Data sovereignty in the Crown Dependencies
For a firm in Douglas, St Helier or St Peter Port, "the cloud" is rarely in the island. Client data processed by public AI tools is processed elsewhere - often in jurisdictions the firm never chose. That is a governance decision pretending to be an IT decision.
What the term actually means
Data sovereignty is not cybersecurity. It is control: knowing where data sits, who processes it, under whose law it can be compelled, and whether it can be moved back. For regulated financial and trust businesses, it is also a contractual and regulatory matter - client consents, outsourcing arrangements and regulator expectations.
The practical questions for a board
- Which data does an AI tool receive? (Often more than the user thinks - address books, attachments, document history.)
- Where is it processed? (A vendor's "UK data centre" can still route through a third country.)
- What can the vendor do with it? (Training models on your data is a commercial clause; check it.)
- Who has legal access to it? (A hosted AI service is subject to its host country's laws.)
- Can you get it back, in full, on demand?
The regional stance
Regulators in the Crown Dependencies operate on outcomes, not prescriptive rules. They expect a firm to be able to explain and evidence its position on data handling. An Isle of Man firm facing the MONEYVAL evaluation in October 2026 should expect that position to be tested.
The defensible position is not "we banned AI". It is "we know which AI touches which data, where that data goes, and we have a documented reason for allowing it".
Options by firm type
- Small practices: written policy + approval list of permitted tools + staff training. Weeks, not months.
- Mid-size firms: the above plus a data map and periodic vendor review.
- Regulated and trust firms: the above plus a documented position that client data may be processed through private models - ideally ones that never leave the island.
What "local" means in practice. Providers building for regulated Crown Dependency firms increasingly use private, local models so client data does not leave the island. An example of the local-model-first approach is Fuzzelogic's guide to AI-ready data for Isle of Man firms, and their approach to AI for regulated businesses built on private models. Assess any such claim - local is only local if you can verify the architecture.