Discussion Paper - The Responsible Use of Artificial Intelligence in Bermuda's Financial Services Sector (2025-07-30)

Summary

This is a Discussion Paper issued by the Bermuda Monetary Authority seeking industry feedback on how AI is used across Bermuda's financial services sector and on a proposed outcomes-based risk management and governance framework for AI. It is not a binding rule; it reviews global regulatory approaches (EU AI Act, UK, Singapore, US NIST, and international standard-setters such as IAIS, FATF, IMF, IOSCO and BIS) and sets out the BMA's early thinking on supervisory expectations for AI governance.

• Scope of framework: Proposes governance and risk considerations covering AI identification and inventory, risk assessment across impact severity, autonomy/human oversight, complexity/explainability, data sensitivity, and deployment context and scale.
• Governance areas covered: Data management, model development and validation, human oversight, explainability and fairness, ongoing monitoring and change management, third-party risk management, generative AI controls, and cybersecurity/operational resilience.
• Proportionality: Governance requirements would scale based on an institution's size, complexity, AI maturity and nature of customer relationships (retail versus institutional).
• Board accountability: Ultimate accountability for AI governance is proposed to rest with an entity's board of directors.
• Next steps: BMA plans to analyse feedback in Q4 2025, hold follow-up consultations and workshops in Q1 2026, and issue a final proposal in Q3 2026.

Because this is a discussion paper rather than final rules or guidance, it does not itself impose binding compliance obligations. Its primary immediate requirement is a request for stakeholder feedback by a set deadline, which will inform future BMA guidelines on AI governance.

Key obligations

• Industry stakeholders and interested persons wishing to respond must submit feedback via the online survey or by email to policy@bma.bm by 30 September 2025, including the company name and the paper's title in the email subject line if using the email option.

Applies to

banks, insurers and reinsurers, investment managers, digital asset businesses, trust and corporate service providers, other BMA-regulated financial institutions

Deadlines

• 30 September 2025: Deadline for industry stakeholders and other interested persons to submit feedback on the Discussion Paper, via survey form or email to policy@bma.bm.
• Q4 2025: BMA target period to analyse feedback received on the Discussion Paper.
• Q1 2026: Target period for follow-up consultations and industry workshops.
• Q3 2026: Target date for BMA's final proposal on AI regulatory framework.