regulatory change as it happens and help you map it to your actual AI use cases in real time, not after the fact. Compare this to the approach taken by many enterprise AI vendors: they sell capability and leave compliance to you. That worked when rules were stable. It does not work now. Your regulator is telling you this explicitly.

What should you do Monday morning? First, audit what AI systems you actually have running across your organisation—not just in IT, but in matter intake, document processing, risk assessment, and client advisory. Many firms have piecemeal deployments that no one has mapped to regulatory obligations. Second, map each system to its regulatory obligation: which FCA rules, SRA principles, PRA expectations, or ICO safeguards does it touch? Third, build a simple but rigorous feedback loop: weekly checks on model performance, quarterly reviews with your compliance and risk teams, and a direct line to your regulator if something fails. This is not excessive burden. It is the price of using AI in a regulated market. Firms that do this now will be first movers with regulators; they will have the documentation and control architecture that turns compliance into a selling point with clients. Firms that ignore this warning will be in breach remediation within 18 months. The FCA is not guessing. They are warning you based on what they are already seeing in the market.

Source: CNBC