The FCA issued a clear alert on 19 October: generic AI platforms like ChatGPT and Gemini are being used by consumers as financial advisers, and the firms building these systems are not treating them as such. There is no personal fact-finding, no suitability assessment, no ongoing monitoring — which means there is also no legal protection for the consumer when advice fails. For regulated firms in law, insurance, financial services and accountancy, this creates a direct problem. If your client receives material financial guidance from an unregulated AI chatbot and then acts on advice you have given that conflicts with it, you inherit both the compliance exposure and the reputational risk. The FCA Consumer Duty PS22/9 and PRA SS1/23 both require you to act in the consumer's best interest and ensure they understand what you are telling them. When they have already consulted ChatGPT on the same question, your duty does not end — it intensifies.

This is part of a broader pattern: the industry has deployed AI systems — often retrofitted into existing workflows — without rebuilding the governance architecture around them. Firms are choosing speed over rigour. They are monitoring outputs sporadically. They are failing to adapt detection thresholds as models change. The FCA is describing this as a governance and deployment failure, but it is actually a failure of honesty: firms knew AI could generate harmful content but treated governance as an afterthought. This matters because the same pattern is now bleeding into client-facing contexts. When Harvey, Legora, Luminance or Copilot are used by lawyers, accountants and underwriters, those firms are responsible for what those systems tell clients. Yet many are still treating AI governance as a technology problem rather than a regulatory one.

Here is Trovix's direct view: you cannot solve this by asking your AI vendor for 'compliance reassurance'. You need to build compliance into your AI deployment from intake through output review. The difference between a system that is auditable and one that is not is not the vendor's problem statement — it is your compliance framework. Firms that have retrofitted governance after deployment are now paying the cost of discovery, retraining and remediation. The right approach is different: define what advice or guidance your AI is and is not authorised to give. Build monitoring that actually tracks whether that boundary is held. Make your governance visible and testable. Trovix Audit is built exactly for this — it gives you a continuous view of AI behaviour against your regulatory thresholds, not a quarterly tick-box.

What should you do now? First, map every client-facing AI system in your firm and confirm whether it can generate advice (legal, financial, actuarial, tax). If yes, treat it as a regulated activity and apply the same governance as you would to a human adviser. Second, establish a baseline: what monitoring are you doing today? The FCA has found many firms doing none. Third, work with your AI implementation partner to build compliance metrics into the system — not as a layer on top, but as part of the design. If your vendor pushes back on transparency or auditability, assume they have not built it in and plan accordingly. Fourth, use Trovix Watch to track FCA guidance evolution on this topic — it is moving fast and you need early warning.

Source: City AM