A Red Hat survey published in April 2026 shows 87% of UK business IT decision-makers have deployed agentic AI systems, yet only 25% have established strong governance frameworks to manage them. For firms under FCA Consumer Duty PS22/9, SRA Code governance requirements, or PRA SS1/23 operational resilience rules, this is not a technology adoption statistic — it is a regulatory exposure. The deeper problem: less than half of these firms have complete visibility of where their data is stored, processed, and accessed. When an AI agent makes decisions on client funds, legal advice, or insurance claims, that invisibility is not an inconvenience. It is a breach waiting to be discovered.

This pattern reflects a industry-wide assumption that has now been proven wrong: that AI products can be deployed first and governance bolted on afterwards. The market responded by selling point solutions — Harvey for legal drafting, Luminance for contract analysis, Microsoft Copilot for general work — each integrated separately, each with its own data residency, audit trail, and access controls. The result is a patchwork of disconnected systems where no single person can answer the question: where is our client data actually going? This is exactly how breaches happen. The regulatory environment has now caught up. The UK's transposition of the EU AI Act, combined with hardening FCA and ICO oversight, means firms can no longer hide behind 'our vendor told us it was compliant.'

Trovix's view is direct: governance must be designed into AI implementation from day one, not added as a compliance layer six months later. This requires three things most firms are missing. First, a single source of truth for AI system inventory and risk classification — which is why Trovix Audit exists. Second, continuous monitoring of regulatory change so your AI governance framework does not drift out of compliance as rules shift — Trovix Watch handles that. Third, hard decisions about where AI touches client data and where it does not. Many vendors — including some of the established legal tech vendors pushing agentic AI hard — conflate 'technically possible' with 'compliant.' They are not the same. A system that can automate intake across 10,000 documents still needs human-in-the-loop sign-off on decisions that touch client advice or funds.

If you are a mid-market law firm, insurance broker, financial adviser, or accountancy practice, the question is not whether to use AI. It is how to use AI without creating a regulatory liability. Start by auditing what AI systems are already running in your firm — including shadow AI that business units deployed without IT approval. Map which systems touch regulated decisions or client data. For each one, establish who is accountable, what the audit trail looks like, and how you would explain it to the ICO or your regulator if asked. Then build your governance framework around those realities, not around vendor roadmaps. If your current AI vendor cannot tell you exactly where your data is processed and why, that is your answer. The firms that win here will be the ones that treat AI governance as a business decision, not a technical problem.

Source: Computer Weekly