I've sat in a lot of boardrooms this year where AI comes up, and I've noticed the same instinct almost every time: "we'll deal with the governance piece once the BMA's guidance lands." I understand the logic, but I don't think it's the right call.
We've seen this pattern before. It's exactly how firms approached the Operational Resilience Code two years ago, and the ones who waited spent 2026 scrambling to retrofit a framework while the ones who started early spent it refining one. AI governance is on the same track, just a step or two behind.
The BMA has already told us where this is going
The Authority published its Discussion Paper on the Responsible Use of AI in Bermuda's Financial Services Sector back in July 2025, and formal guidance has been expected through 2026 ever since. That's not a surprise deadline. Firms have had well over a year of runway to know this was coming, and the direction of travel; board accountability, risk-based controls, clear policy on how AI touches regulated activity, has been visible the whole time.
So, the real question isn't "what will the guidance say?" It's "why hasn't more of the island acted on what we already know it's going to say?"
Most firms are still in the awareness phase
That's what I'm hearing everywhere - boardrooms, working groups, industry panels. People are asking good questions. Where is AI actually being used in our organisation? Who signed off on it? What happens if a model makes a bad call on something regulated? But asking the question isn't the same as answering it, and very few firms I talk to have turned those conversations into an actual governance framework with a named owner behind it.
That gap between awareness and action is the same one that defined the Operational Resilience Code cycle. It closes eventually. The only choice firms have is whether they close it on their own terms or the BMA's.
The group-entity problem is coming for AI too
If you've read anything I've written about the Cyber Code or the Insurance Code, you'll know the group-entity disconnect is the compliance failure I see most often in Bermuda - policies and frameworks built for the parent company, with no Bermuda-specific ownership behind them. AI is heading straight into the same trap. A lot of the AI tools showing up inside regulated Bermuda entities right now arrived through Group IT, not through a local risk assessment. Nobody on the island signed off on them, and nobody on the island could tell a BMA examiner who's accountable for how they're used.
The Code experience already taught us the fix. It isn't rebuilding from scratch, it's localisation: a Bermuda-specific inventory of where AI is actually being used, a named local owner, and board-level sign-off that isn't just a nod to a Group policy document.
What "getting ahead" actually looks like right now
Firms that are ahead of this aren't waiting for a rulebook to tell them what governance means. They're building three things in parallel: a live register of where AI touches regulated activity, a risk-based control that scales with how sensitive that use case is, and a clear line of board accountability for all of it. None of that needs to wait for the BMA's guidance to be finalised, because none of it will be wasted effort once it lands. It's the same groundwork good governance requires regardless of which regulator is asking.
This isn't just a compliance exercise
Done properly, AI governance is a competitive advantage, not a box to tick. The firms that can show a client, a reinsurer or an examiner exactly how they've thought through AI risk are the ones who'll move faster when everyone else is still explaining themselves. The firms still waiting for the guidance to tell them what to do will be doing catch-up, again.
If any of this reflects challenges you're navigating in your own organisation, get in touch. We're here to help.
