When the FCA's CEO says traditional rulemaking doesn't work with 'fast-moving AI technology, particularly as agentic AI development accelerates', he's telling mid-market legal, insurance, financial services and accountancy firms something uncomfortable: you can't wait for the rulebook to tell you what's safe. The FCA's own shift towards collaborative, adaptive regulatory approaches—signalled here and reinforced by SRA Code principles and PRA SS1/23—means the onus is on you. The Consumer Duty (PS22/9) applies to how you deploy AI too. Regulators will be watching not what rules you followed, but what governance you built. If your firm uses AI tools for client advice, underwriting decisions, or audit work without documented risk management, you're already exposed.

This story reflects a pattern we're seeing across all regulated sectors: the AI regulation gap is closing, but not through formal rulemaking. It's closing through enforcement. The EU AI Act is already live. The ICO's AI governance guidance is detailed. Lloyd's Blueprint Two expects insurers to own their AI supply chains. The FRC's ISA UK standards are tightening. What's missing is not rules—it's honest, sector-specific implementation. Too many firms are deploying large language models (Harvey, Luminance, even Microsoft Copilot in enterprise) without understanding what those models actually do: they are statistical pattern-matchers that hallucinate confidently. They are not deterministic. They are not auditable in the way regulators expect. And they are not safe for high-stakes decisions without robust human gatekeeping and documented reasoning chains. Regulators know this. They're warning firms now so they can't say they didn't.

Here's what Trovix believes: AI in regulated firms must be built on three non-negotiable principles. First, transparency about what the AI is actually doing—not marketing language, but genuine explainability of the reasoning path. Second, human accountability that is documented and traceable. Third, failure modes that are understood and managed before deployment. This means generic off-the-shelf agentic AI is not the answer for most mid-market firms. A general-purpose chatbot sitting on your case management system does not meet those standards. But purpose-built, domain-specific AI—trained or fine-tuned on your firm's procedures, with documented workflows, audit trails, and human sign-off gates—does. Trovix Aria and Trovix Sift are built on this principle: narrow, verifiable, auditable, with humans firmly in control. They solve specific problems (knowledge retrieval for fee-earners, data extraction from documents) where the AI adds genuine value and can be monitored. That's the difference between responsible AI and the kind that gets you investigated.

What should you do? First, audit your current AI use honestly. Where are you using commercial generative AI tools? What decisions are they informing? What training data did they see? Document it. Second, map your regulatory obligations by sector: if you're in insurance, check Lloyd's Blueprint Two expectations; if you're legal, check SRA Supervision requirements; if you're financial services or accountancy, check FCA and FRC guidance on model governance. Third, ask your AI vendors hard questions about auditability, hallucination rates, and legal liability. If they can't answer, don't deploy. Finally, invest in governance infrastructure now. Trovix Watch tracks regulatory change so you're not scrambling when the FCA publishes detailed expectations. The regulators are signalling that the collaborative phase is ending. Proactive governance isn't optional; it's the only regulatory position that survives scrutiny.

Source: CNBC