The FCA's warning published this week targets a real and growing problem. Firms — and their clients' end-users — are increasingly turning to generic large language models like ChatGPT and Google Gemini for financial advice without any institutional oversight, appropriate disclaimers, or consumer protection frameworks. What matters here is not the tools themselves but the gap: regulated firms are failing to govern how these tools are used, and some have only retrofitted compliance measures after deployment was already underway. Under FCA Consumer Duty PS22/9, regulated firms remain liable for outcomes affecting their customers, whether the advice comes from a human adviser or a machine. The regulator's alarm is not misplaced. It is a direct signal that the pattern of 'deploy now, govern later' has become regulatory risk.

This story sits within a much larger shift in how regulators view AI across the UK ecosystem. The FCA is not alone: the SRA is tightening its Code expectations on competence and technology oversight; the PRA's SS1/23 guidance makes clear that governance must precede deployment, not follow it; and the broader momentum toward the EU AI Act creates baseline consumer protection expectations that the UK regulator will eventually mirror. What this reveals is that the industry is still caught between two timelines. Technology teams move fast and deploy systems to gain competitive advantage. Compliance and risk teams move deliberately and require evidence, testing, and documented controls before sign-off. Firms that have treated this tension as something to manage retrospectively are now facing FCA scrutiny. Firms that build governance into the procurement and design phase are ahead.

We've observed this pattern across dozens of mid-market firms across legal, insurance, financial services, and accountancy. Many purchased or integrated AI tools to improve intake, research, document review, or client advisory work without first establishing how those systems would be monitored, updated, or audited. Some deployed chatbot interfaces without clarity on what they could and could not do. Some used generic LLMs like ChatGPT directly on client data without considering data residency, confidentiality, or regulatory perimeter questions. The honest truth: ChatGPT, Gemini, and other general-purpose models are powerful but they are not fit for regulated financial or legal advice in their out-of-the-box form. They hallucinate. They drift. They cannot explain their reasoning in ways that satisfy a regulator or an auditor. Purpose-built systems with retrieval-augmented generation (RAG) architecture — like Trovix Aria — solve this differently. They are designed to sit behind a regulatory perimeter. They draw answers from your own approved knowledge base, not the open internet. Every interaction is logged, traceable, and defensible. Governance is not retrofitted; it is built in from the first deployment.

If you are a mid-market regulated firm and you have AI systems in production right now, act this month. First: audit what you have. Which AI tools are your teams using? Where is client or customer data flowing? What governance framework, if any, is in place? Second: classify the risk. Financial advice tools and legal advisory tools carry higher regulatory risk than process automation. Systems that touch client data carry higher risk than those that don't. Third: prioritize remediation. Start with the highest-risk tools. For systems that must be kept, embed proper monitoring and approval workflows. For systems that don't meet your regulatory standard, replace them. And when you do deploy new AI — whether for document intelligence, matter intake, research, or client-facing advice — make governance and auditability non-negotiable from day one. The FCA has made clear that the cost of remediation is now higher than the cost of doing it right upfront.

Source: City AM