Nikhil Rathi's candid admission in July crystallised what many in regulated firms have quietly suspected: the traditional cycle of rule, implementation, audit, repeat no longer works when agentic AI can fundamentally reshape a business process in weeks. The FCA Consumer Duty PS22/9, SRA Code, and PRA SS1/23 were written for a different pace of change. Agentic systems—AI that can make autonomous decisions about document review, underwriting, or transaction monitoring—operate at machine speed. Regulators operate at bureaucratic speed. This gap is not a temporary friction. It is the new operating environment for any UK legal, insurance, financial services or accountancy firm deploying AI at scale. And it means regulatory uncertainty is now a permanent feature, not a bug to be fixed when the EU AI Act finally settles into UK law.

This story is part of a larger pattern: regulators are exhausted. The Financial Conduct Authority, the Prudential Regulation Authority, the Solicitors Regulation Authority, and the Information Commissioner's Office are all genuinely trying to build frameworks that protect consumers while allowing innovation. But they are fighting against exponential change with linear institutions. The result is a three-tier compliance world emerging: large firms with dedicated AI governance teams and lawyers on retainer; mid-market firms scrambling to retrofit governance into systems already in production; and smaller practices either ignoring AI entirely or adopting consumer-grade tools like Microsoft Copilot with no institutional controls whatsoever. The regulatory response, when it comes, will likely be blunt—mandatory governance frameworks, liability caps, audit trails, and documentation requirements that favour the first group while punishing the second and crushing the third.

Here is Trovix's honest view: waiting for the rules to clarify is a losing strategy. Instead, firms need to adopt what we call 'governance-first AI implementation'—building systems that are auditable, traceable, and compliant with emerging standards (ISO 42001, Lloyd's Blueprint Two for insurance, and the incoming UK AI Bill provisions) from the start. This is not about using off-the-shelf chatbots like Harvey or Legora for document review and hoping it works. Those tools are excellent at specific tasks, but they do not give you the institutional control layer you will need when the FCA comes calling. It is not about Luminance's document intelligence either—smart, yes, but again: detection without governance is just deferring the problem. You need systems designed with compliance as a first-class citizen. Trovix Audit exists precisely for this moment: to give mid-market firms a live, auditable view of what their AI systems are actually doing, who is using them, what decisions they are influencing, and how those decisions trace back to policy. And Trovix Sift handles document extraction with full chain-of-custody logging—not just the output, but the reasoning. That is the difference between a tool and a compliant system.

What should a mid-market law firm, insurance underwriter, or financial services practice do right now? First, audit your existing AI deployments. If you are using Copilot, ChatGPT, or any LLM-as-a-service without logging, you are building regulatory liability, not efficiency. Second, map what decisions your AI systems influence: case triage, claims assessment, underwriting recommendations, due diligence speed-scoring. These are not nice-to-have audit trails—under PRA SS1/23 and the evolving Consumer Duty regime, they are mandatory. Third, if you are planning new AI work, demand governance by design. Not bolt-on governance. Not 'we will audit it later'. Built in. The firms that move first on this—not first on AI, but first on compliant AI—will have immense competitive advantage when regulatory enforcement begins. And it will begin. Rathi has just told you it will.

Source: CNBC