The FCA's October warning cuts to the heart of a compliance failure that most UK financial services firms have not yet admitted they are making. Generic AI platforms like ChatGPT and Gemini are being used by consumers to make material financial decisions — and while the platforms themselves are not regulated for financial advice, the firms whose data and context they absorb are still liable. But the deeper problem the regulator has identified is architectural: many firms have deployed AI into client-facing workflows, internal processes and decision support without building governance, audit trails, bias testing or explainability controls into the system from the start. They have bolted compliance onto technology rather than building technology inside a compliance framework. Under FCA Consumer Duty PS22/9 and the PRA's SS1/23 principles on outsourcing and third-party risk, that is not just poor practice — it is a regulatory gap that will attract enforcement action.

This is part of a wider pattern across UK regulated sectors. Law firms using Harvey or Legora for case prediction without documented bias testing. Insurance firms deploying Luminance for claims triage without transparency logs that meet FRC ISA UK standards. Accountancy practices integrating Microsoft Copilot or other generative tools into tax advice workflows without clear audit trails. In each case, the technology arrived faster than the governance framework. The vendors often promised safety and compliance, and firms believed them because they wanted to believe them. The result: organizations are now scrambling to retrofit the very controls they should have designed upfront. The FCA's statement is not a warning about AI itself. It is evidence that the industry has skipped a step.

Trovix's approach starts from a different place. We do not retrofit governance to AI — we build AI inside governance. Before any of our tools touch client data or operational workflows, the control framework exists: role-based access, audit logging that meets ISO 42001 standards, explainability records for every decision, drift monitoring, bias testing, and a clear audit trail for compliance reporting. This is why Trovix Watch sits upstream of deployment: it helps firms understand what regulatory changes (like the FCA's own updated guidance on AI use in financial advice) mean for systems already live. And why Trovix Audit exists as a separate layer — to give you the governance dashboard the FCA is now expecting. We have also seen firms try to fix this by adding generic governance platforms on top of off-the-shelf AI tools. That does not work. You cannot audit your way out of poor architecture. You have to design right from the start.

If you are a mid-market financial services firm, insurer, law practice or accountancy business reading this, do not wait for the FCA to visit. Audit every AI tool and system in use right now — including the vendor-supplied ones that promised compliance out of the box. If you cannot produce a complete audit trail, bias test results, documented control points and an explainability record for every output your AI system generates, then it does not meet the standard the regulator is now enforcing. If you are about to deploy a new AI tool, build the governance first. If you are considering AI for client-facing advice or material decision support, design for regulatory compliance before you design for speed. The firms that treat this as a box-ticking exercise will face either enforcement action or worse: clients discovering that your AI gave them advice with no auditable justification, no bias check, and no human oversight trail. That is not innovation. That is negligence.

Source: City AM