When the FCA's CEO tells CNBC that 'the traditional cycle of rulemaking doesn't work' in the age of agentic AI, he is effectively admitting that the regulatory model built over three decades is broken. This is not hyperbole. It matters enormously to you if you run a law firm, insurance broker, asset manager or accountancy practice in the UK. The Consumer Duty (PS22/9) and PRA SS1/23 frameworks assume you operate within a stable set of rules. They do not. Within 18 months, the specific AI systems you deploy today—whether built on RAG architectures, fine-tuned language models, or autonomous workflows—will face new regulatory expectations that do not yet exist. The European regulators quoted in this piece know it. The question is whether you do.

This story is the natural end point of a pattern that started in 2023. First came the panic: 'AI will disrupt everything, we must regulate immediately.' Then came the confusion: conflicting frameworks from the FCA, the ICO, the SRA, and Brussels. Then came deployment: thousands of UK firms bought ChatGPT subscriptions, bolted Copilot onto their workflows, or signed contracts with vendors like Harvey and Luminance without understanding what they were actually embedding into their compliance systems. Now comes the uncomfortable truth: regulators moved so slowly that they are now legislating for yesterday's technology. Agentic AI—systems that operate independently across multiple tasks with minimal human supervision—barely existed when most current frameworks were drafted. The EU AI Act is already behind the curve. The FCA's approach is three years behind deployment.

Trovix's position is this: waiting for regulators to catch up is a losing strategy. Instead, build compliance systems that are inherently adaptive. This means moving away from point solutions—Harvey for due diligence, Luminance for document review, Copilot for general tasks—that solve individual problems but create fragmented audit trails and inconsistent governance. It means implementing systems built on continuous regulatory monitoring and risk-based assurance, not static checklists. Trovix Watch exists precisely because the regulatory landscape is now too volatile for annual compliance updates. If your firm is still conducting compliance audits twice a year against a fixed baseline, you are already out of date. You need real-time visibility into how your AI systems interact with evolving regulatory expectations—particularly as the EU AI Act moves into enforcement phase and the FCA issues guidance on PRA SS1/23 interpretation. The vendors offering 'AI-powered compliance' without this adaptive layer are selling you yesterday's risk management.

Here is what you should do on Wednesday, 14 October 2026. First: audit every AI system in your firm—including Copilot, ChatGPT, and internal tools—and map it against FCA Consumer Duty, SRA Code, ICO GDPR guidance, and draft EU AI Act enforcement expectations. Second: stop buying AI products that promise to 'solve compliance' and start demanding systems that show you *why* a decision was made, how it relates to current regulatory risk, and what changes in regulation will affect it. Third: implement intake, document handling, and knowledge systems that generate auditable compliance evidence as a byproduct of work, not as an afterthought. Trovix Brief and Trovix Sift are built this way. Fourth: schedule a regulatory risk review for Q1 2027, when the full implications of the EU AI Act enforcement timeline become clear. Your competitors are already doing this. Those that are not will face enforcement action before regulators finish writing the rulebook.

Source: CNBC