The Implementation Gap

Why AI assistants haven’t yet changed how most firms work — and what closes the gap

October 2026 · Alex Roy

This paper draws on the published evidence, conversations with leaders across financial services and on our experience of running Passmore & Oliver on AI every day, including what has not worked.

Summary

Most firms have bought AI assistants. Far fewer have changed how they work. Use is close to universal, but the share of firms reporting any profit impact from AI has barely moved in a year. The firms that do see value are the ones that have redesigned how work is done and checked, not the ones that bought a better tool.

We call this the implementation gap. It matters most in regulated firms, where regulators have deliberately left the “how” to firms. There are no AI-specific rules to follow, but there is accountability to carry.

Our view, drawn from the evidence and from running our own firm on AI every day, is that the gap has five parts:

GapWhat it looks likeWhat closes it
MethodAI kept to routine, time-consuming work, not used as a partner on expert workA working method that starts with the expert’s thinking
PermissionLeaders think they have given permission and time; staff don’t feel itClear leadership and specific permission for named uses, shown on real work
ReviewPolished output is taken as correctReview that tests value, accuracy and the author’s understanding
CapabilityJuniors produce faster but may not build judgementDeliberate development, and review matched to the work
MeasurementValue is felt, not shownLight, honest measures — including what review catches

Gap	What it looks like	What closes it
Method	AI kept to routine, time-consuming work, not used as a partner on expert work	A working method that starts with the expert’s thinking
Permission	Leaders think they have given permission and time; staff don’t feel it	Clear leadership and specific permission for named uses, shown on real work
Review	Polished output is taken as correct	Review that tests value, accuracy and the author’s understanding
Capability	Juniors produce faster but may not build judgement	Deliberate development, and review matched to the work
Measurement	Value is felt, not shown	Light, honest measures — including what review catches

The five parts are not independent. A working method depends on review, review depends on capability, and none of it can be shown without measurement. Fixing one in isolation tends to move the problem to another. Once they are in hand, firms can take the next step: redesigning whole workflows around AI. That is where all five gaps apply at once (section 7).

The habits that make AI use safe are largely the same habits that make it valuable. They are not free. Good reviews take time, and some of what AI saves has to be reinvested in checking. But that reinvestment is what turns faster output into work worth relying on. That is good news for compliance, which can be the function that lets the business use AI ambitiously, because it is done safely.

1. Bought, not embedded

The case for AI assistants in regulated firms has largely been accepted. In the Bank of England and FCA’s most recent survey, 75% of the UK financial services firms that responded were already using AI (Bank of England/FCA, 2024). Yet 46% of firms said they had only a partial understanding of the AI they use, against 34% claiming complete understanding, largely because so much of it comes from third parties. Boards expect savings, and few want to be the firm that falls behind.

The returns have been slower to arrive. McKinsey’s 2026 global survey found that nearly nine in ten respondents report regular use of AI, yet only 37% attribute any impact on operating profit to it, about the same share as a year earlier (McKinsey, 2026).

The UK government’s own trials of Microsoft 365 Copilot tell the same story at close range. Staff liked the tool, with 72% of users at the Department for Business and Trade satisfied. But on an average working day only around 30% of licence holders used it, and the evaluation concluded: “We did not find robust evidence to suggest that time savings are leading to improved productivity” (DBT, 2025).

What we see in conversations with financial services firms matches this. Typical use is light: drafting emails, summarising documents, taking notes from calls, some basic research. Few have moved on to the work where AI could change what a compliance function delivers, such as gap analysis, policy development, monitoring at scale.

It helps to separate three kinds of AI use, because each needs different governance. Personal productivity — staff using assistants to draft, summarise and research — is where most firms are, and a mistake there falls mainly on the user and whoever reviews their work. Production use builds AI into a process, such as quality checking or monitoring, where an error spreads through everything downstream. Customer-facing use puts AI in front of customers, where a mistake lands on them and the Consumer Duty applies directly. Sections 2 to 6 focus mainly on the first, and section 7 turns to the other two.

What distinguishes the firms that do get value is not the tool. In McKinsey’s data, nearly three-quarters of the highest performers have fundamentally redesigned their workflows, against about a quarter of everyone else. That is a correlation, not proof of causation. The data is self-reported, and firms that are already doing well may simply have more room to redesign. But it is consistent with the trials above, where giving staff the tool on its own did not produce robust productivity gains, and with the experimental evidence in section 2 that results depend on how and where AI is used, not on access alone. Our reading is that the difference lies in implementation. The Financial Services Skills Commission reached a similar conclusion for the sector this year, finding that results from AI depend less on the technology than on data, systems, governance and people (FSSC, 2026).

A note on the evidence. Published research on AI in financial services compliance is still thin. The latest Bank of England and FCA survey dates from 2024, and a fourth edition is being run this year, with no date yet for results. Where we draw on other sectors, it is because the dynamics carry across: regulated professionals, personal accountability, and expert work that has to be checked. Legal services, where much of the best evidence sits, is the closest analogue.

Regulators have left the “how” to firms

The FCA has said plainly: “We do not plan to introduce extra regulations for AI.” It relies instead on existing rules, which it says “emphasise accountability for senior managers and are relevant to the safe use of AI”, pointing to the Senior Managers and Certification Regime (FCA). The Solicitors Regulation Authority is more direct: “The use of AI does not diminish or transfer your professional responsibilities” (SRA).

Existing rules already reach most AI use. The FCA’s Consumer Duty applies wherever AI affects customer outcomes. Under the Senior Managers and Certification Regime (SM&CR), a named senior manager is accountable for the areas where AI is used. Operational resilience and outsourcing rules cover reliance on third-party models, UK GDPR governs the data, and for banks with internal-model approval the PRA’s model risk management principles (SS1/23) expressly cover AI models. Firms themselves rank data protection, resilience and third-party rules, and the Consumer Duty as the biggest regulatory constraints on their use of AI (Bank of England/FCA, 2024).

This is a sensible stance from regulators, but it puts the burden on firms. Accountability is clear, but the method is not. Each firm has to build its own, and that is where the gap opens.

The existing rules also leave open where general-purpose AI sits in relation to the regulatory perimeter. Regulators treat AI as a tool and aim to be technology-neutral, which is why their focus is on governance and oversight. But many firms argue that AI is a step change from earlier technology, and financial advice shows why. A customer can give a chatbot their full circumstances and get back something that reads very like a personal recommendation. The FCA’s position is that a general-purpose tool giving information, without a personal recommendation that leads to a transaction, is not fully inside the perimeter, while tools built specifically to give financial advice are likely to be. It flagged the issue in its 2026 Perimeter Report and has asked AI providers for clearer disclaimers, but its chief executive has said that whether such models should be regulated is ultimately a question for Government and Parliament (FCA, Perimeter Report, 2026; Treasury Committee, oral evidence, 13 October 2026, Q767). For regulated firms this cuts both ways. Unregulated tools shape what customers expect, while a firm that builds something similar carries the full rules.

2. The method gap

Most staff keep AI assistants to routine, time-consuming work. The value lies in using them as a partner on expert work.

What it has done for us

For us, AI has changed how the firm works. It runs through our research, our drafting, our proposals and our client records system, where an AI assistant works inside strict controls. Our judgement is that our team now produces more, and better, work than it could before, though, as section 6 explains, we hold that view with care. Clients have commented on the quality of our proposals. Drafting that once held work back now keeps pace with our thinking, so more of our time goes on judgement. We use it to surface our expertise, not replace it.

That change came with a discipline attached. The more we relied on AI, the more deliberately we had to check what it produced. Getting outputs right is what turned faster work into better work.

Our size has helped. A small firm can try a new method on real work, under its normal review, see where it falls short and change within days. The people checking the work are senior, know the context and can say no. In a larger firm, the same experiment has to clear more governance before it reaches day-to-day work, and the conditions that make our review effective have to be built deliberately. Section 4 returns to that difference, which is also why we are careful not to present what works for us as a template for firms many times our size.

Not everything worked straight away. Our systems initially didn’t allow AI access to the necessary files, so we had to redesign them. We also still keep some work away from AI altogether. Sometimes it is our experience alone that needs to drive the advice we give.

The biggest gains have come from using AI on expert work: turning a set of ideas into a clear structure; producing initial draft reports quickly; producing and professionalising slides and documents; and increasingly as a partner in understanding the problems we are tackling for clients. None of these replaces expertise. Each makes an expert faster and, often, better. We use it to challenge our expertise, identify inconsistencies in our thinking and round out our analysis.

Value follows verifiability

What those uses have in common is that the person using AI can tell quickly whether the output is good. You know what you meant to say, and whether the tone is right. This is both a strength and a weakness. With real expertise, you can see quickly where an output is strong and where it is weak. Without it, staff can be persuaded by output that is confident, well argued and polished, but wrong. Tim Harford made a related point in the FT, arguing that AI makes a superficial survey of a subject effortless, and its summaries can be slick, confident and wrong (Harford, 2026). Where AI becomes the source — supplying facts or interpreting a paper you haven’t read — errors are harder to see and the risk rises.

The best-known field experiment on this, with management consultants, found exactly this pattern. On tasks within AI’s capability, consultants using it completed 12.2% more tasks, 25.1% faster, at more than 40% higher quality. On a task just outside that capability, they were 19 percentage points less likely to reach the right answer than colleagues without AI (Dell’Acqua et al., 2023). The researchers call this the “jagged frontier”. The difficulty is that users cannot see where the frontier lies.

This has a direct bearing on compliance. A general assistant asked about a rule from memory will often paraphrase it loosely, or cite a provision that does not quite say what it claims. Firms that want to move on from emails to gap analysis need to give the AI the actual sources (the rule text, their own policies) and keep the expert in charge of the judgement.

A working method

The method we use is simple, and it can be taught:

1. Set the AI up to work your way. Use the organisational settings and instructions to shape how it engages with you, around what you want to achieve.

2. Bring your own thinking first. Start by setting out what you know and think. This keeps the expertise in the work.

3. Let the AI structure and challenge it. Ask it to organise the ideas, find gaps, and push back.

4. Interrogate the draft. Ask it to explain anything you don’t immediately understand. Check that every assertion is fair and matches your experience.

5. Finish with checks. Consistency, clarity, typos — and facts, checked against the source rather than by asking the AI whether it was right.

Underneath this sits a simple mental model: treat AI output as a draft from a talented but new member of the team. Capable, quick, often impressive — and not yet trusted to sign anything off. That sets the right level of trust, and it fits how regulated firms already think about accountability. Whoever signs off owns the work, however it was produced.

3. The permission gap

Leaders often believe they have given staff permission and time to use AI well. Staff often don’t feel they have either.

The reason is structural. In a regulated firm, individuals carry personal accountability under the Conduct Rules. A broad policy that encourages “responsible use of AI” reads, from the desk, as “it’s on you if it goes wrong”. Faced with ambiguity, careful people default to no. Time works the same way. Unless it is protected, the day job wins.

The surveys point the same way. In BCG’s 2025 study of more than 10,600 workers, only a quarter of frontline staff said leaders gave enough guidance on AI, while 54% said they would use AI tools even if not authorised (BCG, 2025). In HMRC’s Copilot trial, 46% of staff who did not use their licence gave security or data privacy concerns as the main reason (HMRC, 2026). Uncertainty produces two failure modes at once. Cautious people hold back, and others work around the rules. Clear oversight helps. In a 2026 survey of 2,000 UK financial services staff for a compliance technology provider, 81% said they would feel more confident using AI if they knew their organisation was properly monitoring the outputs (IT Brief UK, 2026).

Permission is not the same as motivation. In most teams some people take to AI quickly, while others accept it but rarely explore what it could do for their own work. That is usually not a matter of temperament. Trying something new carries personal risk, the day job leaves little time, few people have seen it done well on work like theirs, and some will wonder whether automating a task means automating their role. Saying that AI matters changes none of that. It takes a leader who is clear that this is how the firm is going to work, and who makes it part of the job: show it on real tasks, protect time, be honest about what it means for roles, and reward the people who redesign their work rather than those who simply use the tools most.

Closing it

• Make permission specific. Not “use AI responsibly”, but “you may use AI to draft gap analyses and policy updates, provided you work from the source text, can explain the reasoning, and the work goes through normal review”.

• Show, don’t tell. Have someone credible take a real piece of work from first thoughts to finished product, including the parts that went wrong.

• Protect time against a deliverable. “Go and experiment” rarely survives a busy week. “Use this month’s policy review to try the method” usually does. Some law firms now make that time explicit. Press reports say one large US firm lets first-year associates count up to 400 of their 1,900 annual hours towards AI training and experimentation (Above the Law, 2025).

A simple diagnostic exposes the gap: ask leaders and staff the same three questions. What are you permitted to use AI for? How much time do you have to learn? What happens if it goes wrong? The difference between the answers is the finding.

4. The review gap

The biggest risk with AI assistants is not that they are sometimes wrong. It is that their output looks right.

The fluency trap

We learned this ourselves. Early on, AI drafts looked and sounded so polished that the instinct was to react to them as finished, rather than as drafts that still needed checking. Our sign-off routines meant we recognised this long before anything reached a client, and showed us early that we needed strong controls. The turning point comes when there is genuine challenge and questioning on a draft. Soon it is obvious where some arguments have been skim-read rather than understood. Nothing in it will be obviously wrong. But can it be defended by the person whose name is on it?

The research supports this. Experiments with AI-generated answers found that longer explanations increased people’s confidence even when accuracy did not improve (Steyvers et al., 2025). A survey of 319 knowledge workers found that higher confidence in AI was associated with less self-reported critical thinking (Lee et al., 2025). And the wider literature on automation bias shows it affects experts as well as novices (Parasuraman and Manzey, 2010). The same pattern shows up in financial services: in the same 2026 survey, staff reported using AI for a third of compliance documentation, yet only 41% said they thoroughly review and substantially edit AI output before it is sent (IT Brief UK, 2026).

The consequences are no longer hypothetical. In 2025 the High Court dealt with two cases in which lawyers had relied on citations that did not exist. It stated: “The critical safeguard is to check any output by reference to an authoritative source” — and that guidance alone was “insufficient” (Ayinde v Haringey, 2025). Specialist legal research tools are not immune. A Stanford benchmark, contested by some vendors but later peer-reviewed, found that leading products, tested in 2024, gave hallucinated answers to between 17% and 33% of queries (Magesh et al., 2025).

What good review tests

Traditional review looks for errors. That is no longer enough. In our firm, our practice is for a senior colleague to test significant work against three questions:

1. Have we brought all our expertise to bear? AI’s most common failure is not error but competent, generic output that anyone with the same tool could have produced. For a compliance team, the question becomes: does this reflect our firm, our risks and our history — or a textbook answer?

2. Is it accurate and clear? Have we got any facts wrong, misread a source, or said something hard to follow? And can the author explain it? “Talk me through why we say this” is now a control, not just good management.

3. Is it proportionate? Good compliance advice enables action rather than preventing it. The test is whether advice is proportionate and fits the firm’s risk appetite. AI tends to drift towards cautious, hedge-everything output, so this check matters more than it seems.

Review is now the bottleneck

AI raises the volume of output faster than it raises the capacity to review it. A survey by BetterUp Labs and Stanford researchers on “workslop” — AI output that looks polished but lacks substance — found that 41% of workers had encountered it, with each instance costing nearly two hours of rework (Harvard Business Review, 2025).

Firms that scale AI use without scaling review are building in risk. Review has to be an active, resourced control — with time, defined questions and a named owner — not a signature. That has a cost, and it should be counted honestly. A business case that books the drafting time AI saves, but not the review time it creates, will overstate the gains. Reviewers need training too, because a manager who uses AI to check AI-assisted work is exposed to the same fluency trap.

In a small expert firm like ours, the conditions for good review come with the reviewer, who is senior, knows the context and the sources, and can simply say no. At scale, none of that is automatic. The FCA’s good and poor practice examples make the point: “Effective oversight is not simply about reviewing AI outputs, but about ensuring people have the right authority, information, capability and escalation routes to challenge or intervene where needed” (FCA, 2026). It describes one firm where the reviewer’s role “became a tick-box exercise over time”, as reviewers deferred more and more to the AI.

So in most firms, review is a role to be designed, not just a task to be done. Can the reviewer override the AI without penalty? Do they see the data and the model’s uncertainty, not just its answer? Are they trained in how AI fails? Do they know when to escalate, and is it easy to do? Incentives matter too, since a reviewer measured on throughput will learn to defer. One firm in the FCA’s examples had reviewers assess cases without seeing the AI’s proposed outcome, so their judgement stayed independent.

5. The capability gap

AI makes juniors faster. Whether it makes them better is a different question.

The early evidence is that AI helps less experienced people most. In one large study of customer-support agents, AI raised productivity by 15% on average, with the largest gains for less experienced workers and small declines in quality for the most experienced (Brynjolfsson, Li and Raymond, 2025). That is encouraging, but it measures output, not learning.

Judgement has traditionally come from doing the groundwork — first badly, then less badly. If AI does the first draft, that route shortens or disappears. A controlled study of students found that those given unrestricted access to a ChatGPT-style tool did 17% worse once it was taken away than those who never had it, while a version designed to support learning largely avoided the harm (Bastani et al., 2025). Separately, US payroll data shows employment of 22–25-year-olds in the most AI-exposed occupations running 19% below where it would be had it kept pace with less-exposed peers, with no comparable gap for experienced workers (Brynjolfsson, Chandar and Chen, 2026). Neither study is from financial services, and the second is descriptive rather than causal. But together they point to a real risk: fewer juniors, each learning less. The picture is not uniform, though. US paralegal employment has held up so far, at around 405,000 paralegal and legal assistant jobs in 2025, although the Bureau of Labor Statistics projects little or no change over the next decade, with demand limited partly by AI (BLS, 2026). Uneven take-up, and the other gaps this paper describes, mean the effect on junior roles is still unclear.

Meanwhile, training lags. Only 36% of workers in BCG’s 2025 survey felt adequately trained.

Closing it

• Match review to the work. Junior, functional work mainly needs verification — checking accuracy. Senior, judgement work needs challenge — the three questions above. One review model for everyone serves neither.

• Coach use, not just output. The most useful question to ask a junior colleague is often “how could you have used AI better here?”

• Build judgement deliberately. Have juniors critique AI drafts, not just produce them. Occasionally have them draft without AI, then compare.

We are working this through ourselves as our team grows beyond its senior founders. Large firms with big graduate intakes face the same question at scale.

6. The measurement gap

Most firms believe AI is adding value. Few can show it. A 2026 global study of financial services found that 55% of industry respondents find the value of AI hard to measure, rising to 76% among large institutions (Cambridge Centre for Alternative Finance, 2026). We include ourselves.

Our evidence so far is real but soft: the client feedback described in section 2, and our own sense, after decades of experience, of how much we could produce before and how much we produce now. That is informed judgement, not measurement.

The gap between the two matters, because self-assessment is unreliable. In a small but carefully controlled 2025 trial, 16 experienced software developers believed AI had made them about 20% faster, but when measured they took 19% longer (METR, 2025). A 2026 follow-up gave what METR itself called an unreliable signal, so the lesson is not that AI slows experts down but that perceived and actual gains can differ sharply (METR, 2026). Where evaluators looked for productivity gains rather than asking about them, as the Department for Business and Trade did, they found no robust evidence (DBT, 2025). Even self-reports vary widely with how a trial is run. The cross-government Copilot trial recorded self-reported savings of 26 minutes a day, more than two hours a week (GOV.UK , 2025), while HMRC’s later trial, with randomly allocated licences, put them at about an hour a week (HMRC, 2026).

Proportionate measures

Measurement need not be heavy. Four measures go a long way:

MeasureWhat it showsEffort
Outcomes on key outputs (proposals won, reports accepted first time)Whether quality has changedLow — usually already recorded
Turnaround time on standard deliverablesWhether capacity has changedLow — rough timings are enough
New capabilityWork now done that wasn’t beforeVery low
A review logWhat review caught, against the three challengesLow, if kept brief

Measure	What it shows	Effort
Outcomes on key outputs (proposals won, reports accepted first time)	Whether quality has changed	Low — usually already recorded
Turnaround time on standard deliverables	Whether capacity has changed	Low — rough timings are enough
New capability	Work now done that wasn’t before	Very low
A review log	What review caught, against the three challenges	Low, if kept brief

The review log does double duty. It shows where human expertise added value to AI output, and it evidences that review is happening, which is exactly what a regulator or board will want to see.

Some firms are measuring use instead. One global consultancy is reported to track some senior staff’s weekly AI log-ins and to make regular adoption an input to leadership promotion (Fortune, 2026). One large accounting firm has said AI objectives will form part of staff performance reviews from 2026, and it already tracks engagement through data from tools such as Copilot (International Accounting Bulletin). Use is easy to count, but it is not value. Even customers of one legal AI vendor describe adoption as a supporting signal, not a measure of value (Harvey). In the UK, monitoring also carries obligations. The ICO says employers must tell workers about monitoring, minimise the data they collect, and carry out a DPIA before any high-risk monitoring (ICO).

Reset the board’s expectations

Many boards bought AI expecting headcount savings. The evidence so far points more to capacity and quality: more files reviewed by the same team, faster and more consistent work, issues caught earlier. If boards measure only cost, they may conclude AI has failed — or cut the review capacity that makes it safe.

7. From assistants to workflows

Closing the five gaps makes individuals more productive with general assistants. The larger gains come when a firm redesigns a specific process around AI, and that is also where oversight has to change. We are only at the start of this ourselves. We have built our client with an AI assistant confined to our records and each user's permissions, which finds emails, compares and summarises documents, manages tasks and handles other administration. We are now exploring agentic options to help us run the firm and support our business model, and we aim to have AI in the room as a peer when we develop and test our three-year strategy later this year.

In compliance, six workflows stand out. We see firms using AI for parts of several of them, but rarely consistently or in full.

WorkflowWhy it suits AIMain risk
Rule mappingLarge, structured, tedious by handErrors spread into everything built on it
Regulatory change monitoringHigh volume, recurringMissing the change that matters
Gap analysis against published good and poor practiceA clear benchmark to test againstSuperficial matching
Policy draftingExpert-led, easy to reviewGeneric output
Complaints monitoringHigh volume; patterns hard to spot by handCustomer outcomes — a person must decide
Financial promotions reviewHigh volume, clear criteriaThe approver remains accountable

Workflow	Why it suits AI	Main risk
Rule mapping	Large, structured, tedious by hand	Errors spread into everything built on it
Regulatory change monitoring	High volume, recurring	Missing the change that matters
Gap analysis against published good and poor practice	A clear benchmark to test against	Superficial matching
Policy drafting	Expert-led, easy to review	Generic output
Complaints monitoring	High volume; patterns hard to spot by hand	Customer outcomes — a person must decide
Financial promotions review	High volume, clear criteria	The approver remains accountable

Two points on sequencing:

• Rule mapping is the foundation. Change monitoring, gap analysis and policy drafting all depend on a reliable map from the rules to the firm’s own policies and controls. Without it, each use starts from scratch and relies on the AI’s memory of the rules. Firms that build the map first get the rest far more cheaply.

• Complaints and financial promotions make good first pilots. They stand alone, they are high volume, and their results can be measured. Some firms already use AI to check financial promotions on their partners’ websites, a task that is hard to do thoroughly by hand. Because both affect customers directly and sit squarely within the Consumer Duty, AI should triage and draft, but a person should decide.

Two lessons recur when firms redesign a process. First, the data often needs attention before the AI does. If the management information feeding a process is unreliable, automating it only spreads the problem faster. Second, redesign forces into the open decisions that were never written down. Asking AI to apply a rule exposes where the “rule” was always a matter of individual judgement. That is a benefit, but someone has to own those decisions.

What changes for oversight

Once AI can see more data or take actions, governance has to keep pace. Our own firm uses an AI assistant inside our client records system. It works within each user’s existing permissions, and walled matters are hidden from it. It can help us learn from past work, as any consultant would, but our rules do not allow it to be used to share one client’s confidential information with another. Every action must be confirmed before it happens, and its use it logged and the logs reviewed periodically.

We have revised our own AI policy regularly over the past year. None of those changes followed an incident. They followed changes in what the AI could do and how much we relied on it. That suggests a practical approach, as well as a regular review, revisit AI governance whenever one of four things changes: what the AI can see; what it can do; who uses it; or what it is used for.

The same discipline applies when the AI sits in the business rather than in compliance. As firms put AI into customer-facing assistants, complaints triage, vulnerability detection and customer communications, compliance does not need to own the tools, but it does need to be on the approval path. For each, it should be able to answer three questions: what would we need to see to be comfortable; how will we test the outcomes customers actually receive; and which senior manager is accountable? Firms that can answer those questions before launch can move faster, not slower.

8. Safe and ambitious

The best tools are available to everyone. The firms that pull ahead will be the ones that close the implementation gap: a method people actually use, permission they actually feel, review that tests more than spelling, juniors who still build judgement, and evidence that it all works.

None of this requires waiting for new rules. The FCA’s good and poor practice examples on AI, published in October 2026, point the same way. It warns that human review “may mask weaknesses in the model”, that some firms’ second- and third-line functions lack the expertise to challenge AI risks, and that firms “should be able to show that the controls they choose work in practice” (FCA, 2026). The examples cover AI in the business; they say little about compliance’s own use of AI or staff use of everyday assistants. That is where firms will need to build their own method, and the accountability is already clear.

We set out to use AI ambitiously and safely. We have learned that those goals largely pull in the same direction, even though safety costs time. The disciplines that keep AI output trustworthy are the ones that make it worth having. That gives compliance a better role than gatekeeper, as the function that lets the business use AI with confidence.

Questions for boards and heads of compliance

1. Are our people keeping AI to routine, time-consuming work, or using it as a partner on expert work?

2. Would our leaders and our staff give the same answer about what we currently permit and encourage?

3. Does our review test value, accuracy and the author’s understanding — or only look for errors?

4. How will our junior people build judgement if AI drafts first?

5. What evidence could we show our board, or our regulator, that AI is adding value safely?

6. Which one workflow would we redesign first — and what would change in how we oversee it?

About Passmore & Oliver Partners

Passmore & Oliver Partners is a specialist regulatory strategy consultancy advising investors, law firms, regulators, and legal and financial services businesses across the UK, US, Canada, Australia and Europe. We are a firm built on the safe, effective use of AI. We use it to drive quality and value in our own work, and we help clients do the same in ways that stand up to regulatory scrutiny. We are testing a short AI in compliance review with a small number of firms. To discuss this paper or the review, contact Alex Roy at alex@passmoreoliver.com.

This document does not constitute legal or regulatory advice. Passmore & Oliver Partners does not provide legal advice unless expressly agreed.