Survey

AI Readiness Survey: how regulated firms in the Isle of Man, Jersey and Guernsey score

Regulated firms across the Crown Dependencies are being asked what they are doing about AI - by boards, by clients and soon by regulators. This survey scores your firm against the practical expectations. Ten minutes, twelve questions, and a score you can take into a board meeting.

By Zakir Hoosen, Director, Fuzzelogic Solutions. Board-level guidance in plain English.

Every regulated firm in the Isle of Man, Jersey and Guernsey has a question coming that most boards cannot yet answer: what are you doing about AI, and how are you governing it?

The question is coming from three directions at once. Clients and Group boards are asking it in procurement and due diligence. Compliance officers are asking it because they can see AI arriving in the tools their staff already use. And the regulators are catching up with the practice: the JFSC published AI governance guidance in July 2026, and MONEYVAL conduct an on-site evaluation of the Isle of Man in October 2026.

This survey gives you the answer in a form you can use. Answer twelve questions honestly and you will know where your firm stands, what a regulator would find today, and what to fix first.

How the survey works

Score each question from zero to four:

• 0 - We do not know the answer to this question.
• 1 - We know the answer, but nothing is documented.
• 2 - It is documented, but not consistently followed.
• 3 - It is documented, followed, and evidenced.
• 4 - It is controlled, measured, and reviewed by the board.

Total you out of 48. Be honest - the score is for your firm, not for us.

Part 1: Data (questions 1-3)

Data is the foundation of AI. A regulator or a client will ask where your AI gets its facts. These three questions test whether you can answer.

1. Where does each source of data that matters to your firm sit, and can it be found when a system needs it?
2. Is that data known to be accurate, current and complete - and do you have evidence it is?
3. Can you show where a given output or decision got its facts from, if you are asked?

Most regulated firms score lowest here. Data is spread across legacy systems, spreadsheets and inboxes, and nobody has ever needed to prove its lineage before. AI changes that: an AI system will quietly blend the spreadsheet, the inbox and the legacy system and present the result as fact.

Part 2: Governance and accountability (questions 4-6)

If you only have time for three questions, do these three. Accountability is the question every Crown Dependency regulator asks first.

1. Is a named person accountable for each AI system or AI-supported decision, with authority to stop it?
2. Can someone explain, in plain English, why a particular AI system recommended or decided what it did?
3. Do you know what AI tools already exist inside your firm - including the ones staff installed without telling anyone?

Question six is the one that surprises most boards. You do not know how much AI you already have, because nobody asked. Your staff are using the free tools that ship inside their existing software. Some of it is harmless. Some of it is uploading client data to a public model with no contractual basis. A regulator would want to know which.

Part 3: Change and people (questions 7-9)

AI projects fail most often on the parts that have nothing to do with algorithms.

1. Has the board seen a cost-benefit analysis in numbers the finance director would accept?
2. Is there a plan for how the process and roles will change - not just which technology to buy?
3. Have you mapped which jobs, tasks and outsourcing arrangements will change, and how staff are being prepared?

The regulation matters, but the economics matter first. Plenty of AI in the Crown Dependencies is being adopted underneath the board, in single departments, where the benefit is real but nobody has checked whether it is duplicated, whether the risk is owned, or whether the same outcome was already delivered by the firm's outsourced provider.

Part 4: Regulation and third parties (questions 10-12)

This is the part that makes a Crown Dependency firm a Crown Dependency firm. You are regulated on your own island and exposed everywhere else.

1. Have you mapped which regulators and regimes apply to each AI system - JFSC, GFSC, Jersey FSC, and where relevant the EU AI Act?
2. Do you know what your third-party suppliers, outsourcing partners and software vendors are doing with AI on your data?
3. Is there an audit trail that records how each significant decision was made, evidence it was based on, and who approved it?

Question ten is where the three islands differ. A firm serving clients into the UK and EU has obligations beyond its home regulator. An Isle of Man firm subject to MONEYVAL's October 2026 on-site evaluation will be asked about AI governance in a way that the current assessment methodology now includes. The questions are coming; the only choice is whether you have answers.

What your score means

1. 40-48: You are ahead of most firms in the region. Pick a single high-value use case, govern it properly, and move.
2. 29-39: You are partly ready. The gaps are usually governance, data lineage, or third-party risk. Fix those before building anything.
3. 16-28: You are not ready. A regulator would find gaps today. Preparation is weeks of work, not months - but it should start this quarter.
4. 0-15: You have significant exposure. Data, governance and accountability are not in place. Start with the questions you scored zero.

Most firms in the Crown Dependencies score between 18 and 30. That is not a comfortable place to be, because it is exactly the range where the technology exists in pockets but the accountability does not. And accountability is what regulators and clients inspect first.

The honest limitation of self-scoring

There is a structural problem with self-scoring: the firm is too close to its own systems to see the gaps. The answer to "is the data accurate?" is given by the people who entered the data. The answer to "is AI already in use?" is given by the people who installed it. Self-scoring understates exposure, usually significantly.

For that reason, the survey has two levels. The first level is this page - free, ten minutes, and genuinely useful for prioritisation. The second level is an independent assessment, which is what we do. Two to four weeks, fixed price, and you own the verdict and the roadmap whether or not we ever build any of it.

How to act on your score

Score the survey, agree the evidence gaps with the compliance officer, and bring the number to the board. Then decide whether you want the independent view.

If you do, start with the assessment. Two to four weeks, fixed price, and you own the verdict and the roadmap whether or not we build any of it. Fuzzelogic builds on local and private models, so nothing you show us needs to leave the island.