Introduction
On 14 August 2026, the Bermuda Monetary Authority (BMA) published a Consultation Paper proposing a Guidance Note on the Responsible Use of Artificial Intelligence in Bermuda’s Financial Services Sector. The Consultation Paper builds on the BMA’s July 2025 Discussion Paper and its 9 February 2026 Stakeholder Letter, which together established the foundation for the BMA’s approach to AI governance.
The proposed Guidance Note does not introduce new legislation or propose to regulate AI (or agentic AI) as a standalone regulatory regime. Instead, the guidance confirms that existing regulatory expectations relating to governance, risk management, conduct of business, cybersecurity, outsourcing and anti-money laundering should incorporate AI use where applicable.
Comments are due by 30 October 2026. This alert summarises the key elements of the BMA’s proposals.
Proposed regulatory approach to AI
The Guidance Note is built on eight regulatory principles:
- technology neutrality
- accountability
- proportionality
- integration with current frameworks
- robust lifecycle management
- responsible and ethical data use
- explainability and transparency
- adaptability
Scope of application
The proposed Guidance Note applies to all BMA-regulated entities across all sectors. It covers AI that is: developed internally; procured from third-party providers; provided by group entities; embedded in other products or systems; or hosted internally or externally (including cloud-based solutions).
Key themes from the proposed Guidance Note
The below highlights the key themes set out in the proposed Guidance Note:
- Governance and board oversight: The board of a regulated entity retains overall accountability for AI risk. Board members and senior management should have an appropriate understanding of AI-related risks and use cases relevant to their responsibilities, enabling them to challenge management and make informed decisions. Management information requirements should extend to material AI use cases, risk ratings, performance and drift indicators, incidents and near misses, third-party dependencies, audit findings and significant changes.
- AI inventory: Regulated entities are expected to maintain proportionate visibility over their AI use cases. This may be achieved through an AI inventory or through existing registers. The information recorded should include, on a proportionate basis: each AI system and its purpose, ownership of risk, materiality, risk characteristics, materiality and key attributes relevant to oversight.
- Meaningful human oversight: The Guidance Note emphasises that human oversight must be meaningful and proportionate. Models of oversight range include human-in-the-loop review before execution, human-on-the-loop monitoring, exception-based intervention, periodic assurance, post-decision review, escalation triggers, transaction limits, suspension rights or other automated controls. The appropriate form should reflect the risk, autonomy and reversibility of the use case.
- Validation, testing and performance monitoring: Material or higher-risk AI use cases should be subject to pre-deployment testing, ongoing performance monitoring and escalation arrangements proportionate to their risk. Testing considerations include accuracy, reliability, robustness, bias, security, explainability, model drift and the impact of changes in data, configuration or vendor models. For generative AI, additional testing may address hallucination risk, prompt sensitivity, data leakage and susceptibility to prompt injection. Records of validation and testing should be maintained to support existing governance, assurance and supervisory engagement obligations.
- Generative AI and agentic AI: The Guidance Note includes detailed expectations for agentic AI systems capable of planning and executing multi-step tasks, invoking tools, accessing systems and taking actions with limited human intervention. Regulated entities should assess whether the intended outcome could be achieved through an alternative process with materially lower risk. Where agentic capability is used, the BMA expects proportionate limits on autonomy, objectives, duration, tools, data access and permissions, with bounded environments to limit unintended actions and error propagation. Controls over permitted tools, APIs, databases, code-execution environments and payment functions should not rely solely on prompts or model instructions. Existing cyber, operational resilience and incident management frameworks should be applied to agentic AI, including monitoring for unusual access patterns, scope creep, repeated failures and compromised instructions.
- Cybersecurity and operational resilience: AI-specific cybersecurity risks, including prompt injection, data poisoning, deepfake-enabled fraud, and shadow AI are to be integrated into the broader ICT risk and operational resilience frameworks. Regulated entities should consider this whilst preparing for the upcoming, staged by industry, new operational resilience requirements.
- Third-party, group, and supply-chain risk: A regulated entity’s accountability is not transferred by outsourcing AI capabilities to third parties or group entities. Where information about a third-party model or system is limited, entities are expected to apply compensating controls. The BMA has been careful not to impose requirements that assume a level of technical access that vendors in practice will not provide.
- Conduct, market integrity, and AML/ATF: The same standards of conduct and market integrity that apply to non-AI activities apply to AI-driven activities. The BMA highlights the risk of 'AI washing' — misrepresenting AI capabilities in marketing or disclosures. AI deployed in AML/ATF and sanctions contexts must meet the same regulatory standards as traditional approaches and the BMA will expect the regulated entity to be able to explain how the AI manages identified risks.
No pre-approval requirement
Whilst no new notification or pre-approval requirements are introduced, existing notification and approval requirements continue to apply where triggered by the underlying regulated activity, for example, material outsourcing arrangements, significant business changes or operational incidents.
What this means for you
Regulated entities should consider the following steps:
- Establish or update an inventory of AI use cases. Assess each use case’s materiality and risk using the proportionality indicators outlined in Annex C of the Consultation Paper.
- Consider whether existing governance, risk management and board oversight arrangements adequately address AI-related risks.
- Consider board and senior management level understanding of AI use and risk, and introduce training where necessary.
- Identify whether outsourcing, insourcing and vendor arrangements involving AI are subject to adequate contractual protections, due diligence, oversight and controls.
- Review whether AI-specific risks are addressed within existing cybersecurity risk frameworks.
