The FCA has finally said what it needed to say: firms are deploying AI systems—especially consumer-facing advisory tools—and then hoping governance catches up. This is not a minor process gap. When a law firm, insurer, accountancy practice or financial services firm deploys a ChatGPT integration or similar generic chatbot to handle client queries without baseline controls in place, it is exposing itself to two problems at once. First, the regulatory one: the FCA Consumer Duty PS22/9 requires that firms understand what their tools do, how they fail, and who bears the cost when they do. Second, the business one: when a generic large language model gives tailored-looking advice that happens to be wrong, your firm's liability does not wait for your governance framework to be built. The FCA is not being alarmist here. It is describing what it is already seeing: firms that decided to move fast and retrofit compliance later.

This is the industry pattern that matters. A bank or law firm buys a productivity tool—Copilot, Claude, Gemini, or a third-party wrapper around them—with the genuine intention of improving efficiency. The business case is straightforward. But somewhere between procurement and deployment, the question of whether this tool is actually giving financial advice, legal advice, or personalised guidance gets lost. Is it? Often yes. The vendor's marketing says it is not an advice tool, just an assistant. But if your client reads the output and acts on it, the distinction collapses. Meanwhile, regulated firms have watched unregulated platforms like Gemini and ChatGPT accumulate millions of users seeking exactly this kind of guidance, with zero oversight, creating a false sense that the regulatory bar is lower than it actually is for licensed firms. It is not. The FCA's willingness to name this publicly signals that enforcement is coming, and coming soon.

Here is Trovix's honest position. Generic large language models are not fit for regulated advisory use without human involvement, output validation, and documented reasoning trails. They hallucinate, they generalize, and they cannot explain their reasoning in ways that satisfy regulatory scrutiny. If you are using ChatGPT or similar as a direct consumer interface for advice, you are not implementing AI responsibly—you are outsourcing your professional judgment to a vendor you do not control and cannot audit. This is different from using AI to improve internal efficiency, flag documents for human review, or assist fee-earners who remain responsible for the output. Tools like Trovix Aria are built on retrieval-augmented generation with your firm's documented knowledge as the ground truth, which means the output is traceable, defensible, and under your control. That is not a marketing distinction. That is a regulatory one. When the FCA asks you to explain how your AI tool works, you need to be able to point to your own data, your own rules, and your own oversight—not a third-party LLM's training corpus.

If you are a mid-market firm, your action list is short and urgent. First: audit any AI tool or chatbot currently in client-facing use. What exactly is it being asked to do? Is the output being validated by a qualified professional before it reaches the client? Is there an audit trail? If the answer to any of these is no, you have a governance failure. Second: if you plan to deploy AI in advisory contexts, do not retrofit governance after go-live. The firms the FCA is warning about did exactly that, and they are now in the position of having to explain to a regulator why they chose to operate for months without a compliance framework. Build the framework first. That means understanding your firm's liability under the relevant regulatory regime—FCA Consumer Duty PS22/9 for financial services, SRA Code for legal, PRA SS1/23 for insurance—and designing the AI system to operate within it from day one, not afterwards. Third: distinguish between tools that augment human judgment (defensible, necessary, valuable) and tools that replace it (indefensible, expensive, and increasingly targeted by enforcement). The difference is whether a qualified professional remains accountable for every output that touches a client.

Source: City AM