In July, the FCA called for expanded powers to regulate AI, citing the rise of consumer use of chatbots for financial guidance. The watchdog's review demands greater oversight of autonomous AI models and suggests a public-interest AI financial guidance service. This matters immediately to mid-market financial services firms, insurers, law firms and accountancy practices because it signals that the FCA's current regulatory framework—built around human advisers and documented processes—is no longer fit for purpose. If you are deploying AI to give advice, answer client queries, or make recommendations, you are already operating in a space the regulator is watching closely. The Consumer Duty (PS22/9) already requires you to act in clients' interests. AI systems that hallucinate, lack explainability, or operate without human oversight do not meet that standard.

This is not an isolated warning. It reflects a pattern across UK and global regulators: AI has moved faster than governance. The EU AI Act is already live. The ICO is tightening its stance on UK GDPR compliance for generative AI. The SRA has issued guidance on AI use by solicitors. The FRC expects audit firms to govern third-party AI tools (ISA UK 402). What binds these together is a single insight: most organisations have deployed AI first and asked governance questions later. They have bought tools like generic ChatGPT integrations or ChatGPT-based chatbots, wrapped them in their brand, and hoped compliance would follow. It did not. The regulator is now closing that gap, and firms that have not yet built proper AI governance will find themselves exposed.

Here is the hard truth: a chatbot trained on public financial data and fine-tuned with your firm's documents is not the same as a regulated financial adviser. It does not have professional indemnity insurance. It cannot be held accountable for a specific recommendation. It cannot tell you why it gave that advice in a way a court would accept. Most commercial AI tools—including the large language models that power consumer chatbots—lack the explainability, audit trail, and guardrails that regulated advice demands. Trovix's approach to client-facing AI is different. Trovix Reach is built from the ground up with regulatory governance built in: every response is logged, traceable, and grounded in your firm's approved knowledge base. It does not hallucinate into undefined territory. It knows what it does not know and says so. Compare that to a free ChatGPT instance or a lightly customised LLM chatbot: they are convenient and cheap, but they are not compliant. The FCA is signalling that convenience will no longer be accepted as justification.

What should you do now? First, audit what AI you are already running. Is it client-facing? Is it giving advice or recommendations? Does it have proper governance, audit trails, and sign-off from compliance? Second, if you have not yet built AI into client services, do not deploy until you have a governance framework in place—not after. Third, recognise that AI governance is not a one-time checkbox. You need ongoing monitoring, version control, and the ability to explain what the system decided and why. Trovix Audit is designed for this: it gives you a compliance dashboard for AI systems, audit-ready logging, and the governance evidence regulators now expect. The FCA's review becomes formal regulation within 18 months. Firms that wait for the rule to drop before acting will be scrambling. Those building compliant AI now will have a two-year head start.

Source: City AM