What happened
The Guernsey Data Protection Authority (GDPA) commissioner Brent Homan warned that while companies may outsource certain functions, they cannot outsource accountability for protecting client data when using artificial intelligence. Homan said the bailiwick has not yet experienced a reported AI‑directed breach, but urged firms to have robust contracts and to verify the security of any third‑party AI providers. Matt Palmer, director of Guernsey and Jersey’s cyber‑security centres, echoed the warning, noting that AI is “here to stay” and that the region is adapting its cyber‑risk frameworks. Palmer stressed that AI risks can be managed through careful testing, sensible controls and pragmatic adoption, but acknowledged that the technology will never be risk‑free.
Brent Homan, commissioner for the GDPA, told local businesses that the rapid development of AI demands a serious review of how the technology is used. He stressed that while outsourcing certain operational duties is permissible, the ultimate duty to protect personal data remains with the data controller.
Homan noted that Guernsey has not yet recorded an AI‑specific data breach, but warned that organisations must have “good contracts in place” and verify the security posture of any AI service providers they engage.
Matt Palmer, director of the Guernsey and Jersey cyber‑security centres, added that AI is an enduring presence and that the region is adapting its cyber‑risk strategies accordingly. He described AI risks as manageable through “careful testing, good controls, sensible and pragmatic adoption,” while acknowledging that AI will never be completely risk‑free.
Why it matters
The GDPA’s warning signals a growing regulatory focus on , especially in small jurisdictions that handle cross‑border data. By emphasizing that accountability cannot be outsourced, the authority is pushing firms to embed AI risk assessments into their core compliance processes rather than treating AI as a peripheral service. This stance may influence other data‑protection regulators to issue similar guidance, potentially shaping contractual standards for AI vendors worldwide. Companies that rely on third‑party AI tools—such as large‑language‑model APIs, automated decision‑making platforms, or AI‑enhanced analytics—must now scrutinise vendor security measures and ensure that liability clauses reflect their ultimate responsibility for data breaches. The warning also highlights that, even without a known AI‑related incident, regulators are pre‑emptively addressing the technology’s security implications, which could lead to future enforcement actions or mandatory reporting requirements.
The statement underscores a shift from treating AI as a purely technical tool to recognising it as a governance challenge that directly impacts data‑protection obligations under GDPR‑like regimes.
By foregrounding accountability, the GDPA is likely to influence contract negotiations between data controllers and AI vendors, potentially leading to stricter liability clauses and mandatory security certifications.
The warning may act as a bellwether for other small‑to‑medium jurisdictions that lack dedicated AI legislation but are seeking to align with broader European data‑privacy expectations.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
Why can ethical evaluation not be reduced to one model score?
What to watch next
Watch for any formal guidance or regulatory codes issued by the GDPA in the coming months, as well as any reported AI‑related data breaches in Guernsey that could trigger enforcement. Monitor whether other jurisdictions adopt similar accountability language, and track how AI‑service providers adjust contract terms to meet heightened scrutiny. Companies should also watch for industry‑wide best‑practice frameworks that address AI risk testing, third‑party vetting and continuous monitoring.
Publication of detailed GDPA guidance or a formal regulatory framework on AI risk management.
Any reported AI‑related data breach in Guernsey that could trigger enforcement or fines.
Adoption of similar accountability language by data‑protection authorities in the UK, EU, or other offshore financial centres.
Changes in AI‑vendor contract templates to address liability and security assurances demanded by regulators.