When the FCA's own CEO admits that 'the traditional cycle of rulemaking doesn't work in an era of fast-moving technological change', you should treat that as a direct signal. Rathi was not complaining to CNBC for the sake of it. He was describing the predicament that every regulated firm in the UK is now facing: AI systems—particularly agentic AI that operates with minimal human intervention—are moving faster than European policymakers can write rules to govern them. For mid-market law firms, insurers, financial services providers and accountancy practices, this creates an awkward truth. You cannot wait for the FCA or the ICO to issue definitive guidance on AI governance before you implement systems. The window has closed. By the time PS22/9, PRA SS1/23, or the incoming EU AI Act compliance frameworks fully crystallise in practice, your competitors will have already built institutional knowledge and efficiency gains that will take you years to replicate.

This story is part of a larger pattern. From the adoption of large language models in legal discovery (Harvey, Legora) through to document intelligence in insurance claims (Luminance's use in underwriting) and AI-assisted audit (major accountancy tools), the industry has moved from cautious pilots to embedded workflows. The regulators have noticed. They are panicking quietly, not because AI is inherently bad, but because the pace of implementation has outstripped their ability to measure systemic risk, client harm, and market integrity. The FRC, the SRA, and the PRA are all scrambling to catch up. What they are really saying is this: firms that wait for permission will lose. Firms that move thoughtfully but decisively will own the compliance narrative.

Here is Trovix's honest view. The answer is not to avoid AI. It is to stop treating AI implementation as a product purchase and start treating it as a governance problem. Most vendors—including some generative AI platforms used carelessly in regulated environments—sell capability without accountability. They hand you a tool (Microsoft Copilot, off-the-shelf RAG models, unvetted LLMs) and leave compliance to your interpretation. That approach is now actively dangerous. What regulated firms need is adaptive compliance infrastructure: systems that can document why an AI decision was made, what data was used, whether it breached client confidentiality or market rules, and whether it created unintended bias or concentration risk. Trovix Audit is built precisely for this. It sits between your AI workflows and your governance obligations, translating the gap between innovation speed and regulatory clarity into real-time, auditable decision-making. You are not choosing between AI and compliance. You are choosing between AI done with governance and AI done blindly.

Here is what you should do on Tuesday morning. First: audit which AI systems are already in use in your firm—both sanctioned tools and shadow AI. Second: map them against your existing regulatory obligations under FCA Consumer Duty (PS22/9), SRA Code (for law firms), PRA SS1/23 (for systemically important institutions), and UK GDPR (ICO). Third: identify the gaps—what your AI does that your current compliance framework does not account for. Fourth: implement a governance layer that can evidence your decision-making, track model performance, and flag when AI output might breach client confidentiality, conflict rules, or market conduct standards. This is not bureaucracy. It is the only way to operate at speed without blowing yourself up. Firms that do this in the next 12 months will have a defensible position when formal rules arrive. Firms that do not will be retroactively trying to explain why they were running agentic systems without governance.

Source: CNBC