The BMA's AI Guidance: What Already Applies, and What Is Proposed.

On August 14, 2026, the Bermuda Monetary Authority published a consultation paper proposing a Guidance Note on the Responsible Use of Artificial Intelligence in Financial Services in Bermuda. Comments are due by October 30.

Read that again. The BMA is not introducing a new AI regime. It is telling every regulated entity that your existing obligations — governance, risk management, cybersecurity, outsourcing, conduct of business, record-keeping — already apply to AI. They always have. The Guidance Note simply makes that application explicit.

The consultation paper builds on the BMA's July 2025 Discussion Paper and its February 2026 Stakeholder Letter, which together established the foundation for the BMA's approach. Three principles run through the entire framework.

The BMA's 2022 AI and Machine Learning Survey found that AI adoption was already occurring across Bermuda's insurance market, with prominent use cases in cybersecurity, underwriting, and claims. Since then, adoption has accelerated. Carriers are deploying AI for automated underwriting triage, claims assessment, fraud detection, risk modelling, portfolio analysis, and customer service. Some have moved from pilots to production. Others have adopted AI tools through their vendors without fully recognising them as AI use cases.

The consultation paper introduces practical expectations for each of these use cases.

Every regulated entity should establish or update an inventory of AI use cases across the organisation. This includes AI embedded in vendor platforms — not just AI the carrier built itself. The shadow AI problem is real: carriers may be using AI through their underwriting platforms, their claims systems, their reinsurance administration tools, or their cloud services without having identified those tools as AI use cases subject to governance. A carrier whose underwriting platform uses "automated risk scoring" is using AI. A carrier whose claims system includes "predictive analytics" is using AI. A carrier whose email system uses machine learning-powered spam filtering is, technically, using AI. The inventory exercise will surface use cases that boards did not know existed.

Each use case should be assessed for materiality and risk using the proportionality indicators the BMA outlines in the consultation paper's Annex C. A high-materiality use case — AI making or materially influencing underwriting decisions — requires comprehensive governance: model validation, performance monitoring, drift detection, explainability, human oversight, and documented decision rationale. A low-materiality use case — AI routing customer service emails — requires proportionately less.

Records of validation and testing should be maintained to support existing governance, assurance, and supervisory engagement obligations. When the BMA asks "how do you know this AI model is performing as intended?" the carrier needs documented evidence, not assurances.

The third-party accountability clause is where the practical challenge is most acute.

Consider a Bermuda carrier that uses an AI-powered underwriting platform built by a technology vendor. The vendor trained the model. The vendor maintains the model. The vendor updates the model. The carrier's underwriting team uses the platform to assess risks and issue quotes. If the AI model develops bias — systematically underpricing a risk class, for example — the carrier is accountable for the underwriting outcomes, not the vendor.

The BMA's guidance is explicit: the use of a third-party AI system does not transfer or diminish accountability. But most carrier-vendor contracts do not reflect this reality. The service level agreement covers uptime and response times. It does not typically cover model governance, bias monitoring, explainability, or the carrier's right to audit the AI's decision-making logic. The contractual framework between carriers and their AI vendors needs to evolve to match the regulatory expectation.

The BMA has designed its regulatory architecture as an integrated framework. AI governance is not a new pillar alongside OpRes, Cyber, and PIPA. It is a lens that applies to all three.

AI and Operational Resilience

If an AI system supports an important business service — and if the AI makes underwriting decisions, it almost certainly does — then the operational resilience framework must address that AI's availability, performance, and failure modes. A scenario test under the OpRes Code should include: what happens if the AI model produces unreliable outputs? Can the carrier continue underwriting within its impact tolerances using manual processes? How long can the carrier operate without the AI before the disruption becomes intolerable?

AI and Cyber Risk

An AI system is an attack surface. A compromised AI model — whether through data poisoning, adversarial inputs, or unauthorised access — is a cyber event with unique characteristics. The altered outputs may not be immediately visible. The damage may accumulate before detection. The carrier's cyber risk framework must extend to AI-specific threat vectors, and the incident response plan must account for the possibility that a cyber breach has compromised the integrity of AI-driven decisions rather than just exfiltrated data.

AI and PIPA

The consultation closes on October 30, 2026. That is both a deadline for feedback and an implicit message: the BMA expects boards to be aware of this guidance and to have begun assessing its implications before the final Guidance Note is published. By the time the final version takes effect, the BMA's expectation will be that regulated entities have had ample notice.

Four actions boards should prioritise:

The BMA has stated that responsible adoption requires regulated entities to manage both the risks of using AI and, where relevant, the strategic or operational risks of failing to modernise capabilities. That second clause is often missed. The BMA is not just saying 'govern your AI.' It is saying 'if you are not adopting AI at all, consider whether that itself is a risk.'

This is a regulator that understands innovation. Bermuda's financial services sector — from captive insurance to alternative investments, from digital assets to insurance-linked securities — has built its global position on welcoming innovation within a framework of robust regulation. The AI Guidance Note continues that tradition: innovate, but govern; adopt, but account; automate, but remain accountable.

As Walkers' analysis of the consultation paper observed, the BMA has taken a principles-based and proportionate approach that integrates AI governance into existing sectoral requirements rather than creating parallel obligations. The legal analyses published by Bermuda's leading firms — including Jerome Wilson and Karim Creary's examination in the Royal Gazette — provide essential guidance on the regulatory interpretation. What carriers now need is the operational response: how to conduct the inventory, how to assess materiality, how to update vendor contracts, and how to build governance frameworks that satisfy both the Guidance Note and the integrated requirements of the OpRes Code, the Cyber Code, and PIPA.