The FCA's statement this week is not a gentle suggestion. It is a direct warning that too many firms are treating AI as a technology problem when it is a regulatory problem. Mid-market financial services firms, legal practices, insurers and accountancy firms are increasingly handing client interactions to ChatGPT, Gemini and other generic large language models without proper governance, audit trails or compliance documentation. The regulator is saying what we already know: retrofitting controls after deployment does not work. This matters because under FCA Consumer Duty PS22/9 and equivalent frameworks across the SRA Code and ICO UK GDPR, you are legally responsible for what your AI does—whether you built it or borrowed it. Generic AI platforms do not know your regulatory obligations. They do not know your client's personal circumstances. They certainly do not know whether they are giving advice or making recommendations. And they leave no audit trail that proves you did due diligence.

This is part of a pattern we see every quarter. Firms adopt powerful AI tools, use them to speed up client work or reduce headcount, and only then ask whether they are compliant. Harvey, Luminance and other dedicated legal AI products succeeded because they were built by people who understood law and regulation. They still required implementation governance, but at least the foundation was there. Generic chatbots have no such foundation. The EU AI Act is coming. ISO 42001 certification is becoming table stakes for regulated firms. The FCA, PRA SS1/23, and ICO are all moving toward mandatory AI risk registers and third-party audit frameworks. This news story is the regulator signalling that the period of regulatory ambiguity is ending. Firms that have not yet embedded AI governance into their operations will face scrutiny soon.

Trovix's view is clear: if you use AI to serve clients or process regulated work, AI governance must come first, not last. That means a documented risk assessment before you deploy anything—not after. It means understanding what the tool actually does, what it cannot do, and where human judgment is non-negotiable. It means audit trails and monitoring. Tools like ChatGPT are powerful and useful, but they are consumer tools. Using them for regulated client advice without wrapping them in compliance infrastructure is not integration; it is exposure. This is why we built Trovix Audit—not to slow firms down, but to give them real-time visibility into how their AI is behaving, what it is recommending, and whether it is staying within approved guardrails. This is also why firms using tools like Microsoft Copilot in regulated contexts need to treat them as intake tools for human review, not as final decision-makers.

What should you do on Monday morning? First, audit what AI you are actually using. Include ChatGPT, Claude, Gemini, Microsoft Copilot, and any custom tools. Second, for each tool, document what data it touches, what decisions it influences, and who is accountable if it goes wrong. Third, build a governance framework around it—not a policy document, but a living dashboard that tracks performance, exceptions and compliance. Fourth, if you do not have the internal resource, bring in external review now, while regulators are still signalling rather than enforcing. The firms that treat this as a compliance project rather than a technology project will differentiate themselves over the next 12 months. The ones that do not will spend 2027 explaining to the FCA why they did not.

Source: City AM