Your Compliance Spreadsheet Can’t Read. What Comes After It.
Adam Wenham | Founder & Managing Director, Garrison · 26 October 2026
Somewhere in every Bermuda carrier, there is a spreadsheet. It tracks regulatory compliance. It was built by someone who has since left the organisation. It is maintained by someone who inherited it. It contains formulas that nobody fully understands, references to documents that may or may not still exist, and a colour-coding system whose original logic has been lost to institutional memory.
This spreadsheet cannot read your outsourcing agreements. It cannot extract the compliance-relevant clauses from a 200-page contract. It cannot tell you that the business continuity plan it references was last tested eighteen months ago. It cannot flag that your privacy notice says you don't transfer data offshore while your TPA agreement says you do. It cannot connect a single piece of evidence to requirements across four regulatory domains simultaneously. It cannot tell you what's missing, what's stale, or what's inconsistent.
It is the tool that most Bermuda insurers rely on to manage the most complex regulatory environment in the island's history — the Operational Resilience Code, the Cyber Risk Management Code, PIPA, and the AI governance guidance — simultaneously, accurately, and continuously.
The spreadsheet cannot do this. Not because it is badly maintained. Because it is a spreadsheet.
Watchtower is not software today. Garrison’s consulting builds the rulebook — the requirement taxonomy across the codes and the mapping of which evidence satisfies which requirement — and the rulebook is Watchtower. The first product is the evidence-map workbook, in the second half of 2027. Platform pilots follow from late 2027 into 2028. This piece describes what it is being built to do.
Watchtower reads the evidence across all four areas
Watchtower is the AI-powered compliance platform Garrison is building for Bermuda’s regulated insurance market. At its core sits the Evidence Intelligence Engine — an AI layer that does what no compliance officer can do at scale and what no spreadsheet can do at all.
The compliance officer drags and drops a document — an outsourcing agreement, a BCP test report, a vendor assessment, a board minute. Here is what happens next:
The AI reads the document
Not the title. Not the metadata. The content — every clause, every commitment, every obligation. It extracts the compliance-relevant sections and tags each with a confidence score: high confidence means the extraction is an exact or near-exact match to a regulatory requirement. Medium confidence means a probable match that warrants human review. Low confidence means a possible relevance that requires manual investigation.
The AI maps across four regulatory domains simultaneously
A single data processing agreement might satisfy an outsourcing obligation under the OpRes Code, a third-party cyber risk requirement under the Cyber Code, a data processing obligation under PIPA, and — if the third party uses AI — an AI governance accountability requirement. One document. Four domains. Mapped in seconds. A compliance officer performing this mapping manually would take hours, if they made the cross-domain connections at all.
The AI discovers connections the carrier didn't know existed
"You uploaded a vendor assessment last month that also satisfies a Cyber Code vulnerability management requirement. Your status just moved from red to amber." Evidence that was sitting in the system, unmapped, now contributes to the carrier's compliance posture — because the AI found it.
The compliance officer's role changes fundamentally
From "read every document, decide what it proves, type the status into a spreadsheet" to "review what the AI found, confirm or correct, and focus manual attention on the medium and low-confidence extractions where the AI is uncertain." The intelligence work is done by the AI. The judgment is done by the human. The compliance determination — green, amber, red — is done by deterministic logic that no AI can influence.
The compliance decision is deliberately not made by AI
This architectural choice is the most important decision in the entire platform.
⚠️ Camp A: AI for Everything
Uses AI for everything — including the compliance determination. "You are 87% compliant." That number is generated by a probabilistic model. It might be wrong. The board cannot explain how it was calculated. The BMA cannot verify it. One hallucination and the carrier has a false compliance determination on record.
🔧 Camp B: No AI at All
Rule-based workflow tools. Reliable but manual. The compliance officer still reads every document by hand, maps every requirement manually, and assembles every report from scratch.
✅ Watchtower: A Third Position
AI powers the intelligence — reading, extracting, mapping, discovering, flagging. Deterministic logic powers the compliance judgment — evaluating whether specific evidence satisfies specific requirements based on documented rules. The AI finds the evidence. The rules evaluate it. The board sees a compliance posture built entirely on traceable, auditable, non-probabilistic logic.
When the BMA asks "are you compliant with the Cyber Code's data classification requirement?" the carrier doesn't offer a probability. It offers evidence: "Requirement CY-13 is satisfied because evidence item #47 — data classification register, uploaded 14 March 2027, current — meets the requirement per mapping rule R-CYBER-A3-002-v1." Every determination has a chain. Every chain leads to evidence. Every piece of evidence was found, parsed, and mapped by AI — but the judgment was made by logic that a human wrote, a human reviewed, and a board approved.
The BMA's own AI governance consultation reinforces this architectural choice. The consultation paper states that governance controls should reflect the materiality and risk of each AI use case. Using AI for document parsing and evidence retrieval is a low-materiality application with proportionate governance requirements. Using AI for compliance determination would be high-materiality — and would introduce reliability concerns that deterministic logic avoids. Watchtower is governed by the same AI governance framework it helps carriers implement.
The board sees fact and context, clearly separated
The quarterly board report has two sections, clearly separated and distinctly labelled.
Section A — Deterministic Compliance Posture
Four quadrants — OpRes, Cyber, PIPA, AI Governance. Green, amber, red per requirement. Trend lines showing improvement or deterioration over time. Evidence gaps listed with the specific requirements they leave unsatisfied. This section is generated entirely from deterministic logic. No AI produced any part of it. This is what the board signs off on.
Section B — AI-Generated Context
Clearly labelled as such. A narrative summary of what changed this quarter. Which evidence was refreshed. Which gaps were identified. Which actions the AI recommends based on deadline proximity, evidence currency, and regulatory risk. This section is informational. The board reads it for context. They do not sign off on it. The distinction is visible and explicit — so no reader confuses AI-generated context with the deterministic compliance assessment.
The board deliberation workflow ensures genuine governance. Watchtower generates the draft. The board reviews in a documented session. Board members challenge any determination — and Watchtower provides the evidence chain and mapping rule behind every challenged item. The board amends if necessary, with amendments captured and rationale recorded. The board approves with attestation. The complete deliberation trail — every question, every answer, every amendment — is preserved.
The annual self-assessment under the OpRes Code follows the same workflow. The document the BMA receives reflects the board's judgment, informed by AI intelligence and grounded in deterministic evidence — not a platform output the board rubber-stamped.
INTEGRA preparation is the first proof point
The BMA's INTEGRA portal is where carriers submit their regulatory filings. For most carriers, INTEGRA preparation is a quarterly ordeal — multiple people, multiple spreadsheets, multiple data sources, three days of manual assembly.
Because Watchtower's AI continuously maps evidence against regulatory requirements, the INTEGRA submission is not an assembly exercise. It is an export exercise. The evidence has already been collected. The regulatory mapping has already been applied. The AI has already validated completeness — flagging missing fields, expired evidence, and data gaps before the compliance officer opens the submission package.
Before: Quarterly Ordeal
- Multiple people involved
- Multiple spreadsheets and data sources
- Three days of manual assembly
- Evidence gathered retrospectively
- Errors discovered during submission
After: Watchtower
- Evidence continuously collected
- Regulatory mapping already applied
- AI validates completeness in advance
- Missing fields and expired evidence flagged automatically
- Thirty-minute review and export
This capability depends on obtaining the INTEGRA filing specification — the exact field definitions, data types, and validation rules the BMA portal expects. Garrison is pursuing this through carrier clients who have filed recently and through Bermuda law firms who advise on regulatory submissions. The INTEGRA staging module ships when the specification is confirmed — and every other module operates independently in the meantime.
No carrier data leaves the carrier
Compliance evidence reveals a carrier's vulnerabilities, gaps, remediation priorities, and regulatory exposure. A platform that transmits this data to a centralised cloud environment — even a secure one — creates a concentration risk that neither the carrier nor the BMA should accept.
Watchtower is designed to deploy within the carrier's own cloud environment. Each carrier's data is encrypted with their own keys, stored in logically isolated schemas, with access controls that prevent any cross-carrier visibility. The AI processing runs within the same environment — no evidence data is sent to external APIs. The carrier's compliance data never leaves their control.
This architecture satisfies PIPA (the carrier controls where personal information is processed), the Cyber Code (the carrier governs its data hosting), and the OpRes Code (the carrier understands and documents the technology supporting its important business services). Data sovereignty is not a feature. It is an architectural principle that compliance with the BMA's own regulatory framework requires.
Watchtower arrives through the consulting work
Watchtower does not sell itself. Nobody buys a compliance platform from a cold email or a demo. The sales motion is the consulting engagement.
Garrison runs a diagnostic assessment
During the diagnostic, the consulting team uploads the carrier's documents to Watchtower. The AI parses, extracts, tags, and maps — reducing weeks of manual analysis to days. The gap analysis is generated from Watchtower's evidence map. The carrier sees the four-quadrant dashboard for the first time: this is what your compliance posture looks like.
The remediation programme follows
Every deliverable — every updated policy, every completed assessment, every tested plan — is uploaded to Watchtower as new evidence. The AI maps it automatically. The compliance posture improves in real time. By the time the consulting engagement ends, the carrier's Watchtower instance is populated with evidence, mapped across four domains, and generating board reports.
The licence renewal is not a sales conversation
It is a continuity decision. The carrier's compliance intelligence already runs on Watchtower. The alternative is to go back to the spreadsheet. Nobody goes back.
The BMA is moving to continuous, evidence-based supervision
The BMA's 2026 business plan confirms continued investment in Supervision Technology and Regulatory Technology. The shift from desk-based assessment to on-site review, from annual filing to continuous oversight, from policy-based compliance to evidence-based compliance — the trajectory is toward a supervisory model that depends on carriers producing current, complete, and verifiable evidence on demand.
This is not a prediction about the BMA's future requirements — and it should not be read as suggesting the BMA prefers automated compliance over well-maintained manual processes. The BMA requires compliance. How the carrier achieves it is a commercial decision. A carrier with a rigorously maintained manual framework that accurately reflects its compliance state is not disadvantaged.
But the regulatory direction favours carriers that can produce current, complete, and verifiable evidence on demand. Whether that evidence comes from a platform or a spreadsheet matters less than whether it is accurate, timely, and auditable. The question carriers should be asking is not whether they need AI-powered compliance intelligence today. It is whether the compliance environment they face in 2028 and beyond — four interconnected regulatory domains, continuous supervisory oversight, evidence-based assessment — is an environment their spreadsheet can survive.
As Appleby's Technology & Innovation practice and other Bermuda advisory firms have observed, the regulatory landscape is maturing rapidly. The carriers that invest in the systems to support evidence-based compliance — at whatever level of technology is proportionate to their scale — will find the supervisory conversation simpler. Not because the BMA rewards technology, but because good evidence makes good regulation easier for everyone.
Your compliance spreadsheet can't read your outsourcing agreements. It can't flag that your evidence expired last month. It can't connect a single document to requirements across four regulatory domains simultaneously. It can't tell you what the BMA will ask before they ask it.
AI can. The question is when your board decides to use it.
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda’s regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA’s technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW’s 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Garrison · Hamilton, Bermuda · Practitioner analysis, not legal advice. More at garrison.re/analysis