The FCA's warning this week about unregulated AI financial advice is not really about ChatGPT or Gemini. It is about the firms that have deployed AI systems first and asked compliance questions later. The regulator's specific concern—that some firms have 'retrofitted governance after technology deployment'—cuts to the heart of how many UK regulated businesses are still approaching AI in 2026. If you operate in legal, insurance, financial services or accountancy, this warning is directly about your risk. The Consumer Duty (PS22/9) requires you to put consumer interests at the heart of everything, yet AI systems rolled out without proper governance frameworks actively work against that principle. This is not a theoretical problem: the FCA is flagging live failures happening now.

This story reflects a pattern we have watched play out across the regulated sector for three years. When tools like Harvey, Luminance and Legora arrived, many firms saw competitive pressure to deploy fast. The governance conversation—how you monitor for drift, hallucination, bias, and regulatory drift in your AI systems—was treated as something to add later. It rarely worked. Microsoft Copilot in regulated environments has shown us this pattern repeatedly: brilliant capability, then a scramble to retrofit controls that should have been built in from the start. The FCA is now saying what should have been obvious: you cannot buy your way out of this problem by bolting on compliance dashboards after go-live. The EU AI Act's impact on UK firms, the PRA's expectations on model governance (SS1/23), and the SRA's push on technology competence all point to the same destination—pre-deployment governance is non-negotiable.

Trovix's view is simple and unpopular with some: if your AI system cannot be audited before you deploy it, you should not deploy it yet. This means building governance into your implementation from day one, not as an afterthought. Trovix Audit exists precisely because we saw too many firms discover governance gaps six months after deployment, when they had already trained their teams, embedded workflows and built client dependencies. The difference between retrofitting and building right matters. For client-facing AI like Trovix Reach, we run full governance compliance checks before any customer sees the system. For knowledge work, Trovix Aria includes audit trails and monitoring from day one because we learned that 'we'll add logging later' is a governance fiction. This is slower at launch. It is also defensible.

If you are a mid-market regulated firm, do this now: stop treating AI governance as a post-deployment problem. Ask your AI vendors—whether it is Trovix, your existing provider, or anyone else—to show you their pre-deployment compliance framework. What happens before your team sees the system? How is drift monitored? What audit trail exists? If the answer is 'we add that later', walk away. Second, conduct an honest audit of any AI systems already in use. If they were deployed without formal governance checks, that is your current regulatory exposure. Third, involve compliance and risk from the very first conversation about new AI, not after the build is finished. The FCA is watching. The SRA is watching. Your clients deserve better than systems that work brilliantly until they fail expensively.

Source: City AM