The FCA has named the problem that kills responsible AI deployments: firms deploy technology first and build the cage around it afterwards. The regulator's October warning about generic platforms like ChatGPT and Gemini being used for financial advice is not really about those platforms themselves. It is about the 50 mid-market IFAs, investment banks, and wealth managers who have bolted AI chat tools onto client portals without understanding what those tools actually say or whether they constitute regulated advice. Under FCA Consumer Duty PS22/9, that is not a compliance gap. It is negligence. The firms using ChatGPT for client interactions have no audit trail of what outputs were given, no way to prove suitability assessments, and no governance layer between the client and an algorithmic guess. The FCA is right to alarm.

This story is part of a pattern the regulator has been signalling for eighteen months: the industry has mistaken AI adoption for AI governance. We saw it in legal services when firms licenced Luminance or Harvey without building the human review protocols those tools explicitly require. We are seeing it now in insurance underwriting, where Legora and similar platforms are being used to score risk without the governance frameworks that turn a pattern-matching tool into a defensible business process. The pattern is always the same: a vendor releases a capability, a firm downloads it, a marketing deck calls it 'transformation', and then three months later during a client complaint or regulatory probe, the firm discovers it has no way to explain what the AI did or why. The PRA's emerging AI risk framework and the incoming EU AI Act obligations make this approach unviable. Retrofit governance does not work because by then the decisions have been made and the clients have relied on them.

Here is what Trovix believes should happen instead. AI tools in regulated environments need to be architected for control-first deployment, not retrofitted with controls. That means: capture every output before it reaches a client; maintain a complete audit trail of inputs, model version, and reasoning; build human sign-off into the workflow as a mandatory step, not a nice-to-have; and make governance metrics real-time and visible to compliance teams. That is not what off-the-shelf ChatGPT gives you. It is also not what many point-solution tools deliver unless they are deliberately built for regulated environments. Trovix Reach was built with that architecture from the ground up because we knew from day one that UK financial advisers and insurance underwriters needed a client-facing AI that compliance could audit, not just a chat interface that worked well in a spreadsheet test. The difference is not theoretical. When the FCA examines your firm, they will ask for evidence. Generic tools do not produce evidence. Purpose-built ones do.

If you are running a financial advisory, insurance, or accountancy practice and you are using any unregulated AI for client advice or underwriting decisions, stop and audit today. Map exactly where the AI is making decisions that could be classed as advice or professional opinion under FCA or SRA rules. Then ask yourself: can I explain this output to a regulator? Do I have an audit trail? Is a qualified human signing off before the client sees it? If the answer to any of those is no, you have a governance failure that will not survive an FCA visit. Trovix Watch will alert you to the regulatory signals that matter — the FCA's recent guidance on AI in retail investments is explicitly part of that. But more urgently, you need to know whether your current AI tools have the control infrastructure regulators now expect. Trovix Audit can map that for you. The firms that will survive the next wave of regulatory tightening are not the ones with the fanciest AI. They are the ones that can prove their AI works within a governance system. Retrofit will not cut it.

Source: City AM