The Financial Conduct Authority's warning this week is not really about ChatGPT and Gemini. It is about you. The FCA is saying that UK regulated firms — the ones you work with, the ones you are regulated with — have deployed AI systems without proper governance frameworks in place and are now scrambling to retrofit compliance controls after the fact. This matters because the Consumer Duty (PS22/9), the Senior Managers Regime, and the UK AI Act now require firms to demonstrate meaningful human oversight, explainability, and continuous monitoring of AI systems before they go live. If your firm has implemented AI tools and then asked compliance to figure out how it fits the regulatory framework, you are exactly the problem the FCA is flagging. And you are exposed.

This is not a temporary problem born of haste. It reflects a fundamental misunderstanding about how AI governance differs from traditional technology risk. Many firms treat AI the way they treated software implementation in 2010: purchase the tool, deploy it, then document it. This approach worked because software was deterministic and could be tested exhaustively before launch. AI systems change their outputs based on training data, prompt engineering, and user interaction patterns. The FCA's observation that firms have 'failed to adapt monitoring as systems change' is the real alarm. Generic models like Gemini and ChatGPT used for financial advice are the obvious problem, yes. But the deeper crisis is that regulated firms using more sophisticated platforms — whether Harvey for legal work, Luminance for document review, or Microsoft Copilot for client-facing deployment — are making the same mistake. They assume deployment is the end of the governance conversation rather than the beginning of it.

Here is what we think matters: governance must precede deployment, not follow it. A framework for AI use should include documented impact assessments (aligned with FCA SS1/23 where applicable), clear mapping of accountability under the Senior Managers Regime, explainability requirements that match the specific regulatory perimeter the firm operates in, and continuous monitoring that actually adapts as the model's real-world performance changes. This is not about buying a governance dashboard and calling it done. Trovix Audit exists because firms need to document governance decisions systematically and show the regulator evidence of that thinking, not because audit dashboards are fashionable. The firms doing this right are not using AI for financial advice without a regulated adviser in the loop. They are not deploying client-facing AI assistants like Trovix Reach without clear disclosure of AI involvement and human escalation paths. They are treating AI like the regulated system it is, not like an internal productivity tool.

What should you do on Wednesday morning? First, audit your current AI deployments against the FCA's own published principles on AI governance. Second, identify which AI systems touch regulated advice, financial data, or client-facing communication — those need formal impact assessment and monitoring now, regardless of whether they are publicly available models or proprietary systems. Third, ask your vendor (or your team, if you built it in-house) for evidence that governance was embedded before launch, not bolted on after. If they cannot show you that, you need to implement it yourself. Finally, do not assume your AI vendor has done the compliance work. They largely have not. If you are using Luminance, Harvey, or any specialist platform in a regulated context, it is your firm that holds the risk. Your vendor's terms say so. Make governance a deployment prerequisite, not an afterthought. The FCA is watching firms that do it backwards.

Source: City AM