Navigating BMA’s proposed AI guidance note

After the release of a discussion paper just over a year ago, the BMA has now taken a decisive step in regulating AI with August’s release of a consultation paper entitled “The responsible use of artificial intelligence in financial services in Bermuda”.

The new release includes a draft guidance note regarding how the BMA will analyse financial institutions’ use of AI. This consultation paper and the draft guidance note within is open for feedback until October 30.

Today’s column addresses the key takeaways for Bermuda’s financial sector.

Crucially for financial institutions, the BMA has chosen to extend existing regulatory frameworks rather than establishing a stand-alone AI licensing regime or pre-approval process. This approach minimises compliance complexity while integrating AI risk management into existing sectoral requirements.

For boards and executive teams, the consultation paper outlines several key developments and practical implications.

The proposed guidance note establishes the “AI use case” — rather than the technology label or firm size alone — as the primary unit for assessing risk and calibrating governance. The intensity of oversight must reflect the specific application.

The guidance note distinguishes between two primary categories:

• Higher-impact AI use cases: applications that affect regulated decisions, financial outcomes, valuation, pricing, underwriting, claims, or trading. These demand rigorous validation, independent challenge, and extensive documentation.
• Lower-impact AI use cases: tools used for internal productivity or operational support. These can be managed with simpler controls, such as approved-use policies, user training, and access management.

Recognising that Bermuda’s financial sector is dominated by wholesale, institutional, and cross-border businesses such as reinsurance, captives, and fund administration, the BMA has explicitly rejected the direct importation of retail-focused regimes.

Accordingly, transparency and fairness expectations common in retail markets will not be applied without adaptation.

However, accountability remains crucial. The BMA emphasises that institutional counterparties, boards, and supervisors must retain sufficient information to independently challenge AI-driven outcomes, particularly in high-value activities like underwriting, catastrophe modelling, and reserving.

A major addition to the regulatory framework is the inclusion of separate, detailed sections addressing advanced and unmanaged AI risks:

• Generative AI: regulators highlight risks such as confidentiality breaches, data leakage, and hallucinations. Firms must establish data-input restrictions and ensure that GenAI-supported content is verified by personnel before any external distribution.
• Agentic AI: for systems capable of planning and executing autonomous, multi-step actions across databases and application programming interfaces, the BMA suggests setting bounded permissions, isolating operating environments, and ensuring meaningful human approval points and “kill-switches”.
• Shadow AI: regulators flagged unauthorised employee use of unsanctioned AI tools as a growing operational threat. Firms must define clear acceptable-use policies and platform-level monitoring to mitigate shadow AI.

To prepare for the final guidance note, firms should focus on three immediate areas:

• Integrate proportional inventories: firms must maintain visibility over AI deployments. This can be achieved by integrating AI use cases into existing model, system, or third-party registers — documenting ownership, purpose, risk classification, and data sensitivity.
• Deploy “compensating controls” for vendors: the BMA acknowledges that Bermuda subsidiaries and smaller entities may lack the leverage to extract proprietary source code or training data from global AI vendors. In such cases, firms must implement compensating controls such as vendor due diligence, local testing, and output monitoring to manage residual risk within their appetite.
• Mitigate conduct risk and “AI washing”: the BMA warned against overstating AI capabilities, characterising “AI washing” as a source of conduct and reputational risk.

With the consultation period now open through the end of next month, firms should evaluate their current and planned AI systems against the five core outcomes of the guidance note:

• Accountable governance
• Proportionate life cycle management
• Reliable outcomes
• Secure deployment
• Adequate supervisory evidence.

For complex or novel AI-use cases, clients should consider early engagement via the BMA’s innovation hub or sandbox.

First Published in The Royal Gazette, Legally Speaking column, September 2026