The numbers should terrify every general counsel and compliance officer in a regulated firm. Red Hat's April 2026 survey found that 87% of UK business IT decision-makers deploy agentic AI systems—agents making decisions, accessing data, processing documents autonomously—yet only one quarter have governance frameworks in place. Worse, fewer than half have complete visibility of where their data actually lives, how it is processed, or who can access it. This is not a problem. It is an open door. Under the FCA Consumer Duty PS22/9, SRA Code of Conduct, PRA SS1/23, and ICO UK GDPR obligations, regulated firms must know what their systems do and where their data goes. Data invisibility is not ambition; it is negligence.

What we are seeing is the pattern of every major technology adoption cycle in professional services: the business case gets built first, compliance gets added later. Tools like Harvey, Legora, and Microsoft Copilot have democratised agentic AI access. That is good. But it has also meant that fee-earners, underwriters and advisers can deploy AI agents into production without IT or compliance ever seeing them. The firms that moved fast and loose with AI in 2024 and 2025 are now scrambling to retrofit governance. The firms that allowed every department to choose their own AI tool stack are now unable to map data lineage or audit agent decisions. This is not a technology problem any more. It is an institutional problem. And it cannot be solved by buying another platform.

Here is Trovix's honest view: agentic AI is only as compliant as the visibility and audit trails behind it. No AI platform—not Harvey, not Legora, not Copilot—can make you compliant by itself. Compliance comes from knowing what your systems are doing and being able to prove it to a regulator. That requires three things: first, a complete map of which AI systems are in use and where they touch data; second, automated monitoring of regulatory change (which is why Trovix Watch exists); and third, the ability to extract and validate outputs before they leave your firm. Too many mid-market firms have bought document AI tools and assumed they are done. They are not. A system that extracts a contract clause without proving provenance or audit trail has shifted the liability, not reduced it. The solution is not more AI. It is governance first, then AI.

What you should do on Monday morning: audit which AI systems are actually in use across your firm. Ask your IT team and your business teams separately. The answers will not match. Second, map where client data flows through each system. If you cannot answer that question in an hour, you have a problem. Third, talk to your compliance team about what 'provenance' means in the context of your regulators—the SRA's handbook, the FCA's AI conduct risk framework, Lloyd's Blueprint Two if you are in insurance, or the FRC's ISA UK standards if you audit. Finally, accept that blocking all AI is not the answer, but neither is AI without governance. The firms that will survive regulatory scrutiny are the ones that can say: we know what we use, we know where data goes, and we can prove every decision.

Source: Computer Weekly