The FCA has named the problem explicitly: firms are retrofitting governance after AI technology deployment. This is not theoretical. Mid-market financial advisers, insurers, and law firms across the UK have done exactly this. They bought or built AI tools—usually generative systems like ChatGPT wrappers or basic RAG (retrieval-augmented generation) implementations—then scrambled to build monitoring, audit trails and consumer protection frameworks afterwards. Under FCA Consumer Duty (PS22/9) and equivalent obligations in insurance and legal services, this approach fails from the start. The regulator is now signalling enforcement pressure. What matters to you is this: retrofitting controls does not work. A system designed without compliance and governance built in cannot be made safe through post-deployment bolting-on.

This warning is part of a wider pattern. Over the past 18 months, we have watched three approaches to AI fail at different scales. First: the ChatGPT approach—generic, uncontrolled, unsuitable for regulated advice. Second: the basic RAG chatbot approach—knowledge-base Q&A with no audit, no governance, no accountability for outputs. Third: the retrofitted governance approach—which the FCA is now calling out directly. What survives this cycle are systems built from the ground up with regulated deployment in mind. Luminance, Harvey and similar tools aimed at legal and financial services succeeded because they started with compliance, not added it. The FCA's warning is a watershed moment: it is telling regulated firms that the era of 'launch and govern later' is over.

Trovix has approached this problem differently because we started by asking regulated firms what they actually need. Not what tech can do, but what compliance and Consumer Duty require. That distinction matters. When you deploy AI for document review, intake triage, or knowledge assistance, every output must be auditable, every decision traceable, and every user accountable. This is not just better than retrofitting—it is the only structure that survives regulatory review. Trovix Watch was built to do exactly this: monitor how your AI systems evolve and flag governance gaps before regulators do. Trovix Aria delivers knowledge assistance with full audit trails baked in, not added on. The difference is not marginal. It is the difference between a system a regulator can trust and one they will eventually scrutinise.

If you are running AI tools in legal services, insurance, financial advice or accountancy right now, do this: audit your governance framework against the FCA's specific criticism. Ask: when was this system designed? When was compliance governance added? Do you have full audit trails of every AI output and human decision point? If governance came after deployment, you have a real problem. You need to rebuild the system with compliance designed in, not tacked on. That is work. But it is less painful than an FCA investigation or a complaint from a consumer harmed by unaccountable AI. The alternative—waiting for guidance or softer enforcement—is not credible. The regulator has signalled. Act now.

Source: City AM