Opinion / Caribbean AI sovereignty
The Fastest Way to Take Over the Caribbean with AI
The fastest way to take over the Caribbean with AI could be to let us approach it separately. Each country writes a national strategy, buys its own tools and agrees its own terms. Over time, the systems supporting our decisions could become harder for us to question, change or replace.
That is my concern. A national AI strategy should strengthen a country's ability to choose its future. Developed in isolation, it could deepen dependence on decisions made outside the region.
I want Caribbean governments and businesses to use AI. I also want us to retain enough knowledge, authority and bargaining power to decide how it serves our people.
We could buy the tools and lose the choices
A government can own its data and still have little practical control over the software interpreting it. A business can approve every purchase and still become dependent on a supplier whose system it cannot inspect or replace without disrupting its work.
Consider a hypothetical public service that uses an overseas platform to assess applications. The local team may understand the application process but have limited visibility into how the model produces its recommendation. If staff gradually stop checking the underlying evidence, the supplier's system gains influence over decisions affecting citizens.
That influence can grow through ordinary commercial arrangements. A provider may change prices, withdraw a feature or introduce a new model. The public institution then has to adapt, negotiate or leave. Leaving becomes difficult if the workflows, records and skills needed to operate independently have been neglected.
I see a risk of re-colonisation here: important choices could increasingly depend on infrastructure and priorities controlled elsewhere.
In my Agent Colonialism argument, the people affected must have a say in the design and in whose interests the system serves. A national flag on a strategy document does not establish that control.
An AI agent brings another set of interests into the room
An AI agent is software that can take steps towards a task using tools, rather than simply provide an answer. The distinction matters when we give it permission to read files, send messages or change records.
We need to separate three concerns. Supplier dependence is about who controls access and continuity. Misaligned objectives arise when the goals built into a system do not adequately reflect the needs of the people using it. A hostile operation involves someone deliberately trying to redirect or exploit it. Each needs its own response.
A system designed around a company's commercial goals, or another country's policy priorities, may make recommendations that fit those goals better than ours. That possibility deserves examination through contracts, testing and oversight. A company's nationality alone does not establish that it acts for a state, and poor local performance does not prove a hidden political objective.
There is also a documented security problem. In experiments described by NIST, attackers placed instructions in material an agent might read, such as a website, file or email. The agent could then be redirected towards harmful actions. This is called indirect prompt injection, or agent hijacking. The experiments demonstrate a mechanism; they do not establish that a Caribbean government has been infiltrated.
For a Caribbean institution, my inference is straightforward: the more authority we give an agent, the more consequential an instruction from the wrong source could become. Sensitive access needs limits, a named owner and a way to stop the system.
National strategies need a regional layer
If several countries rely on the same provider, a change to that provider can affect them together. Separate procurement teams may repeat the same assessment while failing to share the weakness one of them discovers. National strategies can therefore look complete while leaving a shared exposure unmanaged.
The Caribbean has already recognised the need to collaborate. UNESCO reported on 7 July 2026 that COTED-ICT members endorsed its Caribbean AI Policy Roadmap. Its regional director, Eric Falt, said the Caribbean should help shape how AI is governed
. UNESCO's account describes a shared approach alongside national readiness work.
The Caribbean Telecommunications Union's December 2025 interim report announcement also called for harmonised governance, procurement and audit standards. It presented those recommendations as a foundation for consultation, not a final policy instrument.
My concern is the distance between agreeing principles and operating shared safeguards. Countries should retain authority over their own public services and laws. They should also be able to draw on common tests, technical expertise and evidence about suppliers.
Coordination has limits. A regional arrangement can become another slow approval process, or spread the consequences of a poor common supplier choice. We should pool expertise while preserving alternatives and clear national accountability.
| Decision | National responsibility | Shared regional support |
|---|---|---|
| Approve a public service | The responsible institution decides whether to deploy. | Specialists provide reusable tests and findings. |
| Respond to an incident | The institution protects affected people and stops unsafe activity. | A trusted channel alerts other exposed institutions. |
| Resolve a citizen's complaint | The institution provides review and an accountable decision. | Common guidance helps countries compare remedies. |
What governments and businesses should do next
I recommend a practical programme that starts with existing institutions and the systems already in use.
- Map the dependence. Each ministry and major institution should identify its AI systems, providers, connected data and permissions. Record which services would fail if a supplier became unavailable, and who can authorise a shutdown.
- Agree common buying requirements. Regional procurement specialists should develop clauses covering data use, subcontractors, model changes, incident notification, access to logs and the ability to export records. Countries can adapt these to their laws and the service involved.
- Share tests and incident findings. Establish a trusted regional channel for reporting failures and attempted agent hijacking. Publish enough about test methods for institutions to reproduce them without exposing personal data or operational secrets.
- Keep expertise inside the institution. Train staff to assess outputs and challenge recommendations. Contracts should include knowledge transfer, with local practitioners involved in testing systems against Caribbean language, law and working conditions.
- Rehearse an exit. Within 30 days, select one non-critical AI workflow and test whether staff can recover its records and complete it using an alternative. Measure completion time, missing information and errors. Use the results to identify what must change before expanding the system's authority.
For Jamaica's public services, for example, a useful starting point would be an inventory of agents permitted to change records or communicate with applicants. A regional team could help test the controls, while the responsible Jamaican institution remains accountable for the decision to deploy.
Our citizens must retain a way to challenge the decision
Citizens should be able to find out when AI materially influences a public decision, who is responsible for it and how to request human review. A regional strategy that overlooks those questions could leave people dependent on both a distant supplier and an institution unable to explain its own process.
The response cannot be to build every component ourselves. Local ownership does not guarantee safe software, and international tools can bring useful capability. What matters is whether we can test the system, set its limits and continue serving people when it fails.
I want every national AI strategy in the Caribbean to identify where cooperation gives us greater control. The next regional discussion should produce named owners, shared requirements and a timetable for testing them. We should be able to see what changed in the contracts, the systems and the services our citizens receive.