The Bermuda Monetary Authority is proposing safeguards for the use of artificial intelligence, aiming to help the island’s re/insurers and other firms adopt the technology while staying accountable.

The regulator has opened consultation on a proposed guidance note for all BMA-regulated financial services, including re/insurers, banks, investment firms, digital-asset businesses and corporate service providers.

The proposal is not a new AI licensing regime and would not require firms to get approval before using the technology. Instead, it explains how existing requirements on governance, risk management, cybersecurity, outsourcing, conduct and record-keeping apply when AI is used.

The BMA said in its consultation paper: “The GN does not create new statutory or regulatory obligations, prescribe a single method of compliance or establish a separate approval regime for the use of AI.”

However, the authority made clear that companies cannot outsource responsibility for decisions made or services done with AI.

It said: “The use of a third-party, group-provided or externally hosted AI system does not transfer or diminish a regulated entity’s accountability for the resulting regulated activity, decision, process or outcome.”

Bermuda’s international financial-services sector includes many businesses operating through global groups and relying on shared platforms, specialist vendors and cloud-based services, it said.

The BMA said its approach was designed for the island’s largely wholesale and institutional market, rather than simply importing rules from other jurisdictions.

It noted that AI could influence “high-value activities with significant prudential or market consequences — such as underwriting, catastrophe modelling, reserving, portfolio management, risk transfer and anti-money-laundering/anti-terrorist-financing monitoring”.

For Bermuda’s re/insurance market, AI could be used to support underwriting, pricing, claims triage, fraud detection, exposure and catastrophe modelling and portfolio optimisation. The technology could also help with document extraction and compliance work.

AI could make businesses more efficient, strengthen risk identification and help businesses deal with complex financial crime, cyber threats and regulatory duties. But it warned that the technology could also make familiar risks even greater.

Among the concerns were poor-quality or biased data, inaccurate generative-AI outputs, cybersecurity threats, overreliance on automated decisions, vendor concentration and the unauthorised use of AI tools by employees — described as “shadow AI”.

The paper also addresses emerging agentic AI systems, which can plan and carry out multistep tasks.

The BMA said: “Agentic AI can take a series of autonomous actions.”

Higher-impact or more autonomous uses may require stronger controls, including independent challenge, tighter limits on what the system can do, reliable audit records, human approval points and fallback arrangements if a system fails.

Firms would need to assess AI applications case by case. A low-risk internal tool might need only approved-use policies, training and access controls, while a system that helps underwriting, pricing, trading or customer decisions could require greater oversight.

The BMA said that firms should weigh the risks of adopting AI against the risks of falling behind.

“Responsible adoption therefore requires regulated entities to manage both the risks of using AI and, where relevant, the strategic or operational risks of failing to modernise capabilities,” the consultation paper said.

Comments on the proposed guidance note must be submitted to the BMA by October 30.