FIS has launched an AI banking agent designed to accelerate financial crime investigations. It is a competent piece of engineering. It is also a test case the UK regulated sector is failing. When an AI agent makes a decision about whether a transaction is suspicious, who is accountable? The agent? The bank? Anthropic? Under PRA SS1/23 and the FCA's Consumer Duty (PS22/9), accountability is not optional—it is a regulatory expectation. Yet most firms deploying agentic AI have no framework to answer that question. FIS's move from experimentation into production is not wrong. But the speed at which the industry is normalizing agentic AI without governance infrastructure is.

This story is part of a pattern. AI vendors are racing to deploy autonomous systems—from Harvey and Legora in legal workflows to Luminance in due diligence to now FIS in compliance—precisely because autonomous agents are more commercially valuable than assistive tools. An agent works alone. A copilot (like Microsoft Copilot or many implementations using basic RAG) requires human review at every decision point. Autonomy is faster. It is also harder to audit, harder to explain, and harder to defend in front of the FCA, the ICO, or a court. The industry has not yet built the muscle for agentic governance. Firms are buying the technology anyway.

Trovix's view is straightforward: if you deploy an AI agent, you must have auditable oversight before it touches production data. Firms often choose between speed and safety. That is a false choice. The real choice is between building governance during pilot phase or facing regulatory intervention during incident investigation. FIS's agent is trained on Anthropic's models—solid engineering, but the governance gap is not Anthropic's to fill. It is each deploying bank's responsibility. We see this repeatedly: firms adopt tools like Luminance for document review or Harvey for legal research without establishing clear human sign-off gates, audit logs, or decision rationale capture. Then something goes wrong—a misclassified transaction, a missed red flag—and suddenly governance matters. We built Trovix Audit specifically to close this gap: governance dashboards that capture why an AI system made a decision, who reviewed it, and what the outcome was. Not for compliance theatre. For actual accountability.

For mid-market financial services, legal, insurance and accountancy firms: your regulator (FCA, PRA, SRA, FRC) will not wait for the industry to figure out agentic AI governance. They are already asking questions in routine supervisory visits. If you are piloting any AI agent in compliance, financial crime, underwriting, or client advice workflows, establish three things immediately. First: an audit trail for every decision—what data the agent saw, what rules it applied, what it concluded. Second: a human sign-off gate for all material decisions, with clear documentation of why the human agreed or overrode the agent. Third: a monthly governance review using a framework like ISO 42001 or the EU AI Act's risk categorization, not because you are subject to those regimes (though the EU AI Act's due diligence logic is spreading), but because they work. Firms that do this in October 2026 will be the ones the FCA cites as examples of responsible AI deployment in 2027. Firms that buy the agent and worry about governance later will be the cautionary tales.

Source: Forbes