Three Regimes, One Consultation, One Deadline. Nobody Is Looking Across All of Them.

This is the structural problem nobody is talking about. The BMA’s two codes, PIPA and the BMA’s AI governance consultation are not independent. They are interconnected by design. And the carriers managing them in silos are missing the connections that matter most.

Consider an outsourcing agreement with an insurance manager. Most Bermuda carriers have one. The insurance manager processes claims, manages bordereaux, handles policyholder correspondence, interacts with cedants. For many carriers, the insurance manager IS the operational backbone.

That single agreement triggers obligations across four regulatory areas simultaneously.

A Big Four firm assesses your cyber posture. They produce a cyber risk report. It covers the Cyber Code's requirements. It identifies gaps. It recommends remediation. It can run to six figures.

The report does not mention that your insurance manager's cyber controls also affect your OpRes resilience, your PIPA compliance, and your AI governance posture. It does not connect the cyber gap to the outsourcing overlay. It does not flag that the same remediation action — improving the insurance manager's incident response capability — satisfies requirements across three other frameworks simultaneously.

A law firm assesses your PIPA compliance. They review your privacy notice, your data processing agreements, your cross-border transfer arrangements. They identify gaps. They recommend contract amendments. They charge by the hour.

The law firm does not mention that the data processing agreement they are reviewing also needs to satisfy the Cyber Code's third-party cyber provisions and the OpRes Code's outsourcing governance requirements. Three sets of contractual obligations, one agreement, and nobody has read it across all three lenses.

The carrier receives two reports. Neither talks to the other. The board sees cyber gaps in one presentation and PIPA gaps in another. Nobody connects them. Nobody says: "The same insurance manager agreement is creating gaps across four regulatory areas, and fixing it once — properly — satisfies requirements across all of them."

The alternative is an assessment that maps evidence across all three regimes and the consultation at once.

A data classification register satisfies the Cyber Code's data classification requirement. It also supports the PIPA data inventory obligation. It also informs the OpRes dependency mapping by identifying which information assets are critical. One document, three frameworks, three requirements satisfied — or three gaps identified, depending on whether the register exists and whether it is current.

A BCP test report satisfies OpRes Step 5. It also satisfies the Cyber Code's recovery requirements. If the scenario tested involves a third-party failure, it informs the outsourcing overlay assessment. If the business continuity plan relies on AI-driven processes, it triggers the AI governance materiality assessment. One test, four connections.

A vendor cyber assessment satisfies the Cyber Code's third-party requirements. It also satisfies the OpRes mapping requirements for the same vendor. It also informs the PIPA assessment of whether the vendor's data handling meets the carrier's privacy obligations. If the vendor uses AI, it feeds the AI governance inventory. One assessment, four regulatory areas.

The OpRes Code requires carriers to complete all seven steps and have a board-approved self-assessment, available to the BMA on request, by 31 March 2028. Step 2, mapping resources and dependencies, requires understanding every third-party relationship, every technology platform, every information asset that supports each important business service. That mapping exercise, done properly, touches every regulatory framework the carrier is subject to.

A carrier that begins its OpRes self-assessment in Q1 2028 has three months to complete a seven-step programme that, done properly, takes 12-18 months. A carrier that begins now has time to assess, remediate, and evidence compliance before the deadline.

The question is not whether a carrier needs a compliance assessment. The BMA expects it. The question is whether that assessment is siloed — one framework at a time, one report per workstream, no connections made — or cross-domain — all four regulatory areas assessed simultaneously, every piece of evidence mapped across every requirement it satisfies, every gap identified in its full regulatory context.

Beyond the structural gaps, there is a temporal gap that is equally dangerous and far more common.

Most carriers have policies. They were written two or three years ago. They were approved by the board at the time. They have not been reviewed since. The BCP was last tested eighteen months ago. The penetration test is fourteen months old. The privacy notice references legislation that has been amended.

These are not missing documents. They are stale documents. The carrier has evidence — but the evidence has expired against its own stated commitments.

This is a critical distinction. Evidence staleness should be measured against the carrier's own policies, not against an arbitrary standard. If the carrier's business continuity policy commits to annual testing and the last test was eighteen months ago, the carrier has failed its own standard. If the policy commits to biennial testing and the last test was eighteen months ago, the carrier is within tolerance. The assessment should reflect what the carrier promised to do — and whether it has done it.

The assessment could be conducted by the carrier's own compliance team, by an insurance manager, by a Big Four firm, or by a specialist consultant. The BMA makes no prescription about who delivers it — only that the carrier can demonstrate compliance through current, complete, and verifiable evidence.

The practical reality for most Bermuda carriers — particularly Class 3B and smaller Class 4 carriers — is that the internal team is too small, an insurance manager cannot independently assess the services it provides, and a large firm's engagement is often priced and scoped for larger organisations.