Every Carrier Is Being Pitched an Insurtech Platform. How Many Are Buying Blind?
Adam Wenham | Founder & Managing Director, Garrison · 19 October 2026
In the last twelve months, Bermuda's insurance market has seen a wave of technology investment. The mea Platform raised $50 million from Scottish Equity Partners. CatX merged with Cactus to create the island's largest insurance software company. INTX expanded its Bermuda presence through a partnership with Bespoke Analytics. BriteCore, Guidewire, Duck Creek, and Sapiens continue to court Bermuda carriers. Every carrier COO on the island has been pitched by at least three vendors in the past six months.
The technology is real. The capabilities are genuine. The question most carriers cannot answer is whether the platform being pitched is the right platform for their specific operations, their specific data architecture, their specific regulatory obligations, and their specific budget — or simply the platform with the best demo and the most persuasive sales team.
Most carriers evaluate platforms without a technology executive
Most Bermuda carriers do not have a Chief Technology Officer. Technology decisions are made by the COO, the CFO, or the Head of Operations — people whose primary expertise lies elsewhere. When a vendor presents a platform that promises to automate underwriting, streamline claims, improve data quality, and reduce operating costs by 40%, the carrier's evaluation depends on the vendor's own materials, a reference call with a carrier the vendor has chosen, and the experience of board members who may have encountered the platform at a previous employer in a different market.
What is typically absent from the evaluation:
Fit against actual operations
The vendor demonstrates the platform's capabilities. The carrier nods. But has anyone mapped the carrier's actual workflows — not the workflows described in the operations manual, the workflows that actually happen — against the platform's architecture? The gap between "this platform can do X" and "this platform can do what we actually need" is where implementations fail.
Regulatory alignment
A cloud-based platform that processes policyholder data across jurisdictions triggers PIPA obligations. A platform with embedded AI triggers AI governance obligations under the BMA's August 2026 consultation. A platform that manages an important business service must be included in the carrier's operational resilience framework. These are not edge cases. They are standard implications of modern technology adoption in a regulated market. Yet many technology procurement processes evaluate functionality and cost without assessing regulatory compliance implications.
Data migration reality
The vendor says migration takes eight weeks. The carrier's data is stored across three legacy systems, two spreadsheets, and an insurance manager's platform. The data models are inconsistent. Historical records use different field definitions than current records. The eight-week migration becomes a six-month data remediation programme that was never budgeted and never scheduled. A pre-procurement data quality assessment would have identified this before the contract was signed.
Total cost of ownership
The licence fee is $150,000 per year. The implementation cost is $300,000. But the data migration, the integration with existing systems, the training, the parallel running period, the configuration of regulatory reporting, and the ongoing support and change management add another $400,000 that wasn't in the vendor's proposal. A carrier that approves a $450,000 technology investment and discovers it is actually a $850,000 programme has a board credibility problem as well as a budget problem.
Decide build, buy or hybrid before choosing a vendor
Bermuda's carriers face a more nuanced technology decision than "which vendor should we choose?" The prior question — often unanswered — is whether to buy a platform, build a capability, or operate a hybrid model.
Buy
Buy suits carriers with standard operations and limited internal technology capability. The platform vendor provides the technology, the implementation methodology, and the ongoing support. The carrier's role is configuration, data migration, and change management. The risk is dependency: the carrier's operational capability becomes tied to the vendor's product roadmap, pricing decisions, and business viability.
Build
Build suits carriers with distinctive operations that no commercial platform serves well — niche specialty lines, unusual reinsurance structures, proprietary underwriting models. Building requires a technology team (in-house or contracted) with insurance domain expertise, a product owner who understands the business requirements, and a multi-year commitment to development, testing, and maintenance. The risk is cost and time: bespoke builds take longer, cost more, and require ongoing engineering investment that most Bermuda carriers cannot sustain.
Hybrid
Hybrid is increasingly the pragmatic choice. A commercial platform for core operations (policy administration, claims, finance) with bespoke components for areas of competitive differentiation (proprietary analytics, specialist underwriting tools, regulatory compliance monitoring). The commercial platform provides the foundation. The bespoke components provide the edge. The challenge is integration: ensuring the bespoke components work seamlessly with the commercial platform and that data flows coherently across both.
Most carriers default to "buy" because it appears simpler. An independent evaluation would assess whether "buy," "build," or "hybrid" is the right strategy for the carrier's specific situation before the vendor conversation begins — not after the contract is signed.
The platform's AI becomes the carrier's accountability
Every major insurtech platform now includes AI capabilities. Underwriting triage. Claims assessment. Fraud detection. Risk scoring. Natural language processing for submissions. Predictive analytics for reserving. The BMA's August 2026 AI governance consultation makes clear that these are AI use cases the carrier must govern — regardless of whether the carrier built the AI or the vendor did.
"the use of a third-party AI system does not transfer or diminish a regulated entity's accountability."
— BMA August 2026 AI Governance Consultation
A carrier that adopts a platform with embedded AI must inventory those AI use cases, assess their materiality and risk, ensure appropriate governance and oversight, and maintain validation and testing records.
Most vendor contracts do not address these obligations. The service level agreement covers uptime, response times, and data availability. It does not typically cover model governance, bias monitoring, explainability, or the carrier's right to audit the AI's decision-making logic. The gap between what the BMA expects of the carrier and what the vendor contract provides is a governance risk that should be identified and addressed during procurement — not discovered during a BMA supervisory review.
An independent technology evaluation should assess the AI governance implications of any platform being considered. Specifically:
- What AI use cases does the platform include?
- What data does the AI process?
- What decisions does it influence?
- Can the carrier explain those decisions to the BMA?
- Does the contract give the carrier audit rights over the AI components?
- If the vendor updates the AI model, is the carrier notified?
These questions are not technical details for the IT team. They are governance requirements that the board must understand before approving the investment.
The BMA Innovation Hub offers a route for genuine innovation
For carriers evaluating genuinely innovative technology — or for technology providers seeking to engage with the Bermuda regulatory ecosystem — the BMA's Innovation Hub provides a structured pathway. The Hub is designed for companies testing new technologies or business models that do not require a licence, offering a direct engagement with the BMA's supervisory team without the full regulatory approval process.
For carriers, the Innovation Hub is relevant when the technology being evaluated represents a genuine departure from established operational models — AI-driven underwriting at scale, blockchain-based policy administration, parametric insurance automation. Engaging with the Hub provides regulatory clarity before full deployment: the BMA understands what the technology does, assesses the governance framework around it, and provides guidance on expectations. For the carrier, this engagement reduces the risk that a significant technology investment encounters unexpected regulatory friction after implementation.
For technology providers operating in or entering Bermuda's market, the Innovation Hub is the formal channel for demonstrating new capabilities to the regulator. As the BMA's 2026 business plan confirms, the Authority continues to invest in supervisory technology and RegTech capabilities — signalling that technology-enabled compliance is not just tolerated but actively encouraged.
Four questions should precede any procurement
What Boards Should Be Asking
Four questions that should precede any technology procurement decision:
First
Have we mapped our actual operations against this platform's capabilities — not the operations manual, the real workflows? If the evaluation is based on a vendor demo and a reference call, the board is approving a significant investment without an independent assessment of fit.
Second
Have we assessed the regulatory implications of this platform? PIPA (where is the data processed?), AI governance (what AI does it include?), OpRes (does it support an important business service?), Cyber (what are the security controls?). If the procurement process evaluated functionality and cost but not regulatory compliance, the assessment is incomplete.
Third
Do we understand the total cost of ownership — not just the licence and implementation, but the data migration, integration, training, parallel running, and ongoing change management? If the vendor's proposal covers the first two but not the last five, the board is seeing half the picture.
Fourth
Is "buy" the right strategy, or should we be evaluating "build" or "hybrid" before choosing a vendor? The vendor conversation should follow the strategic decision, not precede it. A carrier that evaluates three vendors before deciding whether to buy is answering the wrong question first.
Technology adoption in a regulated market is not a technology decision. It is a governance decision with technology at its centre. The carriers that recognise this — and evaluate accordingly, with appropriate legal counsel reviewing vendor contracts against the evolving regulatory expectations — will make better investments, face fewer implementation failures, and build technology estates that satisfy both their operational needs and their regulatory obligations.
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda’s regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA’s technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Garrison · Hamilton, Bermuda · adam@garrison.re
Practitioner analysis, not legal advice. More at garrison.re/analysis