On 19 October, the FCA published examples of good and poor practice in AI adoption across financial services. The statement is carefully worded—the FCA says it will not introduce AI-specific regulation—but the underlying message is clear: you already have rules that apply to AI. Consumer Duty (PS22/9), SYSC and CASS requirements don't suddenly vanish because you deployed a large language model. What the FCA revealed, by publishing poor practice examples, is that many firms have treated AI as a special case exempt from governance. It is not. For any mid-market law firm, insurer, wealth manager or accountancy practice using AI, this guidance reframes the entire compliance picture: AI is not a technology exemption. It is a governance test.

This guidance sits at the inflection point of a broader shift in regulatory thinking. For the past 18 months, AI adoption in UK regulated firms has moved fast—too fast for governance to keep pace. Vendors have sold point solutions (Harvey in legal, Luminance for compliance, generic ChatGPT-wrapped tools) as though AI deployment is a feature purchase, not an operational change. Firms have bought them and deployed them without mapping risk, documenting decisions, or building audit trails. The PRA's work on operational resilience (SS1/23) and the Lloyd's Blueprint Two on algorithmic accountability have already signalled that regulators expect you to know what your AI is doing, why it is doing it, and what happens when it gets it wrong. The FCA's October guidance is the moment the broader regulated sector catches up to that standard.

Here is Trovix's direct view: most AI implementations in mid-market firms have failed because they solved the wrong problem. They asked 'what AI tool can we buy?' instead of 'what governance and accountability infrastructure do we need to deploy AI safely?' The difference matters enormously. Harvey and Luminance are technically competent products, but they do not solve governance. Standalone document AI tools like those built into Microsoft Copilot are convenient, but they do not give you the traceability the FCA now expects under existing Consumer Duty and SYSC rules. You cannot retrofit governance onto a deployed tool—you must build it in from inception. That requires three things: first, a documented decision-log showing why the AI was chosen and what risks were identified; second, an operational audit trail showing what data went in, what the output was, and how humans validated it; third, a live compliance dashboard that surfaces anomalies, data drift and performance degradation in real time. The FCA's guidance implicitly demands this because it references 'accountability' and 'governance' as pillars. Most tools do not provide this infrastructure. Trovix Audit was built to solve exactly this problem—to wrap governance and live accountability around deployed AI systems—because we saw that the regulatory moment was coming.

If you are a mid-market firm with AI tools already in use, here is what to do right now. First, audit what you have: map every AI deployment (including ChatGPT use by fee-earners, document automation tools, data extraction systems). Second, document the governance decision for each one: why was it chosen, what risks were identified, who approved it, and what consumer or operational impact could it have? Third, implement continuous monitoring to show regulators that you know what the tool is doing and can justify its outputs. That might mean adding a compliance layer to existing tools, or it might mean replacing tools that cannot provide the transparency the FCA now expects. Do not wait for the FCA to ask. The firms that will pass the next supervisory visit are those that have already built governance into their AI stack. Those that have not will face questions about Consumer Duty compliance, SYSC governance failures, and operational resilience. The FCA's guidance was published in October 2026. It is not a future warning. It is the standard being applied now.

Source: Financial Conduct Authority