Anthropic's public benefit fund and proposed safety measures sound reasonable in isolation. But Hassan Sajjad's point — that regulators, not AI companies, should set the rules — is not just academic. It is a direct challenge to how mid-market UK legal, insurance, financial services and accountancy firms are currently being sold AI. Too many vendors are positioning themselves as both the problem-solvers and the rule-makers. A law firm implementing Harvey or an insurer evaluating Luminance does not have a regulator-endorsed benchmark against which to measure vendor claims. The FCA's AI rulebook remains under development. The SRA has no statutory power to mandate AI governance in law firms. The PRA's approach to AI risk in financial institutions (PRA SS1/23) does not yet extend to most mid-market advisory firms. That vacuum is being filled by vendors themselves, which is the opposite of what should happen.
This story is part of a larger pattern: the regulatory lag. AI has moved faster than regulation, and vendors have filled the gap by setting de facto standards through their marketing, their APIs and their compliance documentation. Anthropic, OpenAI, and others are now realising that public safety commitments look good and may help with future regulation — but they still let vendors decide what 'safe' means in practice. Meanwhile, EU AI Act compliance is now live, and the ICO is issuing guidance on AI and UK GDPR. UK regulators are catching up. But they are doing so by asking firms to assess their own AI risks — which invites the exact problem Sajjad identifies: firms rely on vendor assurances instead of statutory boundaries. The result is fragmented, vendor-dependent compliance and no common baseline.
Our view is simple: AI tools are useful. Products like Trovix Sift have real value in document intelligence. But they cannot also be the source of governance. We built Trovix Audit because we believe governance and compliance must sit outside the vendor's commercial interests. When a firm uses an AI vendor's own safety framework to justify that vendor's use in client work, that is circular reasoning. It is not regulation. The difference between Harvey's internal safety protocols and a regulator-enforced standard is the difference between a promise and a requirement. Other vendors — including some claiming to offer 'explainable AI' — still rely on users to interpret their outputs correctly. That is better than a black box, but it is not governance. Governance is what the SRA Code, FCA Consumer Duty (PS22/9), and PRA standards require: documented, auditable, externally verifiable control.
What should a mid-market firm do now? First, stop waiting for your AI vendor to tell you how to govern their own product. Second, separate the tool from the compliance framework. Use the AI product — Sift, Copilot, Reach, whatever meets your workflow needs — but govern it through a process that sits outside the vendor relationship. Document your risk assessment. Define which work AI can touch and which it cannot. Build an audit trail. Third, track the regulatory curve. The EU AI Act is live. UK statutory instruments on AI governance are in draft. The FRC's updates to ISA UK now touch AI risk in audit. Your compliance framework should anticipate, not follow, those shifts. Fourth, use governance-first platforms — products designed to log and verify how AI is used — rather than trusting vendor dashboards alone. The firms that separate their AI procurement from their AI governance will find the regulatory transition far less painful than those who treat them as one decision.
Source: CNBC