The AI You Didn't Buy Is Still Your Problem

Outsourced AI is not a procurement decision — it is a material dependency your existing outsourcing obligations already cover, whether you have noticed or not.

Your fund administrator just switched on an AI feature. Your screening provider retrained a model. Nobody told you, and nobody had to. In a jurisdiction built on outsourced operations, the AI most likely to cause you a problem is the AI you never chose.

Jersey financial services runs on outsourcing. Fund administration, transfer agency, screening, custody, document management — much of the operational spine of the island's firms sits inside somebody else's platform. That model has worked for decades. It now carries a new risk that most firms have not priced: those platforms are quietly becoming AI platforms, and the firm that outsourced the function still owns the outcome.

The JFSC's July 2026 guidance closes the escape route firms might have hoped for. It states plainly that the existing Outsourcing Policy applies to AI — there is no separate, lighter regime for intelligence that arrives inside a supplier's product. This piece is about what that sentence actually demands.

There is a comfortable assumption in outsourcing that risk transfers with the activity — that if the vendor runs the tool, the vendor carries the exposure. For AI in a regulated Jersey firm, that assumption is simply wrong, and the guidance removes any doubt about it. The regulatory relationship is with the firm, the customer relationship is with the firm, and the accountability for an AI-influenced outcome stays with the firm no matter whose model produced it.

Outsourcing the function never outsourced the accountability

The principle Jersey firms already live by for outsourced operations applies without modification to outsourced AI: you can delegate the activity, but you cannot delegate the responsibility for its outcome. The guidance is unambiguous that firms remain accountable for AI outcomes exactly as they are for any other technology, and that accountability does not thin out because the model belongs to a vendor.

Outsourced AI is not a lighter version of the AI you build. It is a heavier one — because you have less visibility, less control over change, and often no contractual right to know when the model behind your control has been altered. The convenience of not building it is paid for in oversight you now have to construct deliberately.

The dependency that fails when you are not looking

The JFSC guidance includes a scenario worth every Jersey operations lead’s attention: a third-party AI onboarding tool goes down, the red flags it used to surface stop appearing, and onboarding continues anyway. The result is a weakened AML control and a resilience gap — caused entirely by a system the firm does not own and may not monitor.

This is the defining feature of outsourced-AI risk. The failure is invisible from inside your own building. Your staff see a working screen; they do not see that the intelligence behind it has degraded, gone offline, or changed its behaviour after a silent vendor update. The guidance's remedy is to treat such tools as critical dependencies with manual fallback — and to pause or limit the activity when the tool is unavailable, rather than letting the process run on with a control quietly switched off.

Five questions your existing due diligence probably doesn't ask

Jersey firms already run supplier due diligence. The gap is that standard operational due diligence was not written for a supplier whose product thinks. The guidance points to supplier due diligence, contractual oversight, visibility of sub-contractors, and fallback and exit plans — applied to AI specifically. Table 1 turns those clauses into questions a firm can put to a vendor before the next renewal.

Table 1 — Outsourced-AI due diligence: five questions to add to supplier reviews before the next contract renewal.

The second question is the one most contracts fail. A vendor can change the model behind your AML control overnight, and unless the contract obliges them to tell you, your first sign of a material change may be the incident it causes. In my experience, the right to be notified of model change is the single most valuable clause a firm can add to an AI-enabled outsourcing agreement — and the one most likely to be missing today.

Classify the dependency, not just the vendor

The JFSC's materiality approach classifies use cases by impact, not suppliers by size. A large, reputable vendor providing AI into a material control is a higher-impact dependency than a small vendor providing AI into a cosmetic one — and the firm's oversight should follow the impact, not the logo.

The factors the guidance names for classification apply directly: customer impact, financial crime impact, autonomy, reversibility, and third-party reliance. An outsourced AML screening model scores high on almost all of them and belongs in the material tier, with senior approval, independent validation, explicit fallback, and enhanced third-party controls. A supplier's AI that merely reformats a report does not. The firm that grades every vendor the same way is over-governing the trivial and under-governing what matters.

Contracting for a supplier whose product thinks

Most outsourcing contracts in Jersey were negotiated before the supplier's product could learn. They specify service levels, uptime, and data handling — the things that mattered when software behaved the same way on Tuesday as it did on Monday. An AI-enabled product does not offer that guarantee, and a contract that assumes it is silently out of date.

The guidance's outsourcing expectations — material dependency assessment, supplier due diligence, contractual oversight, visibility of sub-contractors, and fallback and exit plans — read as a contracting checklist once a firm accepts that the product is no longer static. The clause I press hardest for is the right to be notified before a material model change, because it is the only clause that converts an invisible risk into a managed one. Without it, the firm has outsourced not just the function but its own ability to know when the function changed. In my experience, vendors resist this clause precisely because it is the one that matters — which is the clearest possible signal that it belongs in the contract.

The island advantage cuts both ways

Jersey's compact scale is genuinely an advantage here. The same handful of major administrators and service providers serve much of the market, which means the questions in Table 1 are not being asked in isolation — they are being asked, in parallel, by many of a vendor's Jersey clients at once. Coordinated expectations move a supplier faster than any single firm can.

That advantage only exists if firms actually use it. A market that collectively demands model-change notification and tested fallback will get it built into the platforms. A market where each firm assumes someone else will raise it will find, at the next incident, that nobody did. The concentration that makes Jersey efficient is the same concentration that makes a shared blind spot systemic.

The firms that will handle this well are not the ones that stop outsourcing — that option does not exist in Jersey, and it should not. They are the ones that treat an AI-enabled supplier as a material dependency to be governed with the same seriousness as an in-house control: classified by impact, contracted with a right to know when the model changes, tested for fallback, and reviewed on a cadence rather than at renewal. The activity stays outsourced. The oversight comes home.

If your fund administrator retrained the model behind your screening control tomorrow, would your contract require them to tell you — or would you find out from the exception that slipped through?

Next in the series: the role most directly affected — what AI actually changes for the MLRO and the financial-crime function.

Sources: JFSC, Guidance on the use of AI in Jersey's financial services sector (July 2026) — Principle 2 (third-party and outsourcing, cybersecurity, resilience), materiality classification factors, and the illustrative scenario on third-party AI service outage; Government of Jersey et al., Jersey AI Playbook (2026).

Professional disclaimer: The views expressed are my own and are shared for general informational purposes. This content is intentionally non-confidential and does not include proprietary, client-specific, or employer-sensitive information. It is not legal, regulatory, investment, or professional advice; readers should seek appropriate advice for their circumstances.

Financial services leader (20+ years) | Lean Six Sigma Green Belt | London School of Economics (LSE) AI Leadership Accelerator

A version of this article was first published on LinkedIn as part of the Sequence body of work. This is the canonical version.

The views expressed are the author's own and shared for general information. This content is intentionally non-confidential and does not include proprietary, client-specific or employer-sensitive information. It is not legal, regulatory, investment or professional advice. © 2026 Paul Soares. Sequence is the trading name of Sequence Advisory Limited (in formation) · hello@sequenceadvisory.com