AI Governance

AI Governance in Bermuda

How AI is governed in Bermuda, and what Jorai Laurenceo argues it needs.

By Jorai Laurenceo, Founder & Executive Director, Laurenceo.

Read the BMA Response Full Bermuda AI Guide

In Short

Bermuda has no standalone AI law. AI is governed through existing law and sector rules: the Bermuda Monetary Authority's proposed Guidance Note for financial services, the Personal Information Protection Act 2016 (PIPA) wherever AI uses personal information, and the Government of Bermuda's own AI Policy for its staff and consultants.

Jorai Laurenceo's position is that Bermuda has chosen the right design, applying existing obligations to AI rather than creating a new licensing regime, and that the hard part is proof: being able to show, on any given day, that AI controls are actually working. His answer is "evidence by default", where every control produces its own record as it runs.

The Rules That Apply

Financial services: the BMA

2025 – 2026

  • The BMA published a discussion paper on the responsible use of AI in July 2025 and a stakeholder letter summarising the feedback on 9 February 2026.
  • On 14 August 2026 it opened a consultation on a proposed Guidance Note, with feedback due by 30 October 2026. It applies existing governance, risk, conduct, cyber, outsourcing and AML expectations to AI, built on eight principles and five outcomes.

Privacy: PIPA

In force 1 January 2025

  • The Personal Information Protection Act 2016 applies whenever an AI system uses personal information, and is overseen by the Office of the Privacy Commissioner.

Government use

Current

  • The Government of Bermuda's Artificial Intelligence Policy covers how its own employees and consultants use AI, including human review of AI decisions that affect people and compliance with PIPA and PATI.

Dates and sources are listed in Laurenceo's guide to AI in Bermuda, which links to the BMA papers, the Government's AI Policy and press coverage.

His Position on the BMA Guidance

In Laurenceo's public response to the consultation (1 October 2026), Jorai Laurenceo supports all eight of the Authority's principles and its principles-based, technology-neutral and proportionate approach, which suits a jurisdiction whose insurance, reinsurance, banking, investment and digital asset sectors use AI in very different ways. The response concentrates on the fifth outcome, adequate evidence for internal assurance and supervisory review, and makes seven recommendations:

  • Recognise system-generated evidence as a preferred form of evidence for material and higher-impact AI.
  • Publish an illustrative minimum evidence set for lower-impact, material and higher-impact use cases.
  • Specify indicative minimum fields for AI inventories, without prescribing a system.
  • Strengthen agentic AI expectations with boundaries enforced outside the model.
  • Treat material vendor model updates as change events that trigger re-verification.
  • Connect AI incident records to PIPA breach assessment.
  • Add worked sector examples for claims, underwriting, AML/ATF, customer-facing generative AI and agentic automation.

Research

In Practice

At Rize Technologies he evaluated key systems and wrote an AI readiness analysis aligned with BMA governance and PIPA compliance, covering what those frameworks mean for local businesses adopting AI. Through Laurenceo Intelligence he tracks AI developments every day and keeps a public board of dated probability forecasts, with every change logged and its reason given.

Questions

Does Bermuda have an AI law?

No. Bermuda has no standalone AI law. AI is governed through existing law, chiefly the Personal Information Protection Act 2016 for personal data, and through sector rules such as the Bermuda Monetary Authority's proposed Guidance Note for financial services.

Who regulates AI in Bermuda?

No single body. The Bermuda Monetary Authority sets expectations for AI in regulated financial services, the Privacy Commissioner oversees PIPA where AI uses personal information, and the Government's AI Policy covers its own use of AI.

What is the BMA's proposed AI guidance?

A Guidance Note on the responsible use of AI in Bermuda's financial services sector, published for consultation on 14 August 2026 with feedback due 30 October 2026. It explains how existing obligations apply to AI, is built on eight principles and five outcomes, and does not create a new licensing regime.

What did Jorai Laurenceo recommend to the BMA?

That system-generated evidence be recognised as a preferred form of evidence, with minimum evidence sets, minimum AI inventory fields, agentic AI boundaries enforced outside the model, re-verification after vendor model updates, AI incidents linked to PIPA breach assessment, and worked sector examples. The full response is on laurenceo.com.

Who researches AI governance in Bermuda?

Jorai Laurenceo researches and publishes on AI governance in Bermuda through Laurenceo, an AI governance think tank based on the island. The Bermuda Monetary Authority, the Office of the Privacy Commissioner and the Government of Bermuda set the rules, and Bermuda College offers an AI Foundations course.

Last updated October 25, 2026