Nikhil Rathi is right to be worried, and so should you. The FCA's warning that traditional rulemaking cycles cannot match the speed of agentic AI development is not theoretical hand-wringing—it is a direct warning to mid-market firms that the regulatory ground beneath your AI deployments is still being built. If you have deployed ChatGPT plugins, document AI systems, or client-facing chatbots without a formal AI governance framework, you are operating in regulatory white space. The FCA, PRA, SRA, and ICO have not yet issued prescriptive rules on how agentic systems should be audited, monitored, or controlled. That does not mean you are compliant. It means you are taking risk that regulators will later define as unacceptable.

This story reveals a pattern that goes far deeper than banking. Every regulated sector—law, insurance, accountancy, financial advisory—is grappling with the same problem: AI products are shipping faster than accountability infrastructure can scale. The market has sold firms on the productivity wins of large language models (Harvey for legal triage, Luminance for contract review, Microsoft Copilot for advisory work) without equivalent emphasis on governance, explainability, bias testing, or audit trails. The EU AI Act is already law. The UK AI Bill was expected this year. The Lloyd's Blueprint Two framework is tightening the screw on insurance technology governance. Regulators are not saying 'wait for the rules.' They are saying 'we cannot move fast enough, so you must.' That is a different burden entirely.

Trovix's position on this is clear: AI governance cannot be retrofitted. The firms that will navigate the next eighteen months successfully are those implementing AI with auditable decision records, transparent model provenance, and real-time compliance monitoring from day one. This is not compatible with the 'move fast and fix it later' model that many AI vendors promote. When you deploy Trovix Aria as a RAG assistant for your fee-earners, or Trovix Reach for client communication, or Trovix Sift for document triage, you are creating an auditable record of what the AI system saw, how it reasoned, and what it recommended—because that record is what regulators will ask for. Systems like Harvey and Luminance are powerful, but they were designed for productivity, not auditability. That is a meaningful difference when the FCA is asking 'why did your AI make that decision?' and you cannot answer.

Do this now: map every AI system currently in use or planned for the next six months. For each one, document: what data it processes; what decisions it influences; whether it is tested for bias; whether you can explain its outputs to a regulator; and whether you have a kill switch if it breaks. Then implement a compliance dashboard—Trovix Audit is built specifically for this—that treats AI governance as a continuous control, not a one-off audit. The firms that treat this as a checkbox exercise will face enforcement action. The firms that treat it as core infrastructure will be the ones still operating in two years.

Source: CNBC