The FCA's October review cuts through the marketing noise: 11 million UK adults would let AI make financial decisions for them, yet most regulated firms have no reliable way to audit, explain or defend those decisions when they go wrong. The watchdog is right to expand its regulatory perimeter and demand greater oversight of autonomous AI models. What matters to you as a mid-market law firm, insurer or financial services practice is this—if you're currently using Microsoft Copilot, ChatGPT, Claude or any unvetted generalist chatbot for client-facing advice or internal decision-making, the FCA's new regime will eventually reach you. The Consumer Duty (PS22/9) already requires you to act in clients' best interests. AI that generates advice without a documented chain of reasoning, without bias testing, and without accountability doesn't meet that standard. Full stop.

This story is the marker that AI in regulated services has entered a new era. The initial phase—where firms adopted AI tools first and asked governance questions later—is ending. The second phase, where regulatory bodies worldwide are tightening oversight (the EU AI Act, ICO UK GDPR guidance, and now the FCA), is accelerating. We're seeing this play out across the industry: Harvey has built its LLM specifically for legal workflows with compliance in mind. Luminance and Legora have focused on document intelligence with audit trails baked in. Meanwhile, the generic chatbot vendors—still the default for many mid-market teams—have no governance layer. The FCA's review signals that the gap between these approaches now has regulatory teeth.

Here's Trovix's honest take: AI itself isn't the problem. Ungovened AI is. The difference between using an AI tool that produces explainable, auditable outputs and one that generates a black box answer is the difference between compliance and liability. You need three things. First, visibility into how your AI is working—what data it's using, what rules it's applying, what decisions it's making. Second, the ability to stop it if something goes wrong. Third, an audit trail that survives regulatory scrutiny. If your current AI setup can't answer 'why did the model recommend this to the client?' with documentary evidence, you're not compliant. The FCA knows this. So should you. Trovix Audit gives regulated teams exactly that: governance and traceability for every AI interaction, so when the FCA asks questions, you have answers. Trovix Watch flags these rule changes as they land, so you're not caught flat-footed.

What should you do now? First, audit every AI tool in use—from intake chatbots to client-facing advisory systems. Ask your vendor one simple question: 'Can you show me the decision trail for every output you generate, and is it auditable against FCA standards?' If the answer is vague, you have a problem. Second, don't wait for formal guidance. The FCA is signalling intent; the rules will follow. Third, if you're deploying AI for client advice or internal decisions affecting client outcomes, invest in proper AI governance. That means documented processes, bias testing, explainability requirements, and the ability to override or quarantine the model. Mid-market firms don't have the resources of the big banks, but that's exactly why you need to be smarter about which AI you adopt. Pick tools built for regulated services. Build governance before scale.

Source: City AM