Guardrails for regulated AI: FCA, SEC and the shape that survives.
The regulator does not object to AI. It objects to AI without guardrails. Build the guardrails first and the rest of the OS is straightforward.
Every AI project that dies inside a regulated firm dies at the same door: 'compliance said no'. Almost every time, compliance was right — because the project had no guardrails and could not answer the four questions a regulator asks about any material decision. What was the input? What was the process? What was the output? Who was accountable? Guardrails are the layer that lets the OS answer all four, on every call, without slowing anything down.
The four guardrails
- Policy: a machine-readable rulebook the router and agents check before any action. Encodes SM&CR ownership, Consumer Duty, jurisdictional data rules, market-abuse limits.
- Evals: a ground-truth set the firm owns, run continuously, that measures pass rate, hallucination rate, escalation rate and drift. Not a launch check — a live signal.
- Provenance: every fact traceable to a source in Firm Memory, every action to a model version and a policy version.
- Human-in-the-loop: mandatory escalation on specified thresholds — client harm, regulatory disclosure, material trade.
Guardrails are not the thing that slows AI down. Guardrails are the thing that lets it ship.
The regulator's actual position
The FCA's public position on AI has been consistent: they are technology-neutral, outcome-focused and interested in governance, accountability and consumer outcomes. That is exactly what guardrails deliver. A firm that walks into a supervisory conversation with a working policy layer, live evals, provenance on every answer and clear human-in-the-loop rules is a firm that has already done the work the regulator will otherwise ask for.
Where to start
Every KJ Capital engagement begins with a two-week £15k AI Diagnostic. We map your existing data estate, model your firm's OS across the six layers above, cost the build, name the first three skills to ship, and hand you a plan your board can act on. It is deliberately priced to be a rounding error against the value it unlocks.
FAQ
Do guardrails have to be built before we ship anything?
Yes. Guardrails are the first layer, not the last. Every KJ Capital engagement builds guardrails alongside the model router — before any user-facing surface.
What about Consumer Duty?
Consumer Duty maps naturally onto the four guardrails. Policy encodes the four outcomes. Evals measure them. Provenance evidences them. Human-in-the-loop handles the escalations.
Is a third-party audit required?
Not by regulation, but firms typically choose one for material AI systems. The guardrail architecture makes third-party audit a matter of showing evidence, not building it.
Start with the £15k AI Diagnostic
Two weeks, one costed OS blueprint, three named skills to ship first.