Artificial Intelligence and Decision Making

02 Oct Artificial Intelligence and Decision Making

Posted at 11:39h in News & Insights by Charisma Lyall

Where Judgement and Accountability Sit

Charisma Lyall

ConsultGC News and Insights | October 2026

From 1 October to 12 November, Guernsey will go “All In” on artificial intelligence. The Guernsey AI Sprint will bring together businesses, industry bodies and the wider community for a practical programme covering foundation learning, governance, leadership, implementation and education. Its subjects include board oversight, trusteeship, investment management and an anti-money laundering hackathon.[1]

The timing is useful. AI is already being used to search records, summarise papers, compare information, identify anomalies, draft documents and recommend actions. Some uses are modest. Others affect who or what receives attention, the options and information put before a decision-maker and, increasingly, the action taken.

In September 2026, independent researchers reported unauthorised action by agents built on a major AI provider’s models, a case examined later in this article. It illustrates a further risk: a system may exceed the task it was given before either the user or the provider recognises what has happened.

AI is too often treated as a compliance question. That is too narrow. Compliance is one participant in the process. The wider issue is how AI changes decision-making throughout a regulated firm: who sets the objective, which information is used, what the system is allowed to determine, who can challenge it and who remains responsible for the result.

This article continues the theme considered in Beyond Private Equity.[2] Innovation does not change accountability. It changes the knowledge, information and arrangements required to discharge it. AI makes that point particularly acute because it can influence a decision without formally making it.

What the GFSC policy statement means

The Guernsey Financial Services Commission published its policy statement on the use of artificial intelligence on 29 January 2026.[3] The statement is deliberately enabling. It supports innovation and encourages firms to adopt machine learning, large language models, generative AI and agentic AI where they can improve efficiency and reduce administrative burdens.

The statement also explains why the Commission does not propose a separate AI rulebook. Guernsey’s regulatory regime is principles based. Firms may implement innovations within the existing framework without specific approval or prior discussion with the Commission. They should treat AI adoption as they would any other technical or strategic project, applying the Finance Sector Code of Corporate Governance, particularly its principles on accountability and risk management, the Minimum Criteria for Licensing and the requirements in the Handbook on Countering Financial Crime.

That position should not be read as regulatory approval of a particular system or use. If no approval or discussion is required, the absence of an objection from the Commission cannot sensibly be treated as endorsement. The firm has the space to decide how it will use the technology, and it bears the corresponding responsibility for making and evidencing that decision.

Nor does the absence of AI-specific rules leave a gap in which ordinary duties cease to apply. A board must still govern the business prudently. A licensee must continue to satisfy the Minimum Criteria for Licensing. Relevant functions must comply with data protection, confidentiality, conduct, financial-crime and record-keeping requirements, to name but a few. The legal and regulatory question is rarely whether a rule contains the letters “AI”. It is whether the firm can comply with the purpose and substance of the rule when AI forms part of the process.

The Commission stops short of prescribing accreditation or certification, pointing firms instead towards the NIST AI Risk Management Framework, ISO/IEC 42001 and the UK National Cyber Security Centre’s guidance. NIST organises AI risk management into four functions — Govern, Map, Measure and Manage — applied continuously across the system’s lifecycle. These frameworks supply useful methods and vocabulary. They do not decide whether a use is appropriate for a Guernsey firm, allocate legal responsibility or substitute for judgement by the board and senior management.[4]

The statement also leaves room for direct engagement. If an existing rule genuinely obstructs a proposed trial, the Commission is willing to discuss the Innovation Sandbox, a variation or waiver on a pilot basis, or redrafting where technological change has made a rule obsolete. That is a route for a real regulatory obstacle. It is not a means of transferring the firm’s assessment of the use case to the regulator.

The decision matters more than the label

The first governance task is to identify what the system actually does. Product descriptions such as assistant, copilot, model or agent are not a reliable guide. The same product may perform a low-risk drafting task in one context and materially influence a regulated decision in another.

AI may process information by finding, extracting, translating or summarising it. It may frame a decision by deciding what is relevant, how matters are ranked and which cases are escalated. It may recommend a conclusion. It may make or implement the decision itself.

Formal authority is only one measure of influence. A board may retain the final vote, but its view will be affected by the paper it receives. A trustee may remain free to reject a suggested distribution, but the analysis may have excluded a factor the system did not recognise as relevant. An MLRO may retain the statutory reporting decision while an automated process determines which activity reaches the investigation team. In each case, the human remains present, but part of the decision has already occurred upstream.

The assessment should therefore follow the whole chain from data and objective to action. Who chose the source material? What was the system asked to optimise? Which thresholds determine escalation? What is omitted or compressed? Does the output expose uncertainty and contrary indications? How often do people depart from it? What happens after they approve it?

This is why a policy stating that AI will not make “material decisions” may say less than it appears. A tool that filters the cases, drafts the analysis and presents one preferred answer may determine the practical outcome even if a person supplies the final click.

Judgement is more than error checking

Generative AI can produce an answer that is fluent, confident and wrong. An obvious error is usually manageable. A plausible answer is harder, particularly where the user lacks the knowledge, source material or time to test it.

Judgement is not a final check for spelling, arithmetic or a fabricated citation. It includes identifying the right question, deciding which facts and duties matter, understanding the purpose of the applicable requirement and recognising when an apparently routine exception points to a wider problem. It also includes deciding how much uncertainty can properly be accepted and when further enquiry, specialist advice, escalation or regulatory engagement is required.

Consider an AI-assisted customer risk assessment. The system may retrieve corporate records, identify adverse media, compare ownership information and propose a risk rating. An indirect shareholding, a changed registered address or an old adverse-media mention may fall below its threshold yet change the overall picture. What the system treats as noise reflects a judgement about significance. The final assessment may still depend on the credibility of an explanation, the reliability and age of a source, the firm’s risk appetite and whether the overall account of the relationship makes sense. More data does not remove those questions.

The same applies to a board paper. AI may turn 200 pages of reporting into five pages of useful analysis. But compression may omit a changed assumption that a director would recognise as material. Keeping the original 200 pages somewhere on the system is not sufficient. The selection and challenge process must give the board what it needs to govern.

My own threshold for using AI

My own approach is deliberately conservative. I generally ask AI a question only when I already know, in substance, what the answer will be. I use it to draft, organise or refine something I already understand: to find a clearer structure, identify repetition or test whether an explanation works. It is not supplying the underlying conclusion. That still requires care, because a fluent answer can reinforce what I already believe rather than prompt me to test it.

That is why I am comfortable using it. I have an independent basis for recognising when a draft misses a qualification, mistakes the law, overstates the evidence or misunderstands the context. I remain responsible for every proposition and for deciding whether the words express my analysis accurately.

This is a personal threshold which works for me, not a general prohibition on using AI for discovery, research or recommendation. Those can be legitimate uses. They require different controls because the user cannot rely on prior knowledge to identify a plausible error. Depending on the decision, that may mean checking primary sources, examining the underlying data, testing the answer against contrary evidence, obtaining specialist advice or declining to use an output that cannot be verified properly.

The relevant distinction is between assistance and dependence. The more the firm depends upon the system for facts, expertise, selection or conclusion, the more important it becomes to establish how the result will be tested and who is capable of doing so.

What meaningful human review requires

Many governance frameworks refer to a human in the loop. That expression identifies a location in a process, not the quality of the control. Meaningful review requires competence, information, authority and time, with challenge at the points where it can affect the decision.

Competence

The reviewer must understand the subject matter well enough to identify an incomplete answer, an immaterial correlation or a question directed at the wrong issue. They also need a practical understanding of the system’s limitations. They do not need to reproduce the model’s operation. They must be able to disagree with its output for any reason. Two familiar biases explain why a competent reviewer may not. Automation bias is the tendency to defer to an output simply because it is confident and consistently formatted. Anchoring is what happens next: once a system proposes a rating, a valuation or a distribution amount, that figure becomes the frame even for a reviewer formally free to depart from it. Competence includes noticing both at work in one’s own judgement, not only in the system’s.

The objective is role-appropriate competence. Requiring every director, trustee, compliance officer or administrator to become an AI specialist would be unrealistic and would blur responsibility. Each person needs enough knowledge to perform their own role, ask the questions relevant to it and recognise when technical or other specialist input is required. Before your own board next relies on a system’s output, it is worth asking whether the people around the table could explain, in their own words, what it is actually doing rather than what its label implies.

Competence also has a longer-term dimension. Junior staff learn judgement by conducting research, reconciling records, drafting first versions and seeing how experienced colleagues correct them. If AI removes much of that work, firms will need another way to develop the people expected to review its output later. An operating model that saves time today but weakens the future supply of competent reviewers creates a governance problem of its own.

Information

A reviewer needs access to the material required to test the answer. For a significant decision this may include the sources used, relevant data, assumptions, limitations, uncertainty and contrary indicators. A conclusion without that material can be difficult to challenge, however experienced the reviewer may be.

The Bank of England and FCA survey of AI in UK financial services illustrates the issue.[5] Eighty-four per cent of participating firms reported an accountable person for their AI framework, usually at executive level. Only 34 per cent reported a complete understanding of the AI technologies they used, while 46 per cent reported only partial understanding. Limited understanding was associated particularly with third-party systems. An accountable name on an organisation chart does not give that person the information needed to discharge the role.

Authority and opportunity

The reviewer must be able to reject the output, require further work, change the proposed action and escalate the matter. They also need enough time to do so before the result becomes irreversible. A formal override right has little value where staff must clear hundreds of cases, every departure requires a lengthy justification while acceptance is automatic, or performance measures reward agreement with the system.

Override data can reveal whether human review is operating as expected, but it requires interpretation. A very high override rate may indicate a poorly performing model. A rate close to zero may show that the model is excellent, or that users have become unwilling or unable to challenge it. The board needs information that distinguishes between those explanations.

Evidence

A record stating “reviewed and approved” proves that a workflow step was completed. It does not show what judgement was exercised. For a material decision, the record should identify the important information considered, the question or limitation tested, the reason for accepting or departing from the AI output and the person responsible for the conclusion.

Most AI-enabled decisions occur in day-to-day work: a risk rating accepted, a report drafted, an exception resolved. Records should capture the substance of those decisions without reproducing the entire analysis. They should explain which assumption mattered, what evidence supported it and why the decision remained reasonable despite any uncertainty. This is consistent with the Information Commissioner’s expectation that significant AI-related trade-offs should have clear accountability, independent approval and documentation to an auditable standard.[6]

Where review happens

A complex decision is rarely made once. Data is selected, assumptions are set, an output is interpreted and a proposal is presented for approval. An omission or biased assumption introduced early may be invisible by final sign-off. Reviewing only the outcome tests whether the ending is credible, but may leave the reasoning that produced it unexamined. Firms should place review where challenge can still change the result, including data selection, model configuration and interpretation. NIST’s iterative approach similarly recognises that risk changes throughout a system’s life.

AI can also contribute to the answer rather than only requiring one. A system configured to test a conclusion — flagging a contrary indicator, generating an alternative scenario, or checking a proposed decision against stated risk appetite — gives a reviewer something to challenge with, rather than only something to challenge. Used this way, AI does not replace the human review discussed above. It gives it more to work with.

Responsibility across the firm

Treating AI primarily as a compliance project risks assigning ownership to the wrong part of the firm. Compliance may advise on the framework, challenge a use or monitor outcomes. It should not become responsible for every commercial, fiduciary, operational or regulatory decision that technology influences.

The governing body

The board should approve the firm’s approach to AI in a form connected to business strategy and risk appetite. It should know where AI is used in material processes, which decisions remain reserved to people, how responsibilities are allocated and what information will demonstrate that the controls work in practice.

The Finance Sector Code of Corporate Governance already requires the board to maintain sound governance, an appropriate balance of skills and competence, effective risk management and oversight of material outsourced functions.[7]Delegation does not relieve the board of overall responsibility. AI changes the subject matter of that oversight. It does not create a different standard of responsibility.

In October 2024, the US Securities and Exchange Commission fined Rimar Capital and its owner for falsely marketing an artificial intelligence-driven platform for trading securities that did not exist, having raised $3.7 million from 45 investors on the strength of that claim. A board member of the US entity paid a separate civil penalty for his part in the misrepresentation. For boards, the broader point is that material claims about what an AI system does require an appropriate basis for reliance; they cannot simply be accepted as a technology or marketing matter.[8]

Rather than the mathematics of every model, a board needs to understand the purpose for which the firm relies on it, the consequences of failure, the limits placed on its authority and the evidence used to assess continuing suitability.

Trustees and other fiduciaries

A trustee may use AI to organise trust records, identify relevant provisions, model possible distributions or prepare an investment review. The fiduciary decision must still be made by the trustee according to the trust instrument, applicable law and the circumstances of the beneficiaries. A recommendation trained on general patterns cannot determine the weight to be given to an unusual family circumstance or the purpose for which a power was conferred — the same tendency that makes a system efficient with the routine case can make it blind to the exception, treating what is unusual as noise rather than as the fact that actually calls for discretion.

The difficulty is not confined to an autonomous decision. If a system standardises the factors presented for every distribution, genuine discretion may narrow over time without an express policy change. Trustees should consider both the reliability of the output and whether repeated use is reshaping the manner in which discretion is exercised.

Investment managers

An investment manager using AI for research, portfolio construction or trade recommendations should understand the data, objective and constraints on which the result depends. It should be able to explain how the use fits the mandate and how model behaviour is monitored when markets or data relationships change.

A model may be technically accurate in optimising the objective it was given and still be unsuitable because the objective does not reflect the mandate, liquidity requirements, concentration limits or investor expectations. The governance question therefore begins before performance testing. It asks whether the right problem was specified.

MLROs and financial crime teams

AI can assist with customer due diligence, adverse-media review, transaction monitoring and case prioritisation. These are areas in which the volume of information makes technological support particularly attractive. They are also areas in which filtering decisions determine what a human sees. As with the customer risk assessment considered earlier, what a system discards below its threshold is not neutral; the threshold is a judgement, fixed in advance and applied uniformly, about what counts as significant.

The MLRO should understand which cases the system suppresses as well as those it escalates, how thresholds were selected, how changes in customer behaviour are captured and what testing is conducted for groups or transactions that may be under-detected. A model trained on historical decisions can amplify whatever pattern of under- or over-detection already existed in that history, presenting it back as statistically grounded rather than inherited. Where AI drafts an analysis or external report, the responsible person must verify the facts and conclusion rather than assume that a polished narrative reflects the underlying evidence.

Administrators and operational functions

Administrators may use AI to reconcile records, classify documents, process instructions, answer investor enquiries and identify exceptions. Their responsibility lies not in reconsidering every delegated commercial decision, but in performing their own function competently and recognising when an operational anomaly may indicate a wider legal, financial-crime, valuation or governance issue.

Automation can make a process more consistent while concealing an exception that falls outside the categories anticipated when the process was designed — the categories are a design choice, not a complete map of what might occur. Exception handling, escalation rights and the ability to stop automated action are therefore as important as the accuracy rate across routine cases.

Compliance risk and assurance functions

Compliance and risk functions should help establish the control framework and provide informed challenge. Internal audit or another independent assurance function may test whether the framework operates as described. None should accept a control description based only on policy documents or vendor materials. They need evidence from actual use: output testing, overrides, incidents, complaints, drift, access controls and changes made by the provider or the firm.

The functions also need sufficient independence from the team seeking the efficiency benefit. That means clarity about who accepts the risk and who tests whether the stated controls are effective – not a block on experimentation.

Third party systems and concentration

The familiar principles of outsourcing provide a starting point. A firm may appoint a specialist to perform an activity, but responsibility and accountability for a material outsourced function remain with the board. The same logic applies where capability is supplied through an AI provider, embedded in ordinary software or accessed through a chain of cloud, model and data providers.

The Bank and FCA survey found that one third of reported AI use cases were third-party implementations.[9] The proportion rose to 64 per cent in risk and compliance. Respondents also reported substantial concentration among their main cloud, model and data providers. A firm may depend on an entity it has not contracted with directly and have limited visibility of changes below its immediate supplier.

Vendor due diligence should cover more than security questionnaires and contractual warranties. One question matters more than most: whether client data submitted to the system can be used to train the provider’s models, retained beyond the immediate task, or accessed by other customers of the same service. It is widely understood, not least in light of the Paradise Papers, that the protection of client information is a reputational issue of the first order — for the individual licensee and for the Bailiwick as a whole. The firm should also understand where processing takes place, which other services are involved, how changes are notified, what testing evidence is available, how incidents will be reported, whether outputs and logs can be retrieved and what happens if the service becomes unavailable or unsuitable.

In September 2026, the independent research group Transluce reported that agents built on OpenAI’s models had taken unauthorised action, including attempts to access government and financial-sector websites and an unsuccessful cryptocurrency trade.[10] On Transluce’s account, ordinary data-retrieval tasks had escalated into hacking-style tactics without deliberate misuse. OpenAI subsequently disabled the model involved and tightened its controls, but acknowledged that it did not yet have a complete picture of the activity.[11] The reported access to federal government websites prompted the House Financial Services Committee’s ranking member to call for a pause on further model releases pending a fuller account.[12] The governance point is that a regulated firm can inherit risks arising within a provider before either the firm or the market knows those risks exist, including through AI embedded in other software.

Concentration extends the risk beyond a single contract. Where many firms rely on the same underlying models, cloud platforms or data providers, an error or failure may affect them simultaneously. A board should consider how the firm would cope if its provider failed while its peers and counterparties faced the same disruption.

Certification may support that enquiry, but it cannot establish suitability for the firm’s purpose. Nor should a provider’s reputation be treated as a proxy for the firm’s assessment. The provider can explain the product. The firm must decide whether the use, data, authority and controls are appropriate for its business and obligations.

AI functions may also be added to existing software through routine updates or activated by users without a procurement exercise. An AI register based only on projects carrying an AI label will miss embedded models and informal use. Firms need a route by which staff can identify new functionality and determine whether it changes the risk classification of the process.

A proportionate governance framework

Not every use requires board approval, independent validation and detailed decision records. Reformatting an internal draft does not create the same risk as determining customer access, changing a risk rating, influencing trustee discretion, executing a trade or deciding what information reaches a regulator. Client information must be protected in every case.

Proportionality should be based on the use rather than the novelty of the technology. Relevant factors include the significance and reversibility of the outcome, the sensitivity and quality of the data, the degree of autonomy, the ability to explain and test the result, the effect on customers or markets, the use of third parties and the firm’s ability to operate or exit if the system fails.

A framework built around those factors should include:

an inventory of AI uses, including functions embedded in existing systems and uses adopted by individual teams;
a recorded assessment of the purpose, owner, data, decision affected, possible harm and materiality of each use;
a governance map showing who approves the use, who owns the underlying decision, who supplies technical support and who gives independent challenge;
clear limits on what the system may decide or implement, with effective stop, override and escalation arrangements;
testing before deployment and during use, including accuracy, omissions, performance across relevant groups and model or data drift;
requirements for source checking, explanation and record keeping that reflect the importance of the decision;
third-party controls covering data, subcontracting, change notification, incidents, access to evidence, continuity and exit;
management information covering outcomes, overrides, incidents, complaints, exceptions and material changes rather than efficiency alone; and
training and workforce planning designed around the judgement each role must retain and develop.

A low-risk classification should itself have a recorded basis. It should be reconsidered when the data, function, user group, provider, level of autonomy or consequence of the output changes. A tool can move from drafting to recommendation, and from recommendation to action, through small operational choices without a single obvious implementation date.

Questions for boards and decision makers

The questions a board or other decision-makers ask should begin with the activity and outcome, rather than the model or product name:

What work is the system performing, and which decision or outcome does it influence?
What information does it include, exclude, rank or compress before a person sees the result?
Who owns the underlying decision and who is responsible for the technology and data — and could that data train the provider’s models or reach its other customers?
Which decisions remain reserved to people — not only at final approval — and can those people genuinely reach a different conclusion?
What knowledge and information does the reviewer need to test the result?
What would happen if the output were wrong, incomplete, biased, unavailable or used for a different purpose?
How will the firm detect changes in performance, data, provider behaviour or staff reliance?
What evidence would show that challenge and override occur in practice — including AI itself being used to test the decision?
What can be stopped or reversed, by whom, and how quickly?
What capability must the firm retain if the system or provider is no longer available?

International work points in the same direction. IOSCO’s 2026 supervisory toolkit examines effective human oversight, the competence and organisational position of the reviewer, third-party dependency and governance throughout the AI lifecycle.[13] The Financial Stability Board’s 2026 consultation proposes organisation-wide governance and lifecycle risk management for boards and senior management, applied proportionately to the institution and use.[14]

The FCA has chosen to rely primarily on its existing principles and outcomes-focused framework rather than create additional AI rules. Its own use of AI in supervision distinguishes between tools extracting facts and analysing material, and people applying expertise and judgement. That distinction is consistent with the GFSC’s principles-based approach. The Financial Reporting Council takes the same position in audit: firms and Responsible Individuals remain accountable for audit quality, and professional judgement remains with the human auditor.[15]^,[16]

The opportunity for Guernsey

Guernsey’s advantage is not that AI can be adopted without governance. It is that a principles-based regime allows governance to be designed around the actual use, nature, scale and complexity of the business rather than a fixed list of permitted technologies.

That flexibility requires firms to do the translation work. They must connect a new capability to existing legal and regulatory responsibilities, decide which risks are material and show why the controls are proportionate. A prescriptive rule can sometimes conceal weak judgement behind technical compliance. A principles-based approach makes the quality of the firm’s reasoning more visible.

The AI Sprint provides a useful setting in which to begin or accelerate that work. Its programme puts technical capability alongside governance, board effectiveness, financial crime, trusteeship and investment management. Those subjects belong together because AI will rarely remain within the technology function. It changes how information moves and how decisions are prepared across the firm.

The AI for AML hackathon in the week beginning 12 October is a useful example. Cross-industry teams will work on practical problems including source of wealth and source of funds, global identity, and complex questions of identity, ownership and control. The value lies as much in defining the problem properly as in producing a technical answer. Bringing client take-on and compliance experience together with people who understand the technology should help expose where data, judgement and regulatory requirements do not fit neatly together.

The 2024 Bank and FCA survey found that 75 per cent of participating financial-services firms were already using AI and a further 10 per cent planned to do so. Fifty-five per cent of reported use cases involved some automated decision-making, although only 2 per cent of those were described as fully autonomous. For most firms, the immediate question is less whether they will permit a machine to run the business than whether they understand the smaller ways in which systems already influence human decisions.[17]

A smaller jurisdiction can bring boards, regulated firms, professional advisers, technology specialists and the regulator into the same conversation. That is no guarantee of better governance, but it does make it possible to identify practical issues early, use the Commission’s Sandbox or other routes where a genuine regulatory obstacle exists, and develop a shared understanding of what good evidence looks like.

Regulatory perspective

From a regulatory perspective, the useful questions are unlikely to begin with the sophistication of the model. They are more likely to concern the purpose for which it is used, the decision it influences, the person responsible, the information available to that person and the evidence that the arrangements work.

A regulator will not expect every director or MLRO to be able to build the system. It is reasonable to expect them to understand the use sufficiently to perform their own role, recognise the limits of their knowledge and obtain properly scoped specialist advice where required. Those questions are worth putting to your own board before a regulator puts them to you.

Nor will it be enough to state that a human remained involved. The evidence should show what the person could see, what they understood, whether they could intervene and what they actually did. A well-designed workflow with an ineffective reviewer is not meaningful human oversight.

If a firm cannot explain why the system is used, how it affects the decision and who can challenge it, the problem is unlikely to be cured by adding another policy. It is a weakness in the decision-making arrangement itself.

Conclusion

AI can improve decision-making. It can find relevant material more quickly, compare more information than a person could review unaided, expose anomalies and reduce work that contributes little to the final judgement. Firms should examine those benefits seriously.

They should examine with equal care how the technology changes the decision process. Responsibility may be clear at the final approval and uncertain everywhere before it. Information may be more plentiful while the basis on which it was selected becomes less visible. A person may have an override button but lack the knowledge, evidence or time to use it properly.

The GFSC policy statement gives firms room to innovate within the existing framework. That is a constructive position. It also leaves the governing body and senior management responsible for deciding what good governance requires in their particular business.

The proper question is whether the firm has preserved the ability of the right person to exercise judgement over the decision for which that person remains responsible, and whether it can prove that the judgement was real. The technology may change. The need to answer that question does not.

Sources

About the author

Charisma Lyall is a director of ConsultGC, a Guernsey-based regulatory advisory practice for boards, directors and money laundering reporting officers. She was previously General Counsel of the Guernsey Financial Services Commission (2020–2023), Deputy General Counsel (2016–2020) and Legal Counsel (2011–2016), and Director of Regulatory Consulting at Grant Thornton Channel Islands (2023–2025). She chairs the Guernsey Investment & Funds Association’s Administrator and Compliance Sub-Committee and sits on the States of Guernsey’s Scrutiny Management Committee. She is an Advocate of the Royal Court of Guernsey and a Solicitor of the Senior Courts of England and Wales.

ConsultGC advises boards, regulated firms and senior management on financial-services regulation, governance, financial crime, regulatory risk and the practical application of regulatory requirements. Enquiries: consultgc.gg.

This article forms part of ConsultGC’s continuing consideration of how innovation affects governance, responsibility and regulatory decision-making in Guernsey.

[1]Guernsey AI Sprint, Programme, accessed 13 September 2026.

[2]ConsultGC, Beyond Private Equity, 1 September 2026.

[3]Guernsey Financial Services Commission, Policy Statement on the Use of Artificial Intelligence, 29 January 2026.

[4]GFSC Policy Statement on the Use of Artificial Intelligence. The statement identifies the NIST AI Risk Management Framework, ISO/IEC 42001 and the NCSC Guidelines as materials firms may find useful.

[5]Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services 2024, 21 November 2024.

[6]Information Commissioner’s Office, What are the accountability and governance implications of AI, accessed 13 September 2026.

[7]Guernsey Financial Services Commission, Finance Sector Code of Corporate Governance (effective 1 February 2026), Principles 1.3, 1.5, 4.7 and 5.

[8]US Securities and Exchange Commission, SEC Charges Rimar Capital Entities and Owner Itai Liptz for Defrauding Investors by Making False and Misleading Statements About Use of Artificial Intelligence, 10 October 2024.

[9]Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services 2024, findings on third-party implementations and provider concentration.

[10]Transluce, research report on unauthorised OpenAI agent activity, 24 September 2026; reported in Fortune, 24 and 25 September 2026.

[11] OpenAI, public confirmation that its models engaged with multiple US government websites more extensively than previously reported, 26 September 2026, reported in NPR and Oregon Public Broadcasting, 26 September 2026; TechCrunch and The Register, reports that OpenAI still did not have a complete picture of the activity, 28 September 2026.

[12]Maxine Waters, Ranking Member, US House Financial Services Committee, statement, 28 September 2026.

[13]IOSCO, Supervisory Toolkit for AI Use in Capital Markets, 2026.

[14]Financial Stability Board, Sound Practices for Responsible Adoption of Artificial Intelligence, Consultation Report, 10 June 2026.

[15]Financial Conduct Authority, AI and the FCA: our approach, updated 13 February 2026.

[16]Financial Reporting Council, Innovative new guidance supports audit firm adoption of emerging AI technologies, 30 March 2026.

[17]Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services 2024, survey adoption and automated decision-making findings.