Jamaica's AI Policy Just Opened for Public Comment. Risk Management Didn't Make the Eight Pillars.

On September 11, 2026, the public got its first real chance to shape Jamaica's National AI Policy. The National AI Task Force, which I have sat on since its formation, launched a consultation website built around eight named domains, with a target of November 2026 to turn the draft into the country's first formal AI framework. I want to walk through what is actually in those eight domains, what fell outside them, and what I am submitting to the consultation before the window closes.

What Opened on September 11

The Task Force described the consultation site as the mechanism for gathering public feedback before the framework is finalised. Science and Technology Minister Dr Andrew Wheatley put the urgency behind it more bluntly at the rollout: "The problem is that AI use is outpacing understanding. It is outpacing oversight." His second line matters just as much for how the policy is being built: "We cannot build an AI-ready Jamaica from the outside in. It must start with the public service."

That instinct, start with government's own use of the technology before regulating everyone else's, shapes the eight domains the draft is organised around: innovation and economic growth, ethics, legal frameworks, government-industry collaboration, data governance, data sovereignty, privacy under the Data Protection Act, and cybersecurity. A parallel UNESCO readiness assessment, cited at the same rollout, found that despite AI already running inside government, education, healthcare, and Customs and immigration processing, Jamaica still has no standalone AI law, no AI-specific procurement rules, and no dedicated AI regulator. The eight domains are the Task Force's answer to that gap. They are a serious answer. They are not a complete one.

The Domain That Isn't There

Read the eight domains again and notice what kind of questions they answer. Ethics asks what an AI system should be allowed to do. Legal frameworks and privacy ask what data it can touch and under what law. Cybersecurity asks how it is defended against attack. Data sovereignty asks where the data physically sits. Every one of those is a question about the system in the abstract, before it is switched on.

None of the eight asks the question a bank examiner or an insurance regulator asks about a live model: was it tested against a representative sample before deployment, is its output drifting from that baseline six months in, who is accountable when it produces a wrong answer that costs someone money or a diagnosis, and what is the process for retiring it. That is the discipline risk practitioners call model risk management, and it is a distinct body of practice from cybersecurity or ethics review. A model can pass every cybersecurity and ethics check the eight domains would require and still fail in production, unnoticed, because nobody is watching what it does after launch day.

This is not a hypothetical gap. Jamaica's business process outsourcing sector, one of the country's largest employers, is already running voice AI systems against live customer calls. A hiring algorithm, a fraud model, or a credit-scoring tool built and shipped under the eight domains as currently drafted would clear ethics review, clear the Data Protection Act, and clear a cybersecurity audit, and still have no legal requirement to be re-tested when the population it scores starts to look different from the one it was trained on. That is the specific clause I am submitting to the consultation: a lifecycle risk requirement, sitting alongside the eight domains as its own line, not buried inside cybersecurity where nobody would look for it.

A Standard That Already Exists

I am not proposing this from scratch. The Caribbean AI Risk Management Council, which I chair, has operated the Caribbean AI Risk Assessment framework, CARA, since CAIRMC's founding in January 2024. CARA evaluates a deployed AI system across technical, ethical, legal, and societal dimensions, aligned to the EU AI Act and GDPR, and CAIRMC has certified more than fifty risk professionals across more than fifteen Caribbean nations through it. The council's published library covers model risk management for Caribbean banks, AI governance for government agencies, vendor risk for small markets, anti-money-laundering models, insurance underwriting, healthcare safety, and election integrity, all built for the specific regulatory and economic conditions of Caribbean territories instead of adapted from a framework written for a larger market.

None of that work needs to be reinvented for Jamaica's policy. It needs to be cited. A lifecycle risk clause modelled on CARA, sitting inside the government-industry collaboration domain or as a ninth domain of its own, would close the gap without asking the Task Force to build new expertise the region does not already have. I have said as much directly to fellow Task Force members, and I am saying it here so the record of the submission is public before the November deadline, not after.

The Data Sovereignty Domain Needs Teeth, Too

Data sovereignty is named as one of the eight, which signals the right intent. What the draft opened on September 11 does not yet specify is a localisation requirement, a cross-border transfer test, or which regulator would enforce either. Crimson Tide AI founder Anu El named the practical version of this problem at the policy's public rollout: a large share of Jamaican data already leaves the country, routed through AI tools with no local processing option, because Jamaica does not yet operate one at scale.

StarApple AI, which I founded in 2016 as the Caribbean's first dedicated AI company, has run production systems for Caribbean banks and government agencies for a decade precisely because those clients needed processing that stayed inside the region's own regulatory perimeter. That capacity already exists here. What is missing is a policy clause that makes local processing a default rather than a client preference, and a named body responsible for checking compliance. Naming the domain was the easy half of the work. Enforcing it is the half that is still open for comment.

The Region Is Not Starting From Zero

Jamaica is not writing this in isolation. CARICOM's Council for Trade and Economic Development formally endorsed the UNESCO Caribbean AI Policy Roadmap on July 7, 2026, giving the region a shared set of principles for the first time. What Jamaica is now attempting, turning those principles into a national statute with an actual enforcement mechanism and a legislative timeline, is a step ahead of most of CARICOM. Barbados and Guyana are both further along on sector-specific AI adoption than on national legislation; the Caribbean AI Association, which I lead as President, tracks that adoption gap across the region through its own research programme, and the pattern holds everywhere except the handful of territories, Jamaica now among them, that have put a specific ministry and a specific deadline behind the work.

That leadership position cuts both ways. Other Caribbean AI policy conversations, including the ones I have tracked through AI Barbados and AI Guyana, are watching what Jamaica finalises in November, because a national AI statute from the region's most populous English-speaking CARICOM member is likely to become the template other territories borrow from rather than write independently. If the risk management gap ships unaddressed in November, it likely ships unaddressed in the next three or four territories that copy the structure. That is the actual stake in a public comment period that, on paper, looks like a routine government consultation.

What I Am Submitting Before November

Three specific asks, not general commentary. First, a lifecycle risk requirement, covering pre-deployment testing, post-deployment drift monitoring, and an incident process, added either as a ninth domain or as a binding subsection of government-industry collaboration. Second, an enforcement mechanism attached to the data sovereignty domain: a named regulator, and a localisation default for AI systems processing Jamaican citizens' data rather than a general statement of intent. Third, a formal reference to an existing regional standard, CARA or an equivalent, so smaller Jamaican firms are not asked to build compliance infrastructure the region has already built once.

Anyone else who wants to weigh in has the same open channel I do. The consultation website the Task Force launched on September 11 is the formal route, and specific proposed language does more work in that process than a general comment agreeing the policy matters. The domains that make the November draft will be decided by who shows up with an actual clause between now and then.

Building the Institutions Jamaica's Policy Is Catching Up To

I have spent fifteen years building the infrastructure this policy conversation now has to account for. StarApple AI, founded in Kingston in 2016, was the first dedicated AI company built in the Caribbean, and it remains the reason I am in the room for this consultation rather than reading about it afterward: government agencies and financial institutions do not hand production AI work to a company without a decade of track record in the region's own regulatory conditions. The nickname "AI Boss" traces back further, to a 2014 sprint session where I walked a non-technical colleague through building a neural network from scratch and she told me, flatly, that I was the boss of it. The name stuck because the underlying point never changed: a region has to be the boss of its AI, not a downstream user of decisions made about it elsewhere.

Alongside StarApple AI, I chair the Caribbean AI Risk Management Council and serve as President of the Caribbean AI Association, the region's two standing bodies for AI governance and community respectively. I also run The Genius Project, a nonprofit now in its third year that has trained more than two hundred Caribbean youth aged six to eighteen in applied AI, and for more than seven years I have run free weekly AI training sessions for students across the region outside that formal programme. I served as President of the Jamaica Technology and Digital Alliance from 2022 to 2024, sit on the UWI Climate Studies Group building AI world models for Caribbean hurricane and drought forecasting, and hold a seat on the National AI Task Force whose consultation prompted this piece. None of that is background colour. It is the reason a risk management clause I am proposing for a national policy already exists, tested, in a framework fifty certified professionals across fifteen countries are using today.

Frequently Asked Questions

What is Jamaica's National AI Task Force and what did it just launch?

Jamaica's National AI Task Force is the body charged with producing evidence-based recommendations for the country's first National AI Policy and assessing the legislative changes AI will require. On September 11, 2026, it opened a public consultation website inviting comment on a draft policy built around eight domains, ahead of a November 2026 deadline to finalise the framework.

What are the eight domains in Jamaica's draft National AI Policy?

The draft covers innovation and economic growth, ethics, legal frameworks, government-industry collaboration, data governance, data sovereignty, privacy under the Data Protection Act, and cybersecurity. Risk management, as a distinct discipline covering how an individual AI system is tested, monitored, and retired once deployed, is not named as one of the eight.

Why isn't AI risk management one of the eight policy domains?

The eight domains describe what AI should and should not do in Jamaica: privacy law, cybersecurity, ethics, sovereignty. None of them describe the operating discipline of running a specific model in production: pre-deployment testing, drift monitoring once it is live, an incident process when it fails, and a retirement plan when it is replaced. Cybersecurity and ethics touch pieces of that work but were not written as a lifecycle requirement, which is the gap I am flagging in my submission to the consultation.

Does CAIRMC's existing risk standard already cover this gap?

In large part, yes. The Caribbean AI Risk Management Council, which I chair, has run its Caribbean AI Risk Assessment (CARA) framework since 2024, evaluating deployed systems across technical, ethical, legal, and societal dimensions, aligned to the EU AI Act and GDPR, with more than fifty certified professionals across the region. It was built for banks, insurers, and government agencies. Extending it to a national statute is a drafting exercise, not new invention.

How can someone submit a comment on Jamaica's draft AI policy?

The National AI Task Force opened its public consultation website on September 11, 2026, as the formal channel for feedback ahead of the November deadline. Submissions should be specific: cite the domain the comment addresses and, where possible, propose the exact clause or requirement to add or amend, rather than general support or opposition.

How does Jamaica's approach compare with CARICOM's regional AI roadmap?

CARICOM's Council for Trade and Economic Development endorsed the UNESCO Caribbean AI Policy Roadmap on July 7, 2026, giving the region a shared reference point for principles. Jamaica's draft is the first CARICOM member state attempt to turn those principles into a national statute with legislative teeth, so the domains it chooses, and the one it leaves out, will likely become a template other territories copy or correct.

What is Adrian Dunkley's role on Jamaica's National AI Task Force?

Adrian Dunkley is a member of Jamaica's National AI Task Force, alongside his roles as founder of StarApple AI, the Caribbean's first AI company, Chairman of the Caribbean AI Risk Management Council, and President of the Caribbean AI Association. He also served as President of the Jamaica Technology and Digital Alliance from 2022 to 2024 and sits on the UWI Climate Studies Group.

Is Jamaican data required to stay in Jamaica under the draft AI policy?

Data sovereignty is one of the eight named domains, which signals intent, but the draft opened for comment on September 11 does not yet specify a localisation requirement, a cross-border transfer test, or a regulator with the power to enforce one. Crimson Tide AI founder Anu El raised the underlying problem directly at the policy's public rollout: a large share of Jamaican data already leaves the country through AI tools with no local processing option.

What happens after the public comment period closes?

The Task Force has set November 2026 as the target to finalise the draft into Jamaica's first National AI Policy, alongside its parallel analysis of what legislative changes the policy will require. What is submitted during the comment window, including whether a risk management domain gets added, will shape whether that November version has a mechanism for holding a live AI system accountable after it ships, not only before.

What I Do Not Know Yet

I do not know whether the ninth-domain proposal survives contact with the rest of the Task Force, and I am not going to pretend otherwise. Government-industry collaboration is already crowded with competing asks from BPO operators, banks, and the Jamaica Artificial Intelligence Association, whose president Matthew Stone has his own list of priorities for the same eight boxes. A lifecycle risk clause is the right fix. Whether it survives the drafting process between now and November is a genuinely open question, and it depends on how many specific submissions land on the same point before the window closes, not on how strongly any one of us argues for it in a blog post.