FIS and Anthropic's AI agent entered commercial use this week, five months after their partnership announcement. The story is not about the capability. The story is that when this agent makes a mistake—and agents do make mistakes—the bank deploying it remains fully accountable under FCA Consumer Duty PS22/9 and PRA SS1/23. The FCA and PRA have been explicit: outsourcing an AI decision does not outsource a firm's compliance obligation. Yet most mid-market financial services, insurance and legal firms we talk to have no documented governance framework proving they can audit, explain or override an AI agent's decision when it matters. That is the real risk FIS's launch has just crystallised for the rest of the market.

This story is part of a larger pattern. The industry has spent two years racing to deploy AI agents—in banking, in legal practice, in insurance underwriting—with the assumption that the technology vendor's reputation acts as a proxy for safety. It does not. Harvey and Legora have sophisticated AI products for legal work, and they are genuinely useful. Luminance excels at document intelligence. But none of these firms can absorb your firm's regulatory liability if something goes wrong. The difference between a tool (like document review software) and an agent (like a banking chatbot or claims triage system) is that agents make decisions on your behalf. When they do, governance becomes non-negotiable. The FCA's recent focus on third-party AI risks in its latest guidance makes this clear: having a good vendor is not the same as having good controls.

Here is our honest view: most AI agent implementations in UK regulated firms are built on a shaky foundation. They lack the governance layer that regulators now expect. PRA SS1/23 requires firms to understand and document model risk. ISO 42001 (which leading UK practices now reference) demands transparent AI risk management. Yet we see law firms, insurers and accountancies deploying Copilot agents, custom LLM automations and third-party AI agents without the audit trail, version control, or decision logging that would survive an FCA examination or an ICO UK GDPR complaint. The difference between Trovix's approach and many others is that we build governance into implementation from day one. Trovix Audit is designed specifically for this: to give regulated firms the documentary evidence that they have understood, tested and overseen their AI agent before it makes a decision that affects a client or a compliance obligation.

If you run a mid-market firm—whether you are a managing partner at a 50-person legal practice, an underwriting manager at a specialist insurer, or a partner at an accounting firm with regulatory oversight—your action this month should be to audit your existing AI agent deployments against these questions: Can we explain how this AI reached this decision? Can we override it? Do we have a log of its mistakes? Do we know what data it was trained on? Do we have a fallback if it fails? If the answer to any of these is 'no', then you are exposed. FIS's agent launch is not a warning about their technology. It is a signal that regulators are watching how firms govern third-party AI. Trovix Watch can help you monitor the regulatory changes coming around AI agent liability. But more urgently, you need to map your current AI use and plug the governance gaps now, before the FCA or PRA makes this a formal expectation in guidance or examination.

Source: Forbes