When Nikhil Rathi says the traditional cycle of rulemaking 'doesn't work' anymore, he is telling you something critical: the FCA cannot regulate your AI implementation into safety. The regulatory framework that governed algorithmic trading in 2015, or robo-advice in 2018, moves at a pace that was always glacial. Agentic AI — systems that make decisions autonomously — has made that lag catastrophic. For mid-market law firms, insurers, financial advisers and accountancy practices, this admission from Europe's top banking regulator means one thing: regulatory approval will not arrive in time to make your AI deployment decisions for you. You will have to decide for yourself what responsible AI implementation looks like. That decision—and your documented reasoning behind it—will matter enormously when the rules finally catch up.

This is not a temporary problem. We are watching the institutional response to innovation failure in real time. The FCA published its AI roadmap. The PRA issued SS1/23 on AI governance. The SRA published guidance on legal tech. The ICO issued its framework on UK GDPR and AI. Yet here we are in October 2026, and the regulator's own chief is saying the framework doesn't work. That's not a gap in regulation. That's a systemic admission that the old model—regulate after problems emerge—is broken when the technology moves this fast. The EU AI Act exists. It is also already behind the curve. Every regulated firm is now operating in a space where you have some rules, many grey areas, and genuine uncertainty about what compliance will actually mean when enforcement arrives. This is the new normal.

The honest truth: not all AI implementations are equal, and the market has not caught up to this reality. Tools like Harvey (legal document analysis), Luminance (litigation and compliance review) and Microsoft Copilot (document automation) all claim to handle regulated work, but they handle it very differently. Harvey has published detailed governance documentation. Luminance focuses on explainability for audit trails. Copilot relies on your firm's own guardrails. Some products are built for a world where auditors and regulators will scrutinise every decision. Others are not. The critical difference is not the model or the vendor—it is whether the implementation includes verifiable compliance architecture from day one. You need to know: does your AI tool produce an audit trail that would satisfy the FCA Consumer Duty PS22/9 requirements for fair outcome testing? Can you demonstrate, in writing, how it avoids breaching SRA Code? Is there a governance layer built in, or are you bolting it on afterwards? Most firms do not ask these questions until after deployment. That is backwards. Trovix Audit exists precisely because mid-market firms need to know, before they go live, whether their AI implementation will withstand regulatory scrutiny. Not because the rules are clear—they are not. But because you can document your reasoning, your controls, and your testing so that when the rules do crystallise, you have evidence of good faith compliance effort.

Here is what to do on Monday morning: do not wait for the FCA to finish writing the rulebook. Do audit your current AI use (if you have it) and your planned AI use (if you don't yet) against the frameworks you do have: the Consumer Duty, SRA guidance, ISA UK (for audit firms), the PRA's expectations, and the ICO's AI transparency principles. Document your risk assessment. Establish what you will measure, how you will measure it, and how often. Treat this as a governance problem, not a vendor problem. Your AI provider's claims about compliance are not enough—you need to own the compliance architecture. Set up a regulatory watch function: what is the FCA actually saying about AI now, and how does that change your risk profile? Trovix Watch does this. Finally, bring this to the board as a risk management issue, not a technology issue. Your firm's reputation and regulatory standing depend on how you implement AI over the next twelve months, not on whether Rathi and his regulators finish the rulebook.

Source: CNBC