The FCA's warning about unregulated AI financial advice is not really about ChatGPT or Gemini. It is about your firm. When the regulator says businesses are 'retrofitting governance after technology deployment', they mean you have probably already done this—or are planning to. A partner uses an LLM to draft client emails. A junior pulls investment insights from a generic platform. A compliance officer runs a one-off audit after six months. None of this is intentionally reckless. It is just how the AI industry has sold adoption: fast deployment first, controls later. The FCA is signalling that this approach now carries real regulatory risk, particularly in financial services where the Consumer Duty (PS22/9) already demands you understand how your tools affect client outcomes. Mid-market firms in legal, insurance, and accountancy are in the same position. You do not have the resources of a global bank to absorb a £10m fine. This story is your deadline.

This warning sits within a pattern that has been building for 18 months. The ICO has been quietly tightening UK GDPR enforcement on AI training data. The PRA's SS1/23 guidance on operational resilience is being read (correctly) as applying to AI systems. The EU AI Act is weeks away from enforcement and will reshape how UK firms think about risk classification. What used to be a nice-to-have—proper AI governance—is now table stakes. The difference is that most firms still believe governance means ticking boxes after implementation. They hire external consultants to run an ISO 42001 audit. They install Luminance or Harvey to handle documents with more transparency than ChatGPT. They assume the tool vendor is responsible for safety. None of this is wrong, but all of it is incomplete. Governance that starts after deployment is always reactive. You end up managing risk, not preventing it. The firms winning this transition are thinking about AI governance before they choose the tool.

Here is Trovix's honest view: governance and capability are not separate. If your AI system cannot explain its decision-making, or if you cannot audit what it trained on, or if it does not fit within your existing regulatory framework, then it is not a capability gain—it is a liability dressed as automation. The difference between a tool like Luminance (which focuses on document-level transparency) and a system built from the ground up with governance baked in is material. Luminance tells you what a contract says. A properly governed AI system also tells you why it was chosen, who can see the result, and whether it meets your PRA, FCA, or SRA obligations. This matters especially for client-facing work. A tool like Copilot can draft emails faster, but if you cannot show the FCA how you vetted it, tested it, or monitored its outputs for bias, then you have just outsourced your liability. Trovix Audit exists because we saw mid-market firms getting this backwards. You need a governance dashboard that runs in parallel with your AI tools, not after. You need to know before you go live.

The practical next step is not to pause AI. It is to stop treating AI implementation as a procurement decision and start treating it as a governance design challenge. This week, audit which AI tools your staff are already using. (There will be more than you think.) Then map them against your actual regulatory obligations—not the vendor's marketing material. For a financial services firm, that means Consumer Duty, FCA Handbook, and COBS. For a law firm, it means SRA Code and liability insurance terms. For an insurer, it means PRA SS1/23 and regulatory reporting. Do not ask: 'Is this tool compliant?' Ask: 'Can I prove this tool is compliant?' If the answer is no, you have a gap. Trovix Watch can help you track what the FCA, ICO, SRA, and PRA are actually requiring month by month, because the rules are moving faster than most AI vendors can keep up with. But the real work is internal. You need a single source of truth for which AI systems are in use, who owns them, what data they touch, and how you monitor them. That is not optional anymore.

Source: City AM