Nikhil Rathi, CEO of the FCA, has done something rare: admitted the regulatory system is structurally outdated. AI development now moves in months. Rulemaking takes years. The EU AI Act took three years to finalise. By the time it lands, agentic AI—systems that act autonomously without human instruction—will be three generations beyond what the rules address. For mid-market legal firms, insurers, financial services practices and accountancies, this admission is both warning and permission. The warning: do not assume regulation will protect you. The permission: you must build your own compliance infrastructure now, using existing legal frameworks (FCA Consumer Duty PS22/9, SRA Code, PRA SS1/23, ICO UK GDPR) as your anchor, not waiting for new AI-specific rules that will arrive too late to matter.

This is not new. We have seen it before. When high-frequency trading emerged, regulators had to retrofit rules around systems they didn't understand. When cloud computing became critical infrastructure, the PRA and FCA scrambled to write SS1/23 years after adoption began. When data became the commodity, GDPR arrived as an afterthought. The pattern is consistent: technology moves first, regulators catch up, firms caught in between get hurt. The agentic AI moment is different only in speed. A law firm deploying an AI agent to draft contracts, an insurer using agentic systems to assess claims, a financial services firm automating due diligence—none of these can wait for the FCA or Lloyd's of London to issue detailed guidance. They exist in a regulatory grey zone. Some vendors—Harvey, Legora, Luminance—have built compliance checks into their products, but most treat regulation as something to avoid rather than something to embed. That is a foundational error.

Trovix's view is direct: the firms that survive this transition intact are those that treat AI governance as operational infrastructure, not a compliance checkbox. This means building systems that can evidence what your AI systems do, why they do it, who approved it and whether they stayed within guardrails. It means continuous monitoring of regulatory change—not once a quarter, but weekly, integrated into how your practice actually works. It means accepting that some AI use cases will need human sign-off not because regulation requires it yet, but because your risk profile demands it. Tools like Trovix Watch exist precisely because the FCA's own admission is that traditional rulemaking cannot keep pace. If you are waiting for the regulator to tell you whether your AI system is compliant, you are already behind. Trovix Audit lets you audit your own AI governance against existing frameworks (SRA Code, Consumer Duty, ISA UK) and catch drift before the regulator does. The firms deploying this infrastructure now—not as a cost centre, but as a competitive moat—will have answers ready the moment scrutiny arrives. Firms hoping for clarity from EC or FCA will not.

The practical action is immediate. Audit every AI system you currently use or plan to deploy over the next twelve months. Document: what decision or task does it automate, what data does it touch, who in your firm is accountable for its output, and how would a regulator react if they asked to see your working. If you cannot answer those questions in writing, you do not have governance. You have hope. Then, build a monitoring system for regulatory change that actually reaches the people who use AI in your firm—not just compliance officers reading FCA newsletters. When the Lloyd's Blueprint Two or updated PRA guidance on AI risk arrives, your fee-earners and claims handlers need to know within days, not months. Finally, start treating AI adoption as a governance decision, not a technology decision. The tool you choose (Microsoft Copilot, Harvey, a custom build) matters less than whether your firm can explain and defend how you use it. That is the real competitive advantage in a world where regulation lags reality.

Source: CNBC