Firms in Guernsey and Jersey are being sold AI from several directions at once: UK vendors with island landing pages, local IT providers adding AI to their managed service lists, digital agencies adding it to web and app work, and a few specialist builders. Meanwhile four regulators have published something on the subject, and what they have said is more modest and more useful than the sales copy suggests. Nobody had put the two halves side by side, so this review does. It is built only from pages the regulators and the providers have published, each listed at the end. It contains no survey and no adoption figures, because we found no public data on island adoption worth repeating, and that absence is itself a finding.
The regulatory position
The Guernsey Financial Services Commission published a Policy Statement on the Use of Artificial Intelligence on 29 January 2026. It says the Commission "supports innovation and recognises the role Artificial Intelligence ("AI"), in all forms, could play" in financial services, names machine learning, large language models, agentic and generative AI, and then states plainly that "The Commission is not proposing specific rules or guidance in relation to the use of AI." Firms are pointed instead at the Finance Sector Code of Corporate Governance, the Minimum Criteria for Licensing, and external frameworks such as the NIST AI Risk Management Framework, ISO/IEC 42001 and NCSC guidance. The statement followed an industry session for regulated firms on 1 December 2025, "Artificial Intelligence in Finance: Innovation, Oversight and Opportunity".
On outsourcing, the GFSC position predates AI and applies to it directly. Its November 2021 Guidance Note on outsourcing by entities licensed under the Protection of Investors Law states that "responsibility cannot be outsourced and that the Licensee at all times remains responsible and accountable to the Commission". Licensees should tell the Commission about outsourcing proposals early, though no formal approval is given, and Principle 6 reserves the Commission's and the licensee's access to books and records.
The Jersey Financial Services Commission published Guidance on the use of AI in Jersey's financial services sector in July 2026. The JFSC's own website blocks automated access, so we relied on two published summaries by Jersey firms, dated 16 and 17 July 2026. Both say the guidance introduces no AI-specific regime and instead expects firms to apply existing obligations in a proportionate, risk-based way. It sets out five principles: governance and accountability; cybersecurity, privacy and data quality; regulatory compliance; consumer protection and fair treatment; and transparency and explainability. A materiality ladder gives low-impact productivity tools light oversight unless they touch regulated activity, customer outcomes, confidential information or regulatory filings, and asks for fuller governance around uses such as onboarding or lending decisions. One line is worth keeping: "responsibility cannot be delegated to technology. Boards and senior management remain ultimately accountable for decisions made with the assistance of AI." Firms are told to review their arrangements with third-party AI providers, contractual protections on data use, record-keeping and escalation, under the JFSC's revised Outsourcing Policy in force since 1 January 2024.
The two data protection authorities have both published AI guidance for organisations, and neither page carries a publication date. Guernsey's Office of the Data Protection Authority applies the Data Protection (Bailiwick of Guernsey) Law, 2017 through a ten-step practical guide that runs from checking whether personal data is involved at all, through a data protection impact assessment, handling training data responsibly and respecting individuals' rights, to keeping records and maintaining ongoing oversight. It notes that individuals can ask for automated decisions and profiling to be reviewed by a human. Jersey's Office of the Information Commissioner publishes "What to think about before using Artificial Intelligence" under the Data Protection (Jersey) Law 2018: a DPIA where AI carries significant risk, a lawful condition under Schedule 2 before processing starts, a written processing agreement under Article 19 where a provider acts as processor, compliance with Articles 66 and 67 for transfers out of Jersey, and "meaningful human involvement" in automated decisions, because "People have a right to know when AI is being used to process information about them." On 28 January 2026 the JOIC also named AI as one of its three strategic priorities for 2026 to 2028, with a specific focus on AI in human resources.
So the position is easy to state. Neither financial regulator has written AI rules, and both have said they do not intend to. Both say accountability stays with the firm, outsourcing rules apply to AI providers, and records must exist. Both data protection authorities expect a DPIA, a lawful basis, a processor contract and a route to human review. Anyone telling an island firm that a regulator has approved or banned a particular AI product is describing something that has not been published.
Who is providing AI services on the islands
Managed IT providers are adding AI to an existing service list. Clarity, at seekclarity.com, describes itself as a "Strategic Technology Partner in Jersey & Guernsey" and lists "AI Solutions", "Data Analytics and Dashboards", "Robotic Process Automation" and "Knowledge Work Automation / AI" alongside 24/7 managed IT support, Microsoft 365 and Azure enablement and a cyber security practice. Its site cites ISO 27001 and Cyber Essentials Plus certification and Microsoft Tier 1 partner status.
Digital agencies are adding AI to web and systems work. DEXM, at dexm.co, calls itself "a dedicated development agency", gives a Smith Street, Guernsey address, was founded in 2024 and serves "clients across Guernsey, Jersey, and the UK". It groups websites and apps, bespoke systems and process automation, and an AI strand described as "AI Agents & Intelligent Workflows" and "AI-Enabled Systems & Automation", with hosting alongside; its insights caution against using AI to "rebuild the business you already have". Harbour Studios, at harbourstudios.com, is a "full-service creative studio" with studios in Guernsey and Hong Kong, listing web design, apps, brand identity, digital marketing, report design, hosting and video, with "AI Consultancy" added as a service line.
UK consultancies publish island landing pages. Bell Integration, at bell-integration.com, has pages titled for Guernsey and for Jersey offering AI consulting, training, implementation, managed AI, "AIaaS" and custom LLM development, naming Kore AI, Amelia and Starburst as partners. Its Guernsey AI-as-a-service page describes "managed environments that are designed, deployed, and operated by experienced AI, managed service providers" and notes that "Data residency requirements, privacy regulations, and industry specific standards vary across regions". The pages list locations "throughout the UK, EU, Asia, Middle East and North America"; they give no Guernsey or Jersey office address and do not say where data is hosted. Search results also surface UK marketing agencies with Guernsey-titled pages whose content, at the time of writing, did not mention the islands.
Specialist builders are a smaller group, and we are one of them, so read this as description rather than verdict. Islands AI, at islandsai.com, is a Guernsey company at 2 Market Street, St Peter Port. Its site says it builds AI systems with governance and auditability designed in from the start, operates two products in production, Kalvo for voice and Flarion for compliance work, and puts the standard as "If we cannot show your regulator how a system behaves, it does not ship."
Where the gaps sit
Put the regulators' expectations next to the providers' pages and the gaps show up as questions. A buyer should put them to any provider, including us, before anything touches client data.
Where will our data be processed and stored, and can you put that in writing? Both data protection laws treat transfers off-island as a specific step with conditions, and the JFSC's outsourcing policy expects the arrangement to be notified. Several provider pages say nothing about hosting location. Silence is not an answer.
What record does the system keep, and can we reconstruct a decision afterwards? The JFSC principles ask for explainability commensurate with risk; the ODPA's ninth step is to "keep records and be ready to explain"; the GFSC's outsourcing note reserves access to books and records. Ask to see the audit trail on a real workflow, not a slide.
Who operates the system after handover? A page that promises design and deployment describes a project. The regulators describe an ongoing obligation, with monitoring and review through the life of the system. Ask who answers the phone in month nine, and whether that is in the contract.
Who holds liability when it is wrong? Both financial regulators have said responsibility stays with the firm, so the honest answer from any provider is "you do, and here is what we do to make that survivable": review points, contractual protections and an escalation route.
What we expect over the next twelve months
This section is our view, not a finding. We expect both financial regulators to hold the line they have drawn: no AI rulebook, and closer attention to whether existing rules on governance, outsourcing and records are being applied to AI. We expect the first difficult supervisory conversations to be about records, because that is where a firm using a consumer AI tool has nothing to show, and we expect the JOIC's focus on AI in human resources to produce the first guidance with teeth. On the supply side we expect more UK landing pages, not fewer, and island buyers getting sharper at telling a page from a presence. We will update this review in twelve months, and we would be glad to be corrected on any of it.
Sources
GFSC, Policy Statement, Use of Artificial Intelligence, 29 January 2026: https://www.gfsc.gg/news/policy-statement-use-artificial-intelligence
GFSC, Industry session, Artificial Intelligence in Finance, 1 December 2025: https://engagementhub.gfsc.gg/events/4
GFSC, Guidance Note on the Outsourcing of Functions (Protection of Investors Law), November 2021: https://www.gfsc.gg/sites/default/files/2021-10/Guidance%20Note%20on%20the%20Outsourcing%20of%20Functions%20by%20Entities%20Licensed%20Under%20The%20Protection%20of%20Investors%20(Bailiwick%20of%20Guernsey)%20Law,%202020.pdf
JFSC, Guidance on the use of AI in Jersey's financial services sector (site blocks automated access): https://www.jerseyfsc.org/industry/guidance-and-policy/guidance-on-the-use-of-ai-in-jersey-s-financial-services-sector/
Comsure, JFSC publishes new AI guidance, 16 July 2026: https://www.comsuregroup.com/news/jfsc-publishes-new-ai-guidance-that-includes-5-principles-materiality-ladder/
Mourant, JFSC publishes AI guidance for Jersey's financial services sector, 17 July 2026: https://www.mourant.com/updates/jfsc-ai-jersey/
Comsure, Guidance on the JFSC 1 January 2024 revised outsourcing policy, 4 December 2023: https://www.comsuregroup.com/news/guidance-on-the-jfsc-1-jan-2024-revised-outsourcing-policy/
ODPA, Artificial intelligence guidance: https://www.odpa.gg/guidance/artificial-intelligence
ODPA, Ten-step practical AI guidance: https://www.odpa.gg/guidance/ten-step-ai-guidance
JOIC, What to think about before using Artificial Intelligence: https://jerseyoic.org/guidance/data-protection/artificial-intelligence/what-to-think-about-before-using-artificial-intelligence
JOIC, strategic priorities article, 28 January 2026: https://jerseyoic.org/news/the-ink-dried-on-data-protection-law-years-ago-if-you-re-not-compliant-you-re-leaving-yourself-open-to-enforcement-action
Clarity: https://seekclarity.com/
DEXM: https://dexm.co/
Harbour Studios: https://harbourstudios.com/
Bell Integration, Guernsey AI companies page: https://www.bell-integration.com/artificial-intelligence-companies-in-guernsey/
Bell Integration, AI as a Service in Guernsey: https://www.bell-integration.com/ai-as-a-service-in-guernsey/
Islands AI, About: https://islandsai.com/about
All pages were retrieved on 26 September 2026.
Frequently asked questions
Has the GFSC or JFSC issued rules on AI?
No. The GFSC policy statement of 29 January 2026 says it is not proposing specific rules or guidance on AI, and the JFSC guidance of July 2026 introduces no AI-specific regime. Both expect existing obligations on governance, outsourcing and records to be applied to AI in a proportionate way.
Do the data protection authorities expect a DPIA before using AI?
Both say a DPIA is expected where AI carries significant risk to individuals, such as automated decisions or profiling. The ODPA lists it as step three of its ten-step guide; the JOIC guidance calls it mandatory where AI makes decisions about individuals or processes sensitive information.
Is this review based on a survey?
No. It is built entirely from pages published by the regulators and the providers, all listed under Sources. We found no public data on AI adoption across the islands that we were prepared to repeat.