Nikhil Rathi is correct, and this matters urgently to you. The FCA CEO's July warning that traditional rulemaking cycles cannot keep pace with agentic AI is not abstract concern—it is a direct signal that UK regulated firms in law, insurance, accountancy and financial services will face regulatory uncertainty for the next 18 to 36 months. The old model—wait for rules, then implement—is dead. Firms that continue on that path will either face enforcement action for negligence, or will be caught holding expensive, inflexible AI implementations that breach frameworks nobody could have predicted. The FCA Consumer Duty (PS22/9), PRA SS1/23, and emerging EU AI Act compliance requirements already demand demonstrable human oversight, bias testing, and auditability. But these were written for narrow AI use cases. Agentic AI—systems that operate autonomously, make decisions, and learn in production—sits in the gaps. Regulators know it. The question is whether you do.

This is the third wave of a pattern we have watched closely. First came the vendor gold rush: chatbots plugged into firm data (often misconfigured), general-purpose LLMs like ChatGPT and Microsoft Copilot deployed without consent or data governance, retrieval-augmented generation products like Harvey and Luminance promising to 'transform' document review and legal research. They delivered speed. Many also delivered risk—data leakage, hallucinations in critical outputs, opacity that made audit trails impossible. Second came the compliance backlash: firms realised that SRA Code of Conduct 2019 rule C26 (competence) meant they could not trust a system they did not understand. ICO enforcement on UK GDPR processing became real. Third, now, is the regulatory bifurcation: the FCA and PRA are signalling that they will tolerate AI innovation, but only in environments where firms can explain every decision, prove bias has been tested, and demonstrate that humans remain in control. This is not a temporary position. It is the new normal.

Trovix's view is this: firms that succeed will be those that decouple compliance monitoring from AI implementation. You cannot wait for a perfect rulebook before deploying AI. You also cannot deploy AI and hope compliance catches up. Instead, build AI systems with compliance architecture built in from day one. This means: (1) Auditability first. Every decision—whether it is document classification in Trovix Sift, knowledge retrieval in Trovix Aria, or intake triage in Trovix Brief—must be logged, explainable, and human-reviewable. Harvey and Luminance are capable systems, but if your firm cannot audit why they chose a particular precedent or flagged a risk, you are exposed. (2) Governance over speed. A chatbot that runs at 10x velocity but operates in a black box is a compliance liability, not an asset. (3) Continuous regulatory tracking. Use Trovix Watch or equivalent tooling to monitor FCA guidance, PRA expectations, ICO decisions, and Lloyd's Blueprint Two developments in real time. Rathi's warning about regulatory lag means frameworks will shift. You need to know within weeks, not months.

Here is what to do on Monday morning. First: audit every AI system currently in use. If you cannot produce a compliance report that explains its inputs, decision logic, bias testing, and human override points, take it offline or restrict it to non-critical tasks immediately. Second: if you are evaluating AI vendors or building internally, make auditability and explainability non-negotiable requirements, even if it costs speed. Third: establish a regulatory liaison role or team—someone whose job is to track FCA Consumer Duty obligations, PRA SS1/23 model risk governance, EU AI Act scope (relevant if you have European clients or operations), and SRA compliance guidance weekly. The FCA's own AI Rulebook Project and the FRC's ISA UK standards on analytical procedures are moving targets. You must track them. Fourth: run a pilot with a vendor or tool that genuinely provides transparency—not one that hides complexity behind a slick interface. Compliance regret is expensive. Speed regret is more expensive.

Source: CNBC