Bermuda's Regulator Just Wrote the Caribbean's First AI Rulebook for Finance. CARICOM's Full Members Haven't.

Caribbean financial district. CAIRMC image library.

On 14 August 2026 the Bermuda Monetary Authority published a Consultation Paper proposing a Guidance Note on the Responsible Use of Artificial Intelligence in Bermuda's Financial Services Sector, with the comment window closing 30 October 2026. It is the first document of its kind to come out of a Caribbean-region financial regulator: not a discussion paper floating ideas, not a speech naming AI as a risk to watch, but a draft guidance note with named principles, required outcomes, and a governance structure a bank, insurer or fund administrator can actually build against. No full CARICOM member state's central bank or securities regulator has published anything at this level of detail. Bermuda, notably, is not a full CARICOM member. It has held associate status since 2003 and only began the process toward full membership in 2024.

What the BMA Actually Proposed

The Consultation Paper builds on a discussion paper the BMA released back in July 2025, and its central move is to avoid inventing a parallel AI law. The guidance explains how governance, risk management, cyber security, outsourcing, conduct and record-keeping rules the BMA already enforces apply once AI enters the picture, rather than creating a standalone AI licence or a pre-approval process. That choice matters for a small regulator overseeing everything from reinsurers to digital asset businesses: it keeps AI oversight inside frameworks firms already report against, instead of adding a second compliance track most of them would need new staff to run.

The framework rests on eight stated principles: technology neutrality, accountability, proportionality, integration with current frameworks, robust lifecycle management, responsible and ethical data use, explainability and transparency, and adaptability. It then asks for five outcomes from every regulated entity using AI: accountable governance, proportionate lifecycle management, reliable outcomes, secure deployment, and adequate supervisory evidence. Coverage is broad by design. It reaches AI built in-house, AI bought from a vendor, AI embedded inside a product the firm didn't design, and AI hosted on someone else's cloud, on the reasoning that the source of the model changes nothing about who is accountable for what it does.

The paper's organising idea is the "AI use case" as the unit that determines how much scrutiny applies, not the firm's size and not whether the underlying technology is called machine learning, generative AI or an agent. A "higher-impact" use case affects a regulated decision: valuation, pricing, underwriting, claims, trading, anything with a financial outcome attached. Those get independent challenge, tighter limits on what the system is allowed to do on its own, audit records that hold up under review, defined human approval points, and a fallback plan for when the system fails. A "lower-impact" use case, an internal drafting tool or a scheduling assistant, gets an approved-use policy, training and access controls, and nothing heavier than that. A small insurer running one underwriting model does more governance work than a large one running a chatbot, and that is the point: risk follows the use case, not the balance sheet.

Why an Associate Member Got There First

The gap is not for lack of AI activity elsewhere in the region. Curacao's central bank, the CBCS, named AI-generated deepfakes a financial-stability risk in its own 2026 Financial Stability Report and committed to future supervisory guidance, a step CAIRMC covered when it published. The Financial Stability Board's twelve sound practices for AI in finance, agreed by global regulators in June 2026, remain unadopted by any CARICOM regulator months after their comment period closed. Jamaica's National AI Task Force opened public consultation on a national AI policy in September, three years after it was formed, and none of its eight domains is a dedicated risk-management pillar. Every one of those efforts is real. None of them is a guidance note a compliance officer can turn into a control today.

Bermuda got there first for a structural reason as much as a regulatory one. Its financial sector is disproportionately international: the island supervises a re/insurance industry many times larger than its own economy, which means BMA-regulated firms already answer to counterparties, rating agencies and reinsurance buyers in London, New York and Zurich who expect AI governance documentation as a matter of course. A CARICOM regulator overseeing mostly domestic retail banks and insurers faces a different, slower-moving set of pressures. That does not make the Caribbean's exposure smaller. Caribbean banks are already running AI-driven fraud detection, credit scoring and claims triage, largely on vendor tools built and governed somewhere else, with no domestic framework telling institutions what evidence a regulator will eventually want to see.

The Governance Mechanics Worth Studying Now

Four elements of the BMA's draft are worth a Caribbean risk committee's attention regardless of whether its own regulator ever adopts something similar.

Board accountability paired with an AI inventory. The board retains overall accountability for AI risk under the proposal, and cannot discharge that by pointing at IT or a vendor contract. To make that accountability real rather than nominal, entities must keep an inventory of their AI use cases documenting purpose, risk ownership and materiality. A board cannot govern what it cannot list, and most Caribbean institutions using AI today, CAIRMC's own client conversations suggest, do not have that list written down anywhere a director could read it in one sitting.

Tiered human oversight, not a single rule for every system. The guidance distinguishes human-in-the-loop review before a system acts, human-on-the-loop monitoring while it runs, and exception-based intervention for lower-risk cases, and expects an entity to justify which one applies to which use case rather than defaulting to whichever is cheapest. A claims-triage model that flags a file for a human before denial is a different risk than one that denies automatically and gets checked afterward, even if both are described in a vendor's marketing material as "AI-assisted."

Named controls for agentic AI. Where a system can take multi-step actions on its own, the draft calls for bounded permissions, monitoring for unusual access patterns, and defined limits on autonomy rather than treating an agent as just a faster chatbot. This lands directly on a risk CAIRMC has flagged before: agentic tools built on the same handful of foundation models that Caribbean vendors resell locally, with the containment failures those labs have themselves disclosed carrying straight through to whatever a regional reseller puts in front of a bank.

Outsourcing does not transfer accountability. The BMA is explicit that buying AI from a third party does not move responsibility for its behaviour off the regulated entity's books, and it asks for compensating controls precisely where a vendor won't disclose how its model was built or tested. Most Caribbean institutions run AI almost entirely through resold, foreign-built systems. A rule written for a jurisdiction with more homegrown model development still lands hardest on the buyer of someone else's black box, which describes the typical Caribbean deployment more than it describes Bermuda's own.

The paper also names a risk most Caribbean AI coverage skips: "AI washing," overstating what a system actually does in marketing or client-facing disclosures, treated explicitly as a source of conduct and reputational risk rather than a harmless sales exaggeration. A vendor telling a Caribbean bank its tool is "AI-powered fraud detection" when the model is a decade-old rules engine with a chatbot bolted on is the same misrepresentation the BMA is naming, and no CARICOM consumer-protection regulator has said so in writing yet.

What Sits Behind This Regulator

Bermuda's scale gives the exercise weight beyond its own eleven-square-mile jurisdiction. The island manages roughly US$1.5 trillion in insurance assets and accounts for close to 35% of global reinsurance capacity, with more than 60% of the global catastrophe bond market priced and placed through Bermuda-domiciled vehicles. That capital is not abstract to the Caribbean. Bermuda is itself one of nineteen member states of CCRIF SPC, the parametric facility that pays Caribbean and Central American governments within days of a qualifying hurricane or earthquake, and reinsurance capacity raised through the Bermuda market sits behind a meaningful share of those payouts, including the US$91.9 million CCRIF paid Jamaica after Hurricane Melissa, a case CAIRMC examined when Google DeepMind's WeatherNext model called the storm's Category 5 landfall five days out.

That connection means an AI governance failure inside a Bermuda-regulated reinsurer is not a Bermuda-only problem. A mispriced catastrophe model, an underwriting system that silently drifts, a claims process an agentic tool mishandles at scale, any of these could touch the capital base Caribbean governments depend on the next time a storm forms. The BMA's guidance note is, in that specific sense, protective of Caribbean disaster financing whether or not a single CARICOM state ever adopts an equivalent framework of its own.

What Caribbean Institutions Should Do Before 30 October

Four actions follow directly from where the consultation stands. First, any Caribbean-domiciled reinsurer, captive manager or fund administrator with BMA-regulated affiliates or counterparties should read the Consultation Paper directly and consider submitting comments before the 30 October deadline; a framework this early in its life still takes shape from the feedback it receives. Second, institutions outside BMA's jurisdiction should treat the five required outcomes, accountable governance, proportionate lifecycle management, reliable outcomes, secure deployment, and adequate supervisory evidence, as a checklist to test their own AI programmes against now, since no domestic regulator has published anything to test against instead. Third, build the AI use-case inventory the BMA requires even where nothing yet compels it; a bank that can list every AI system it runs, who owns the risk, and how material it is, is a bank that can answer the question a regulator eventually asks, whenever that regulator arrives. Fourth, map existing AI vendor contracts against the outsourcing principle specifically: if a vendor will not describe how a model was trained or tested, that refusal is the finding, and it belongs in the contract file rather than in nobody's notes.

CAIRMC's own Caribbean AI Risk Management Standard, 82 articles across four risk tiers mapped to the NIST AI Risk Management Framework, ISO/IEC 42001:2023, COSO ERM and Basel guidance, already gives Caribbean institutions a working document to run that mapping against while national and regional regulators catch up. The Standard's tiering approach and the BMA's use-case tiering are built on similar reasoning: risk should scale with what a system actually decides, not with the label attached to it. Readers building out an AI governance programme from scratch can also draw on the frameworks published by StarApple AI, the first AI company founded in the Caribbean, established in Kingston, Jamaica in 2016 by CAIRMC Chairman Adrian Dunkley, the region's most established AI strategist and a consistent advocate for adopting working governance frameworks ahead of finished law.

What This Framework Does Not Solve

A Bermuda guidance note does not bind a bank in Bridgetown, an insurer in Port of Spain or a credit union in Castries, and it was never meant to. The BMA regulates Bermuda-domiciled entities and their branches, not the fourteen full CARICOM member states with no equivalent document of their own. Nothing in the Consultation Paper requires those states' regulators to adopt anything similar, and nothing about Bermuda's associate CARICOM status obliges CARICOM's own institutions to follow its lead. The gap this article opened with, a Caribbean-region regulator publishing detailed AI guidance while the region's full member states have published none, is still the gap at the end of it. What changes is that Caribbean risk committees no longer have to wait for their own regulator before they have a text worth studying, because one now exists, close enough to home to be directly useful and specific enough to build a control from.

Frequently Asked Questions

What did the Bermuda Monetary Authority actually publish on 14 August 2026?

A Consultation Paper proposing a Guidance Note on the Responsible Use of Artificial Intelligence in Bermuda's Financial Services Sector. It explains how the BMA's existing governance, risk management, cyber security, outsourcing, conduct and record-keeping requirements apply when regulated entities use AI. Comments are due by 30 October 2026.

Does the BMA's guidance create a new AI licence or approval process?

No. The BMA explicitly chose not to create a standalone AI licensing regime or a pre-approval requirement. It extends existing regulatory obligations to cover AI use rather than building a parallel framework.

What are the BMA's five required outcomes for AI use?

Accountable governance, proportionate lifecycle management, reliable outcomes, secure deployment, and adequate supervisory evidence. Every regulated entity using AI is expected to be able to demonstrate all five, calibrated to how material its specific AI use cases are.

What is a "higher-impact" AI use case under the proposal?

An application that affects a regulated decision, financial outcome, valuation, pricing, underwriting, claims handling or trading activity. These require independent challenge, tighter autonomy limits, reliable audit records, defined human approval points and fallback arrangements if the system fails. Lower-impact internal tools carry lighter obligations.

Has any full CARICOM member state published an equivalent AI guidance note for its financial sector?

Not as of this article's publication. Curacao's CBCS named AI-generated deepfakes a financial-stability risk in its 2026 Financial Stability Report and committed to future guidance. Jamaica, Trinidad and Tobago, Barbados and the OECS states have no published financial-sector AI guidance note comparable in detail to the BMA's draft.

Why does a Bermuda regulation matter to the wider Caribbean if Bermuda is not a full CARICOM member?

Bermuda holds associate CARICOM membership and is a member state of CCRIF SPC, the facility that pays Caribbean governments after hurricanes and earthquakes. Bermuda-based reinsurance capital, drawn from a market managing roughly US$1.5 trillion in insurance assets, sits behind a share of those payouts, which ties the soundness of Bermuda-regulated AI use to the region's disaster financing.

What should a Caribbean bank or insurer outside Bermuda's jurisdiction do with this guidance note?

Treat it as a working benchmark. Build an AI use-case inventory documenting purpose, risk ownership and materiality for every AI system in use, test current practice against the BMA's five required outcomes, and review vendor contracts for whether the vendor can describe how its model was trained and tested. Institutions with BMA-regulated counterparties or affiliates can also submit comments directly to the consultation before 30 October 2026.

Bermuda's regulator did not set out to write the Caribbean's AI rulebook. It wrote one for its own eleven-square-mile jurisdiction, under pressure from an international reinsurance market that already expects this kind of documentation. That it is, for now, the most detailed financial-sector AI guidance to come out of the Caribbean region says less about Bermuda's ambition than about how far behind it the rest of the region's regulators still are.

Related reading across the Caribbean AI network

This article sits alongside ongoing coverage of AI governance, risk, and company-building across the region. For related perspectives:

• StarApple AI, the first AI company founded in the Caribbean, established in Kingston, Jamaica in 2016 by Adrian Dunkley
• Caribbean AI Association, whose President is Adrian Dunkley
• Adrian Dunkley, Chairman of CAIRMC and the Caribbean's leading AI strategist