IoM Guide

Isle of Man AI compliance: JFSC and GFSC guidance

The JFSC has issued AI governance guidance. The GFSC is moving the same way. Isle of Man boards that ignore this are exposing themselves to regulatory action.

By Zakir Hoosen, Director, Fuzzelogic Solutions. Board-level guidance in plain English.

The JFSC issued AI governance guidance in July 2026. The GFSC is moving in the same direction. If you sit on the board of an Isle of Man financial services firm, this is not optional reading. It is the baseline for every AI decision your business makes from now on.

This guide covers what the regulators expect, what the board must do, and where the most common compliance mistakes happen.

What the JFSC guidance says

The JFSC guidance is not a rulebook with a checklist. It is a set of expectations that the regulator will use to judge your business. The principle is simple. The board is accountable. Not the IT team. Not the vendor. Not the data scientist. The board.

The guidance requires explainability. A regulated firm must be able to explain to a customer, and to the JFSC, why an AI system made a particular decision. That does not mean the board needs to understand the mathematics. It means the board needs to ensure someone in the business can explain it in plain English, and that the explanation is documented.

It requires human oversight. An AI system can recommend. It should not be the final authority on decisions that affect customers without a human who understands the output and can override it. That human needs training, time, and authority.

It requires governance. The board must know what AI systems exist in the business, what data they use, who maintains them, and what the failure modes are. If the board cannot produce that inventory today, it is not ready for the guidance.

In regulated financial services on the Island, the number with no governance should be zero. It is not. The JFSC knows that. The guidance is the first step in changing it.

What the GFSC expects

The GFSC has not issued AI-specific guidance in the same detail as the JFSC. But the direction is clear. The GFSC expects firms to manage operational risk. AI is operational risk. The board must understand the systems that make material decisions, and it must ensure those systems are controlled.

For Isle of Man firms that operate under both regimes, or that have cross-border exposure, the compliance burden doubles. The strategy must account for the most demanding regulator, not the most convenient one.

The EU AI Act is also relevant. Isle of Man firms with EU clients or EU operations face additional requirements. The Act requires transparency, documentation, and human oversight for high-risk AI systems. That applies to financial services.

Rushing AI without reading the regulatory landscape is the most expensive compliance mistake an Isle of Man firm can make.

The compliance checklist for the board

Three things the board must have before any AI system goes live in a regulated firm.

First, the inventory. A document that lists every AI system in the business, what it does, what data it uses, who maintains it, and what decisions it influences. If the business does not have this, it cannot comply.

Second, the explanation. For each system, a plain English explanation of how it works, what it decides, and how a customer can query a decision. Not a technical document. A document the board, the customer, and the regulator would accept.

Third, the oversight. A named person, not a committee, who is responsible for each system. That person must have the authority to stop the system, the training to understand its output, and the time to monitor it.

1. Step one: Map every AI system in the business. Yes, every one.
2. Step two: Classify each system by customer impact. High, medium, low.
3. Step three: Document the governance for each high and medium impact system.
4. Step four: Appoint an owner for each system. Name the person.
5. Step five: Brief the board. Make sure every director understands what exists.
6. Step six: Review quarterly. The landscape changes. Your inventory must keep up.

Where compliance goes wrong

The pattern Fuzzelogic sees most often is the shadow system. A team builds or buys an AI tool, it works well enough, and it becomes part of the daily process without anyone in governance knowing it exists. It sits under the radar. It works. Until it does not, and then the board finds out about it for the first time.

The second pattern is the vendor dependency. A firm buys a system from a vendor, the vendor handles the AI, and the firm cannot explain how it works. The board approves it because the vendor says it is compliant. But the JFSC does not hold the vendor accountable. It holds the board accountable.

The third pattern is the documentation gap. The system exists, the board knows about it, but there is no documentation that explains how it works, what data it uses, or who oversees it. When the regulator asks, the business scrambles to create documents after the fact. That is not governance. It is reaction.

Compliance is part of the seventy percent. It is process change. It requires the business to change how it documents, how it governs, and how it reports. That takes executive commitment.

The honest assessment

Here is what most consultants will not tell you. Some AI systems in regulated firms cannot be made compliant without significant rework. A model that cannot explain its decisions is not compliant, no matter how accurate it is. A system that no one inside the firm understands is not compliant, no matter how well it performs.

If the honest answer is that a system needs to be rebuilt, replaced, or stopped, Fuzzelogic puts it in writing. We do not build systems that will not pass regulatory scrutiny. We tell you which ones can get there and which ones cannot.

For Isle of Man firms, the advantage is speed. The Island's regulatory framework is clear, the guidance is available, and the JFSC is accessible. Firms that act now, with proper governance, will be ahead of the curve. Firms that wait will be reacting to enforcement, not preparing for it.

Start with the assessment. Two to four weeks, fixed price, and you own the verdict and the roadmap whether or not we build any of it. When you are ready to talk AI, call Fuzzelogic Solutions and ask for Zak. www.FuzzelogicSolutions.com | info@FuzzelogicSolutions.com | +44 (0)1624 618950