Illustrative Case Studies / AI in regulated sectors

Illustrative case study | AI in regulated sectors

In regulated markets, the pressure that creates demand also slows the sale

How DemandAxis would take a complex AI product from promising pilots to a paid decision in UK financial services and legal firms.

Illustrative scenario. The organisation is hypothetical and no client results are claimed. Market and regulatory facts are sourced at the end.

Client

UK AI start-up, technical founders, seed funding

Product

Reviews communications and complaint files to evidence Consumer Duty outcomes

Target buyer

FCA-regulated lenders, insurers and wealth managers. Large law firms to test.

Starting point

Strong demos and two unpaid pilots. No signed contract.

The challenge

Momentum stops after the demonstration

of organisations in Deloitte's 2026 enterprise research had moved 40% or more of their AI pilots into production¹

Where deals stall today

DemoCompliance leaders recognise the problem

AccessRead access to CRM, telephony and complaints systems

StallDue-diligence questionnaire, DPIA input and senior manager accountability

ResultPilots with no decision date, success measure or route to a paid contract

The product processes personal data, some of which may reveal health conditions or financial difficulty.

Sourced fact

Few organisations move most AI pilots into production¹
The FCA expects firms to stay responsible for AI they procure²
The ICO says most AI uses of personal data are likely to need a DPIA⁵

Scenario assumption

Both pilots are unpaid, with no decision date
Compliance leaders recognise the problem
The product can work with a person making every decision

Discovery must confirm

Whether either pilot has a budget owner
What data access the product needs, and whether security will approve it
Whether large law firms are a real second segment

The commercial insight

In this market, approval is most of the sale. The buyer needs a decision they can defend.

Head of Compliance

The board

The data protection officer

The regulator, if asked

The product that wins is often the one that is easiest to approve.

Reasons to act now

Four dated triggers and one recurring signal

The same pressure that slows procurement is the strongest reason to buy. None of this is legal advice, and each point needs checking against the buyer's own position.

1 September 2025

Failure to prevent fraud offence^{6, 7}

In force for large organisations, including partnerships. Government guidance expects reasonable prevention procedures, including monitoring and review.

Test a second proposition for large law firms and lenders before investing

5 February 2026

Data (Use and Access) Act 2025^{4, 5}

Revised automated decision-making rules commenced. The ICO says most AI uses of personal data are likely to need a DPIA.

Position as decision support with human review. Prepare DPIA input early.

19 October 2026

FCA: AI in financial services²

The FCA's good practice review creates no new requirements. Existing rules apply, and firms remain responsible for AI they procure.

Build assurance material against the FCA's published themes

2 December 2027

EU AI Act, Annex III^{8, 9}

Firms with EU operations

High-risk rules apply from this date, as amended by the Digital Omnibus on AI. Annex III includes creditworthiness assessment of individuals.

Prepare a clear statement of intended purpose. Classification needs specialist review.

Recurring signal

Consumer Duty. The FCA publishes firm-level complaints data twice a year for larger firms³.

Lead with the evidence gap and use complaints data to prioritise accounts

The decision

Should the founders start a third pilot?

Not recommended

Start a third unpaid pilot

Adds data-access work and founder time without a route to a decision. Interest is already proven. Buying intent is not.

Recommended

Convert or close the two existing pilots

Agree a decision owner, date, success criteria and commercial terms with each buyer, or end the pilot and record why.

Conditional

Pause new pilots and build the trust pack

If both pilots stall at security or data protection review, that review is the real blocker.

Why

A strong demo shows interest. An unpaid pilot shows a willingness to explore. Only a named owner, a decision date and agreed terms show an intent to buy.

What would change the recommendation

A buyer offers a paid pilot with a named decision owner
A pilot shows a different use case that is easier to approve
Data access cannot be approved, in which case the use case changes before any new pilot

Proposed approach

Six steps designed around approval

Start with the easiest use case

Complaint-file quality review, where a person makes every decision.

OutputUse-case shortlist and first ICP

Build the trust pack early

Data flows, hosting, sub-processors, audit logging and human review.

OutputAssurance pack and due-diligence response

Target visible pressure

Complaints data, Consumer Duty roles and enforcement in the segment.

OutputResearched account list

Engage the committee in order

Compliance sponsor first, then the DPO and information security early.

OutputStakeholder map and messaging

Design a pilot with an end

Phased data access. A paid pilot, even at a modest fee.

OutputPilot brief and scorecard

Expand on evidence

Review conversion, time to approval and objections first.

OutputEvidence review

Decision criteria

Agreed before any pilot starts or is extended

Success criteriaDecision ownerDecision dateApproved data accessCommercial terms on success

ConvertCriteria met. Move to a paid contract on the agreed terms.

Extend onceOnly with a new decision date, a named owner and a fee or written terms.

PauseA keen sponsor with no budget owner this year. Keep the feedback and revisit at a dated point.

Do not startNo decision owner, or data access cannot be approved. Do not start or extend the pilot.

Product feedback and commercial qualification are tracked separately. Useful feedback is not a buying signal.

Who decides

The buying committee

A regulated buyer has more people who can say no than people who can say yes.

Head of Compliance or Consumer Duty lead

Needs to believeThe product closes a monitoring gap that manual sampling cannot, and they can explain it to the board.

Evidence that moves themCoverage compared with current sampling, sample outputs and a complete audit trail.

Select a person on the map.

Stakeholder	Needs to believe	Evidence that moves them
Accountable senior manager (SM&CR)	They can take reasonable steps to understand and control the risk they are accountable for.	A one-page governance summary covering human oversight, escalation and what happens if the system fails.
Data protection officer	There is a lawful basis, processing is minimised and human involvement is meaningful.	DPIA input, data flows, retention periods and sub-processor details.
Information security	Access is controlled, read-only where possible, logged and appropriately hosted.	Architecture overview, testing evidence and only the certifications the vendor actually holds.
Head of Compliance or Consumer Duty lead	The product closes a monitoring gap that manual sampling cannot, and they can explain it to the board.	Coverage compared with current sampling, sample outputs and a complete audit trail.
CTO or data lead	Integration effort is proportionate and will not displace other priorities.	Connector list, data mapping and a realistic effort estimate.
Procurement and third-party risk	The vendor is viable, and exit and model-change terms are clear.	Contract terms, model change notice, exit plan and evidence of financial standing.
Operations or QA team	Their workload falls.	Reviewer workflow and how incorrect flags are handled.

What we would measure

Time from first meeting to security and data protection review

Pilots with an agreed decision date

Pilot-to-paid conversion

Recurring due-diligence questions

Each pilot is reviewed against its scorecard on the agreed decision date, not left open.

Illustrative deliverables

Use-case prioritisation and ICPTrust pack structure and due-diligence responseRegulatory trigger map and account listBuying committee map and persona messagingPilot brief, scorecard and conversion termsQualification criteria and CRM stage definitionsEvidence review for the next investment

Every engagement is led by the founder of DemandAxis, who would own commercial strategy, positioning, outreach and deal coordination. DemandAxis does not provide legal, regulatory or data protection advice. Product capability, security, compliance status and implementation stay with the founders and their advisers. No paid adoption or revenue outcome is guaranteed.