Modernisation pressure

For Isle of Man TCSPs, Rulebook 8.16 (r8.16) becomes even more important in an AI environment.

Boards are rightly pushing modernisation. As a result, many firms aim to onboard faster, improve monitoring and screening, and align workflows to produce better management information.

Outsourcing triggers R8.16

In practice, modernisation often introduces new vendors, outsourced capabilities, or AI-enabled systems. That’s exactly when r8.16 moves from a tick-box requirement to day-to-day governance.

If you outsource a material management or business function, or make a material change to that arrangement, you need the Authority’s written consent first. In addition, you must notify the Authority at least 20 business days before the delegation or outsourcing goes live. Either way, outsourcing does not remove responsibility.

Accountability stays with you

The key point is simple: new technology does not reduce accountability. Instead, it increases the need for clear ownership, strong oversight, and the ability to challenge outcomes with evidence.

Under the Code, companies must complete a Technology Risk Assessment before they launch or implement new or developing technology. Keep that assessment updated, record it properly, and link it into the wider Business Risk Assessment.

Boards want speed

This creates real pressure for compliance teams. Boards may see AI as a speed-and-scale solution. Compliance teams, however, still need answers:
• What data does the tool use?
• Which outputs do we rely on?
• What happens when the system gets it wrong?
• Can we explain the outcome?
• Can we challenge the outcome?
• Do we have human oversight?
• Does the tool weaken sanctions or adverse media reviews?
• Do we still understand source of funds and wealth properly?
• Can we retrieve audit trails?

AI adds another layer

An AI-enabled onboarding or monitoring system may improve control. However, without proper assessment, it can also introduce hidden risks. Common examples include weak escalation paths, poor data quality, unclear decision routes, and over-reliance on vendor logic.

Start with the risks

Good practice is clear: start with the risks, not the product.
• Complete the technology risk assessment before implementation, not after go-live
• Treat AI deployment as a governance, compliance, and operational change, not just an IT project
• Document who owns decisions, who challenges outputs, and how humans stay in the loop

Where decisions involve outsourcing, check Rulebook 8.16 early, not at the end of the assessment.

AI supports judgement, it does not replace it

Compliance teams have heard the message for some time now: adoption pressure must not outpace the firm’s ability to understand, govern, and evidence AI use.

In a TCSP, AI works best as support to enhance judgement within a documented risk framework, with proper oversight and a completed assessment before the live date.

AI can support the process.
It cannot own the risk.

For more insights like this, follow Acclaim.