Nikhil Rathi's comment that traditional rulemaking cycles are broken in the era of fast-moving AI is not a regulatory cop-out. It's a confession that the FCA, PRA, SRA and ICO are playing catch-up, and when regulators catch up, they catch up hard. The EU AI Act is already in force. The FCA's guidance on AI (TFPR and SYSC updates) is tightening. UK-regulated firms in law, insurance, financial services and accountancy are currently operating in a window where AI adoption is not yet heavily policed—but that window is closing. Any firm that has deployed ChatGPT, Claude, Copilot or generic agentic AI without documented governance, data handling controls, and output validation will soon face uncomfortable questions from compliance teams and regulators.

This story is part of a pattern we see across the sector: firms bought the AI hype, bought the tools, and skipped the governance. They deployed Harvey or Luminance without asking hard questions about how the model was trained, what data feeds it, whether its outputs are auditable, or how conflicts of interest are managed. The result is a generation of AI implementations that work in pilots but fail in production because they were never built for regulated environments. The pattern will accelerate as agentic AI systems—which make autonomous decisions without human review—become mainstream. Regulators are signalling loudly that they will not tolerate black-box decision-making in lending, underwriting, claims handling, or legal advice. The rules are not yet written, but the direction is unmistakable.

Trovix's answer to this problem is not to wait for the rules to stabilize or to buy the flashiest vendor tool. It's to build AI systems that are governance-first, not governance-afterthought. Tools like Harvey or Microsoft Copilot are trained on broad data and optimized for speed—they solve writer's block and pattern recognition brilliantly, but they don't solve the question that regulators will ask: can you prove this output is safe and compliant? Trovix Watch exists because regulatory change is accelerating and firms need to track it. But more importantly, Trovix Audit exists because if you're going to deploy AI in a regulated firm, you need to prove it works correctly before it touches client data, and you need to log and validate every decision it makes afterward. That's the difference between an AI tool that works in a demo and one that survives an FCA probe.

For a mid-market legal firm, insurance underwriter, financial adviser or accountancy practice, the practical move is this: audit your current AI use today. If you cannot answer these questions for each AI tool in use, you have a problem: What data trained this model? Who owns the output—you or the vendor? Can you explain why the AI recommended X and not Y? What happens when the AI makes a mistake? How do you validate its work before it reaches a client or enters a file? If you cannot answer those questions, you need to either replace the tool or put human review in place immediately. Then, start building a compliance framework now, before the regulators write one and impose it. Trovix Brief can help you automate intake and triage safely because it's designed around compliance from the start, not bolted on after. This is not theoretical risk—it's the cost of regulation catching up.

Source: CNBC