The European Union AI Act runs to 144 pages in the Official Journal. The United Kingdom has published white papers, hosted international AI safety summits and set up a government AI institute. The United States has issued executive orders and created its own AI safety body. This is serious work by capable people.
Little of it fits Jamaica, Barbados, Trinidad and Tobago or any other CARICOM member trying to govern AI in 2026. The EU Act was written for a single market of 450 million people with deep regulatory capacity and a domestic AI industry large enough to regulate. CARICOM has fifteen full member states, twelve of them with populations under a million, regulators whose staffing and budgets differ widely, and no domestic AI industry of any size. Almost every AI system its institutions use was built elsewhere.
I have built AI systems in Jamaica since 2011, and the frameworks I see proposed for the region mostly copy templates designed for that other situation.
What exists in the region today
Several member states now have data protection law. Jamaica's Data Protection Act 2020 came fully into force in December 2023 and is enforced by the Information Commissioner. Barbados passed its Data Protection Act in 2019. Trinidad and Tobago's 2011 Act has been only partly brought into force. CARICOM has worked on a regional digital agenda and on harmonising data protection, and Barbados has been active on cybersecurity.
No member state has an AI-specific framework. Data protection is the foundation, but it covers how personal data is collected, stored and used. It does not say how an automated decision system should be tested for bias, or how a citizen denied a benefit by one can challenge the result. Most of the risk sits in that gap.
The Caribbean does not yet have an AI industry to regulate. It has AI systems imported from elsewhere, making decisions about Caribbean citizens without Caribbean oversight.
The Caribbean mainly imports AI, and policy should start there
Large economies frame AI governance around their own builders: what obligations the companies and labs developing AI owe to the people their systems affect. The Caribbean has few AI builders. Its exposure comes from systems built by foreign companies under foreign rules, trained on data that may not represent Caribbean people, and deployed here with little transparency.
- A bank that licenses a North American credit model applies someone else's assumptions about income and repayment to Caribbean borrowers, including those paid in cash or through remittances.
- A government that buys an automated benefits eligibility system inherits rules written for another country's household structures.
- A school that adopts an adaptive learning platform uses models trained mostly on other students in other countries.
The urgent work is building the capacity to evaluate, audit and, where necessary, reject imported systems.
Five things a CARICOM AI policy needs
1. Accountability rules for imported systems
Any AI system used in a consequential decision, whether credit, public benefits, policing risk scores, health triage or exam grading, should meet a minimum transparency standard. The deploying institution must be able to explain in plain terms how the system decides, what data trained it, how it was tested for accuracy and bias on Caribbean data, and how a citizen can appeal.
Vendors should already hold this documentation, so the barrier is contractual and political, not technical. Governments can require it in every public sector AI contract.
2. Data sovereignty that covers models, not just storage
Caribbean debates on data sovereignty mostly concern cloud storage: where data sits and which courts can reach it. Those questions matter. A second loop gets less attention. When Caribbean data trains a model abroad, the model captures patterns from Caribbean people and is then licensed back to Caribbean institutions, which own none of it and cannot inspect it. A data sovereignty framework should set terms for whether and how local data may be used to train vendors' models.
3. Language and cultural representation standards
Language AI is trained overwhelmingly on standard American and British English and a few major European languages. Jamaican Patois, Trinidadian Creole English, Haitian Creole, Papiamento and Caribbean English generally are barely represented. The results are predictable: speech recognition that fails on Jamaican accents, sentiment tools that misread Caribbean social media, tutoring systems calibrated to how other students express understanding.
A regional policy should require public-facing AI systems to be tested on local speech and text before deployment, and should fund Caribbean language datasets that local developers can use.
4. A regional AI capacity body with real authority
Fifteen small states each building AI oversight alone will duplicate effort and produce inconsistent standards. A regional body, drawing on the Caribbean Court of Justice's model of shared regional institutions, could provide:
- shared auditing tools and staff;
- a register of AI systems used in CARICOM public sectors;
- common procurement standards and technical help for ministries buying AI;
- a joint voice in international AI forums, where Caribbean interests are rarely represented.
It would supplement national regulators, not replace them.
5. Incentives to keep AI talent working on Caribbean problems
A framework is only as good as the people who run it. A developer in Kingston or a data scientist in Port of Spain with strong AI skills can often earn several times their local salary in a remote role for a North American firm. In a field this thin, losing ten practitioners can mean losing a large part of a country's working AI capacity.
The answer is incentives, not restrictions: public sector AI fellowships, grants for Caribbean-focused AI projects, tax treatment that favours AI companies headquartered in the region, and procurement preferences for Caribbean-built solutions.
The Core Shift
Caribbean AI governance should move from protecting citizens after harm is done to evaluating and shaping AI systems before institutions deploy them. That means procurement rules and technical capacity, with consumer protection behind them.
Why early governance can attract investment
Political will is scarce in small states with thin administrations and competing priorities. One argument helps: clear AI rules are an asset to investors. A company choosing a regional base for AI services looks for predictable rules as well as time zones, English-speaking staff and financial infrastructure, all of which the Caribbean offers. States that set trustworthy frameworks early attract that investment; states that adopt others' standards later carry the compliance cost without the advantage.
This gives ministers two cases to make, one about protecting citizens and one about capturing value, and different audiences respond to each.
The step any member state can take this year
Most of the conceptual work on algorithmic accountability has been done internationally. What CARICOM lacks is institutions to apply it. The most practical first step is a minimum procurement standard for public sector AI contracts, requiring vendors to document how the system works, what data trained it, its accuracy on Caribbean data, and the appeal route for citizens. It needs no new legislation and no regional agreement, and it builds the institutional knowledge that fuller governance will need.
The weak point in my own argument is capacity. A procurement standard is only as good as the official reading the vendor's documentation, and most ministries have no one trained to judge a bias test. Until the regional body exists, some of these standards will be checked by people who cannot fully assess them.
What to do next
- Ministries of finance and public procurement offices: add an AI annex to standard contract templates before the next budget cycle, requiring system documentation, test results on local data, audit rights, a ban on vendors training their models on government data without written consent, and a citizen appeal route.
- Each government's chief information officer: within six months, publish a register of every AI or automated system used to make or support decisions about citizens. Each entry should name the vendor, the purpose and the responsible official.
- Data protection regulators: issue guidance on how existing data protection law applies to automated decisions and profiling, so institutions know their obligations before any AI law arrives.
- CARICOM Secretariat: commission a costed design for a regional AI capacity body, covering staffing, funding shares and legal basis, for discussion at a Heads of Government meeting.
- UWI and regional universities: start collecting consented, labelled speech and text data in Jamaican Patois, Trinidadian Creole English and Haitian Creole, and publish it under an open licence for local developers.
Frequently Asked Questions
Does the EU AI Act apply to Caribbean companies?
It can. The Act applies to providers who place AI systems on the EU market and to providers and deployers outside the EU whose AI output is used in the EU. A Caribbean BPO running an AI tool for European clients, or a Caribbean software firm selling AI features to EU customers, may fall within it. Check the Act's scope provisions with counsel before signing European contracts.
Which CARICOM members already have data protection laws?
Jamaica's Data Protection Act 2020 has been fully in force since December 2023, with the Information Commissioner as regulator. Barbados passed its Data Protection Act in 2019, and the Bahamas has had data protection legislation since 2003. Trinidad and Tobago's Data Protection Act 2011 is only partly in force. Several other members have bills in progress, so check each country's current position before relying on it.
What should a government AI contract include at a minimum?
Documentation of how the system works and what data trained it, results of accuracy and bias tests on local data, the right for the government or an appointed auditor to test the system, and limits on the vendor's use of government data, including a ban on training its models on that data without written consent. It should also require the vendor to report incidents promptly, keep data where the law requires, and return or delete data when the contract ends.
Are there ready-made tools for assessing a public sector AI system?
Yes. Canada's federal government publishes an Algorithmic Impact Assessment questionnaire, required for its own automated decision systems, and it can be adapted by other governments. The NIST AI Risk Management Framework and the ISO/IEC 42001 standard for AI management systems give structured approaches that do not need to be rewritten for the Caribbean. The practical work is choosing one and training officials to use it.
Can a Caribbean citizen challenge a decision made by an AI system today?
Partly. Data protection laws in Jamaica and Barbados give individuals rights over their personal data and some protection against decisions based solely on automated processing; read the relevant sections of your country's Act or ask the regulator. Ordinary administrative law also lets people challenge unfair public decisions, whether a person or a system made them. What is missing is a routine way to find out that an AI system was involved at all, which is why a public register matters.