Dext has launched AI Connector, which patches Claude, ChatGPT and Copilot directly into accounting practice data. It is free to Advanced partners in the UK and Commonwealth. On the surface this is logical: accountants already use these models; why not let them query client books conversationally? But here is the problem. The FCA's Consumer Duty (PS22/9) and the PRA's SS1/23 on operational resilience both demand that firms understand and control third-party AI risk. Dext's model outsources that control to whichever LLM a user chooses on any given day. For a mid-market UK accountancy practice holding sensitive tax, payroll and corporate financial data, that is not integration — it is exposure.

This story is part of a wider pattern we see across professional services: AI vendors racing to embed consumer AI tools into workflows without building the compliance layer first. Luminance and Harvey have both built proprietary models with training on regulated use cases. Microsoft Copilot for Microsoft 365 at least maintains data sovereignty and audit trails through the Microsoft envelope. But the trend toward 'just plug in your API key and get conversational access' treats regulated firms as if they were startups. They are not. An accountancy firm sharing client data with OpenAI's servers without explicit client consent, detailed data processing agreements, or audit logs is likely in breach of ICO UK GDPR Schedule 1 Part 2 (lawfulness of processing). It may also trigger questions under ISO 42001 on AI governance — a standard the FRC is now citing in its audit guidance.

Trovix's view is this: conversational access to firm data is useful. But it only works inside a compliance envelope. That means data must stay within the firm's own cloud, AI decisions must be logged and auditable, and access must be granular and consented. Trovix Audit exists precisely to solve this — it wraps AI governance around any tool, including off-the-shelf models, so firms can offer their users ChatGPT-like experience without the regulatory liability. Dext's free offer is tempting. But temptation and compliance rarely align in professional services.

If you run a mid-market accountancy, law firm or financial services operation, do not assume that 'free AI from my software vendor' means 'compliant AI'. Before you enable AI Connector or any similar feature, ask: Where does my client data go? Who has access? Can I audit every query? Am I in control of which AI model is used? If the answer to any of these is 'it depends on the user', you are not ready. Build the governance frame first. Then integrate the tools. The cost of a compliance incident far exceeds the savings from free API access.

Source: IT Brief Australia