BERMUDA Law and Practice Contributed by: Ian Stone and Leo Shaw, Wakefield Quin Limited
8.4 Key Disclosure Requirements for AI Use There are no AI-specific disclosure requirements under Bermuda law. The Companies Act does not require companies to disclose their use of AI, AI strategy, AI governance arrangements or AI-related risks in their annual reports or other filings. For companies listed on overseas exchanges, applicable securities regula - tion may require disclosure of material risks, which could include AI-related risks where they are material to the company’s business, operations or financial condition. Under PIPA, organisations are required to be transpar - ent about their use of personal information, which may extend to the use of AI systems that process personal information. However, this is a data protection disclo - sure obligation rather than a corporate governance or financial reporting requirement. As per the AI Discussion Paper, Bermuda may in due course consider AI-specific disclosure requirements.
committee or a dedicated technology or innovation committee. For regulated entities, the BMA would expect AI-related risks to be addressed within the entity’s risk management framework and to be subject to appropriate board-level oversight. 8.3 Liability Exposures Arising From AI Use The principal liability exposures for boards and officers arising from AI use in Bermuda include the following. • Data protection: breaches of PIPA arising from AI systems that process personal information improp - erly. The Privacy Commissioner has enforcement powers under PIPA against the organisation. Crimi - nal offences may be pursued through the courts. • Breach of fiduciary duty: where directors fail to exercise adequate oversight of AI deployment, resulting in loss to the company. Enforcement is by the company or by shareholders via derivative action (see 3.8 Breach of Directors’ Duties and 4.4 Shareholder Claims ). • Regulatory enforcement: for regulated entities, the BMA may take enforcement action where AI- related failures amount to breaches of regulatory requirements – eg, an industry code of conduct. • Contractual liability: where AI systems produce erroneous outputs that result in breaches of con - tractual obligations. • Reputational risk: directors’ duty of care encom - passes the obligation to manage material risks, including reputational risks from AI use. There is no AI-specific liability regime in Bermuda. Liability arising from AI use would be assessed under existing common law, statute and regulatory frame - works.
58 CHAMBERS.COM
Powered by FlippingBook