When the FCA's own CEO tells CNBC that traditional rulemaking cycles cannot work with fast-moving AI technology, mid-market UK regulated firms should stop expecting a regulatory safety net. Rathi's candour—echoed by European bankers and regulators—signals that the old model of compliance-by-rule-book is broken. The Consumer Duty, SRA Code, PRA SS1/23, and the EU AI Act are real constraints, but they are floor requirements, not a complete governance map. For legal practices, insurers, financial services firms and accountancies, this means one hard truth: regulatory frameworks will always lag behind what your AI systems are actually doing. The FCA is effectively saying it cannot keep up. That responsibility now falls on you.

This is not new panic, but an inflection point. We have watched three years of AI vendors—from Harvey to Luminance to Copilot-based solutions—sell speed and automation without forcing firms to ask hard questions about governance, audit trails, or explainability. Many mid-market firms deployed these tools into production with compliance assumptions that looked reasonable on paper but crumbled under real-world scrutiny. The gap between what an LLM or agentic AI system can do and what regulators can meaningfully oversee has widened faster than anyone predicted. European policymakers are now grappling with the fact that supporting AI adoption and containing systemic risk are in genuine tension. That tension will not be resolved by regulation alone. It will be resolved by firms that choose to over-govern their AI rather than under-govern it.

Trovix's approach starts from this uncomfortable truth: compliance-first AI implementation is the only rational choice for regulated firms in 2026. This means building governance infrastructure—audit logs, decision explainability, human override protocols, continuous monitoring—before you scale AI, not after. Trovix Audit was built because firms told us they were deploying AI systems with no clear view of how decisions were being made. The alternative products in the market—Luminance, Harvey, and mainstream enterprise AI—excel at capability and speed. They solve real problems. But they assume a compliance team with the bandwidth and technical knowledge to retrofit governance onto a live system. Most mid-market firms do not have that. Trovix Watch monitors the regulatory landscape so you know what rules are changing. But governance has to come first, because by the time a new regulation lands, your AI should already be meeting it.

Here is what you should do this month. First, audit any AI system currently in production in your firm—whether it is ChatGPT, Harvey, Copilot, or a bespoke build—against the specific governance gaps: Do you have a complete audit log of every decision? Can you explain why a particular action was taken or rejected? Is there a human sign-off gate for high-stakes outputs? Do you know what happens when the AI makes a mistake? Second, do not wait for the FCA, ICO, or FRC to clarify expectations. They cannot. Instead, use ISO 42001 and Lloyd's Blueprint Two as your north star, plus sector-specific frameworks like the ICO UK GDPR guidance on automated decision-making. Third, talk to your regulator now—not when something goes wrong—about your AI governance roadmap. Fourth, build or acquire tools that give you real-time visibility into how your AI systems are behaving. Compliance theatre—reports that look good on paper but do not reflect reality—will not survive regulatory scrutiny or operational failure.

Source: CNBC