AI - Jersey firms should consider going beyond the JFSC AI guidance – MAS Guidelines and EU/international standards raise the bar

AI - Jersey firms should consider going beyond the JFSC AI guidance – MAS Guidelines and EU/international standards raise the bar

This note looks at three related pieces of guidance that Jersey firms may wish to consider together:

• The Jersey Financial Services Commission’s Guidance on the use of AI in Jersey’s financial services sector (July 2026), which sets the local baseline.

  • It creates no new AI-specific regime and instead explains how existing legal and regulatory obligations apply when AI is used on a proportionate, risk-based basis.

• The Monetary Authority of Singapore’s Guidelines on Artificial Intelligence Risk Management for Financial Institutions (issued 7 October 2026),

  • Which provide a detailed, risk-proportionate set of supervisory expectations covering oversight, identification and inventory, risk materiality assessment, lifecycle controls and third-party accountability.

• Recent international and EU material, notably the Financial Stability Board’s Sound Practices for Responsible Adoption of Artificial Intelligence (final report, 15 October 2026), the European Supervisory Authorities’ joint statement on ICT risks from frontier AI models (31 July 2026), and the EU’s first official AI quality standard, EN 18286:2026 (recognised on 14 October 2026).

  • These supplies practical benchmarks on governance, lifecycle risk management, third-party dependencies, and quality management systems that align with peer regulators' direction.

Together,

• They show how a high-level local approach can be supported by more granular international practices that many Jersey firms (particularly those in groups or with cross-border clients) are already encountering or may adopt voluntarily.

Why go beyond the JFSC guidance?

• In July 2026, the Jersey Financial Services Commission published Guidance on the use of AI in Jersey’s financial services sector.

  • It is deliberately high-level and proportionate. It creates no new AI-specific regime.

  • Instead, it confirms that existing legal and regulatory obligations continue to apply when firms use AI, organised around five principles: governance and accountability; cybersecurity, privacy and data quality; regulatory compliance; consumer protection and fair treatment; and transparency and explainability.

  • Accountability stays with the firm; material uses should be reflected in the business risk assessment, and low-impact tools generally need only light controls.

• That approach is practical and flexible. For many Jersey firms, it is also the minimum. Going further is worth considering for several reasons.

  • First, many Jersey businesses sit inside groups with operations, clients or counterparties in Singapore, the EU, the UK or elsewhere.

    • Supervisors and counterparties in those jurisdictions increasingly expect evidence of AI inventory, materiality assessment, lifecycle controls and clear third-party accountability. A group framework that meets only the JFSC’s high-level principles may still leave gaps when tested against MAS, FSB or EU expectations.

  • Second, the JFSC guidance itself notes that it aligns with the OECD AI Principles and guidance from international peer regulators.

    • Adopting elements of those peer frameworks gives firms a concrete way to demonstrate that alignment and to produce the documentation and controls that supervisors (and sophisticated clients) are starting to look for.

  • Third, AI risks are evolving quickly, particularly with generative AI and agentic systems that can operate with greater autonomy and tool access.

    • High-level principles remain valid, but practical tools such as consistent identification of AI use, an inventory that captures embedded and third-party AI, a structured materiality assessment, and defined lifecycle controls make it easier to keep residual risk within appetite and to show that accountability has not been delegated to the technology or the vendor.

  • Fourth, third-party AI is already widespread.

    • Firms remain accountable for outcomes even when the system is supplied by a vendor. More detailed expectations for assurance, compensating controls, and exit options reduce the chance of residual risk remaining outside the firm’s appetite without being visible.

  • Finally, adopting these practices voluntarily now is lower-friction than having to retrofit them later if local expectations tighten, a group standard is imposed, or a significant client or regulator asks for evidence that goes beyond the JFSC baseline.

    • The goal is not to import a foreign rulebook wholesale, but to use the more granular international material as an implementation benchmark that strengthens compliance with the JFSC’s own five principles.

The JFSC baseline (July 2026)

• The JFSC guidance confirms that existing obligations apply on a proportionate, risk-based basis.

• Low-impact productivity tools generally need only light-touch controls unless they affect regulated activity, customer outcomes, confidential data or regulatory submissions. Higher-impact uses attract fuller expectations.

• Material AI use cases and controls should be included in the business risk assessment.

• The core message is that responsibility cannot be delegated to technology.

JFSC sources

• Guidance page: https://www.jerseyfsc.org/industry/guidance-and-policy/guidance-on-the-use-of-ai-in-jersey-s-financial-services-sector/

• PDF: https://www.jerseyfsc.org/media/koaltyhh/guidance-on-the-use-of-ai-in-jersey-s-financial-services-sector.pdf

• Industry update (14 July 2026): https://www.jerseyfsc.org/news-and-events/new-guidance-on-the-responsible-use-of-ai/

MAS/EU + Practical takeaways for Jersey firms

• The remainder of this note sets out the key features of the Monetary Authority of Singapore’s Guidelines on Artificial Intelligence Risk Management for Financial Institutions (issued 7 October 2026) and recent EU and international outputs, and explains how they map onto the JFSC guidance.

• Practical takeaways for Jersey firms

  • Treat the JFSC guidance as the local baseline.

  • Use the MAS Guidelines and FSB sound practices as optional implementation benchmarks, especially for identification, inventory, materiality assessment, lifecycle controls and third-party accountability.

  • For firms with EU exposure or higher-impact AI, consider EN 18286:2026 as a structured route to a documented quality management system that supports the presumption of conformity with key AI Act requirements once they apply.

  • Map AI use (including embedded and third-party AI) into the business risk assessment and existing risk, outsourcing, technology and data-protection frameworks.

  • For groups, ensure local senior management can demonstrate that any group framework meets Jersey expectations and that cross-border issues have clear escalation paths.

  • Review third-party contracts and assurance arrangements.

  • Keep the approach under review as AI capabilities evolve.

MAS Guidelines – a practical international benchmark

• The MAS Guidelines apply to all financial institutions and all forms of AI (including generative AI and AI agents). They are risk-proportionate and allow firms to tailor their approach to size, nature of business and risk materiality. Key expectations relevant to Jersey firms include:

  • Board and senior management oversight, with AI risks explicitly addressed in the risk appetite and clear roles and responsibilities (existing governance structures may be used; a dedicated AI committee is not mandatory).

  • Consistent identification of AI use (including AI embedded in material third-party services), an accurate inventory at an appropriate level of granularity, and a risk materiality assessment covering at least impact, complexity and reliance (both inherent and residual).

  • Proportionate lifecycle controls covering data governance, testing and evaluation, human oversight, fairness, transparency and explainability, technology and cybersecurity, monitoring, change management and incident handling.

  • Strong third-party accountability: the firm remains accountable for AI used in the services it delivers, even if developed, operated or provided by a third party. Sufficient assurance must be obtained; compensating controls applied where gaps exist; and use limited, suspended or replaced if residual risk cannot be brought within appetite.

  • Phased implementation: Sections 3–4 (oversight, identification, inventory and materiality) from 7 October 2027; Sections 5–6 (lifecycle controls and capability/capacity) by 7 October 2028. Basic policies may suffice for low-materiality uses.

• These map directly onto the JFSC principles.

  • The inventory and materiality assessment give practical effect to governance and accountability, and the requirement to include material uses in the business risk assessment.

  • Lifecycle controls and third-party rules strengthen expectations for cybersecurity, data quality, fair treatment, and transparency.

  • Local senior management remains accountable even when group frameworks are leveraged.

MAS sources

• Guidelines page: https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions

• PDF: https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf

• Media release (7 October 2026): https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions

• Consultation response (P017-2025): https://www.mas.gov.sg/-/media/mas-media-library/publications/consultations/bd/2025/response-to-feedback-received-on-guidelines-on-artificial-intelligence-risk-management.pdf

Recent EU and international developments - EU’s first official AI quality standard – EN 18286:2026

• On 14 October 2026, the EU officially recognised its first harmonised standard for the quality management of high-risk artificial intelligence systems: EN 18286:2026 (Artificial intelligence – Quality management system for EU AI Act regulatory purposes).

  • Under Article 40 of the AI Act, high-risk AI systems that conform to a harmonised standard whose reference has been published in the Official Journal benefit from a presumption of conformity with the requirements covered by that standard. For EN 18286:2026, this covers the quality management system requirements in Article 17(1), points (a) to (m). These include strategy for regulatory compliance and management of modifications; design, development, testing and validation; data management; the risk management system (Article 9); post-market monitoring (Article 72); serious incident reporting (Article 73); and record-keeping, resource management and accountability frameworks.

  • Application of the standard is voluntary. Organisations that do not use it must still demonstrate compliance directly with the AI Act. Using it, however, provides a structured, auditable route and legal certainty within the scope of the citation.

• CEN and CENELEC published the standard in July 2026 (date of availability 22 July 2026);

  • The Commission’s formal assessment confirming it meets the objectives of the AI Act is set out in Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 (published in the Official Journal on 14 October 2026).

• The relevant high-risk obligations (including Article 17) were postponed by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

  • They now apply from 2 December 2027 for high-risk AI systems under Annex III and from 2 August 2028 for high-risk AI systems under Annex I. EN 18286:2026 is the first of a suite of European standards expected under the Commission’s standardisation requests; further standards on risk management, data governance, transparency, human oversight and other topics are still in development.

  • The standard includes annexes that map its clauses to ISO/IEC 42001 and ISO 9001. Work already done on ISO/IEC 42001 is therefore useful and can be reused, but ISO/IEC 42001 alone does not confer a presumption of conformity under Article 40 of the AI Act.

Key sources

• Commission Implementing Decision (EU) 2026/2274 of 12 October 2026: https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj

• CEN project page for EN 18286:2026: https://standards.cencenelec.eu/ords/f?p=205:110:::::FSP_PROJECT,FSP_LANG_ID:80556,25&cs=175392A97352F2C5B1211EEC4FA215C15

• CEN-CENELEC announcement (July 2026): https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/

• AI Act consolidated version: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727

• Regulation (EU) 2026/1744 (Digital Omnibus on AI): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744

• Financial Stability Board – Sound Practices for Responsible Adoption of Artificial Intelligence (final report, 15 October 2026).

• Twelve sound practices covering organisation-wide AI governance and lifecycle risk management (including materiality assessment, data governance, explainability, human oversight, cyber/ICT risks and third-party AI dependencies). They are designed to be tailored and integrated into existing frameworks.

• Press release: https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/

• Final report: https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/

• European Supervisory Authorities (EBA, EIOPA, ESMA) joint statement (31 July 2026) on ICT risks from frontier AI models.

  • Calls for a cross-sectoral, risk-based supervisory approach and emphasises robust governance, risk management, and the prevention, detection and management of cyber risks linked to highly capable AI models, situated within existing frameworks including DORA.

  • EBA press release: https://www.eba.europa.eu/publications-and-media/press-releases/eba-eiopa-and-esma-call-enhanced-governance-and-consistent-supervision-mitigate-ict-risks-frontier

  • EU AI Act and DORA context. High-risk AI obligations under Annex III have been deferred in places by the 2026 AI Omnibus amendments (as noted above in connection with EN 18286:2026). DORA already treats AI systems as ICT assets subject to operational resilience, inventory, lifecycle and third-party risk requirements. Existing EBA internal governance, model risk and third-party expectations continue to apply. The practical effect is layered expectations around accountability, documentation, human oversight and third-party control.

Jersey firms

• For Jersey firms that develop, supply or use higher-impact AI (particularly those with EU exposure or group entities in the EU), early engagement with EN 18286:2026 offers a practical way to structure a documented quality management system that supports both the AI Act and the broader accountability, documentation and lifecycle expectations reflected in the JFSC guidance, the MAS Guidelines and the FSB sound practices.

Practical takeaways for Jersey firms

• Treat the JFSC guidance as the local baseline.

• Use the MAS Guidelines and FSB sound practices as optional implementation benchmarks, especially for identification, inventory, materiality assessment, lifecycle controls and third-party accountability.

• For firms with EU exposure or higher-impact AI, consider EN 18286:2026 as a structured route to a documented quality management system that supports the presumption of conformity with key AI Act requirements once they apply.

• Map AI use (including embedded and third-party AI) into the business risk assessment and existing risk, outsourcing, technology and data-protection frameworks.

• For groups, ensure local senior management can demonstrate that any group framework meets Jersey expectations and that cross-border issues have clear escalation paths.

• Review third-party contracts and assurance arrangements.

• Keep the approach under review as AI capabilities evolve.

CONCLUSION

• Jersey firms that adopt these elements will be better placed both to meet the JFSC’s expectations in a demonstrable way and to operate confidently in multi-jurisdictional groups or with sophisticated counterparties.

Primary sources

• JFSC: https://www.jerseyfsc.org/media/koaltyhh/guidance-on-the-use-of-ai-in-jersey-s-financial-services-sector.pdf

• MAS Guidelines: https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf

• FSB final report: https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/

• EN 18286:2026 (Commission Implementing Decision): https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj

• ESA joint statement: https://www.eba.europa.eu/publications-and-media/press-releases/eba-eiopa-and-esma-call-enhanced-governance-and-consistent-supervision-mitigate-ict-risks-frontier

This note is based on the published documents as of October 2026. Firms should consult the originals and obtain advice specific to their circumstances.