Most firms have bought AI assistants. Far fewer have changed how they work.
The evidence is consistent. Three-quarters of the UK financial services firms that responded to the Bank of England and FCA's latest survey were already using AI. Yet in McKinsey's 2026 global survey, only 37% of respondents attributed any impact on operating profit to AI, about the same share as a year earlier. The government's own Copilot pilot at the Department for Business and Trade found staff liked the tool, but "did not find robust evidence to suggest that time savings are leading to improved productivity".
The firms that do see value tend to have changed how they work. In McKinsey's data, nearly three-quarters of the highest performers had fundamentally redesigned their workflows, against about a quarter of everyone else. We call the difference the implementation gap.
Why it matters more in regulated firms
Regulators have deliberately left the "how" to firms. The FCA has said plainly: "We do not plan to introduce extra regulations for AI." The SRA is just as clear that "the use of AI does not diminish or transfer your professional responsibilities".
So accountability is settled, but the method is not. The Consumer Duty, the Senior Managers and Certification Regime, outsourcing rules and data protection already reach most AI use. Each firm has to build its own way of meeting them, and that is where the gap opens.
There is also a grey area at the edge of the rules. Customers increasingly turn to general-purpose AI for guidance on borrowing, saving and investing, which the FCA has flagged as a risk that sits outside its perimeter. Its chief executive told MPs this month that whether such models should be regulated "is ultimately a question for Government and Parliament" (Treasury Committee, 13 October 2026). For regulated firms that cuts both ways: unregulated tools shape what customers expect, while a firm that builds something similar carries the full rules.
The gap has five parts
Drawing on the evidence, and on running our own firm on AI every day, we see five parts to the gap.
| Gap | What it looks like | What closes it |
|---|---|---|
| Method | AI kept to routine, time-consuming work, not used as a partner on expert work | A working method that starts with the expert’s thinking |
| Permission | Leaders think they have given permission and time; staff don’t feel it | Clear leadership and specific permission for named uses, shown on real work |
| Review | Polished output is taken as correct | Review that tests value, accuracy and the author’s understanding |
| Capability | Juniors produce faster but may not build judgement | Deliberate development, and review matched to the work |
| Measurement | Value is felt, not shown | Light, honest measures — including what review catches |
The parts depend on each other. A method depends on review, review depends on capability, and none of it can be shown without measurement. Self-assessment alone will not do: in one controlled trial, experienced developers believed AI had made them about 20% faster, but measured, they took 19% longer.
Permission is the gap leaders most often miss. In a regulated firm, individuals carry personal accountability. A policy that says "use AI responsibly" reads from the desk as "it's on you if it goes wrong", and careful people default to no. "You may use AI to draft gap analyses, working from the source text, provided you can explain the reasoning" works far better.
And permission is not the same as motivation. Some people take to AI quickly; others accept it but rarely explore what it could do for their own work. This is rarely a matter of temperament. Trying something new is a personal risk, time is short, few people have seen it done well on work like theirs, and some will wonder whether automating a task means automating their role. Leaders who want AI to change how the firm works have to make it part of the job and give people the time to do it.
What we learned: the fluency trap
AI assistants are sometimes wrong, but the bigger risk is that their output always looks right.
We learned this ourselves. Early on, AI drafts looked so polished that the instinct was to treat them as finished. Our sign-off routines caught this long before anything reached a client. The turning point comes when drafts are properly challenged.
The courts have seen the same risk. In 2025 the High Court dealt with lawyers who had relied on citations that did not exist, and said: "The critical safeguard is to check any output by reference to an authoritative source."
So in our firm, our practice is for a senior colleague to test significant work against three questions:
1. Have we brought all our expertise to bear, or is this a textbook answer anyone with the same tool could produce?
2. Is it accurate and clear, and can the author explain it? "Talk me through why we say this" is now a control in its own right, as well as good management.
3. Is it proportionate? AI drifts towards cautious, hedge-everything advice. Good compliance advice enables action.
Our size helps here, and we are careful not to present it as a template. In a small firm the conditions for good review come with the reviewer: they are senior, know the context and can say no. At scale none of that is automatic. The FCA's new good and poor practice examples on AI make the point: effective oversight is "not simply about reviewing AI outputs, but about ensuring people have the right authority, information, capability and escalation routes to challenge or intervene where needed". In most firms, review has to be designed as a role in its own right.
From assistants to workflows
It helps to separate three kinds of AI use, because each needs different governance. In personal productivity, a mistake falls mainly on the user and whoever reviews their work. In a production process, such as quality checking or monitoring, an error spreads through everything downstream. In customer-facing use, it lands on the customer, and the Consumer Duty applies directly.
Closing the five gaps makes individuals more productive. The larger gains come when a firm redesigns a whole process around AI. In compliance, two points matter most:
• Rule mapping comes first. Change monitoring, gap analysis and policy drafting all depend on a reliable map from the rules to the firm's own policies and controls.
• Complaints and financial promotions make good first pilots. They are high volume, they stand alone, and their results can be measured. Because both affect customers directly, AI should triage and draft; a person should decide.
Two lessons recur when firms redesign a process. The data often needs attention before the AI does: automating a process fed by unreliable information only spreads the problem faster. And redesign forces into the open decisions that were never written down. That is a benefit, but someone has to own them.
The same discipline applies when the AI sits in the business rather than in compliance: customer-facing assistants, complaints triage, vulnerability detection. Compliance does not need to own those tools, but it does need to be on the approval path. For each one it should be able to answer three questions: what would we need to see to be comfortable, how will we test the outcomes customers actually receive, and which senior manager is accountable?
Safe and ambitious
The best tools are available to everyone. The firms that pull ahead will be those that close the implementation gap.
The habits that make AI use safe are largely the habits that make it valuable. They are not free: good review takes time, and some of what AI saves has to be reinvested in checking. But that is what turns faster output into work worth relying on. It also gives compliance a better role than gatekeeper: the function that lets the business use AI with confidence.
Four questions for boards and heads of compliance:
1. Are our people using AI as a partner on expert work, or only for routine tasks?
2. Would our leaders and our staff give the same answer about what we permit?
3. Does our review test value and understanding, or only look for errors?
4. What evidence could we show our board, or our regulator, that AI is adding value safely?
Read the full paper, The Implementation Gap, for the evidence, our working method and the measures we recommend. We are also testing a short AI in compliance review with a small number of firms. To take part, or to discuss the paper, contact Alex Roy at alex@passmoreoliver.com.
This document does not constitute legal or regulatory advice. Passmore & Oliver Partners does not provide legal advice unless expressly agreed.