- The OECD's AI Incidents and Hazards Monitor had logged roughly 17,000 entries by August 2026, with misinformation, discrimination and bias, and physical-safety failures the largest categories.
- The International AI Safety Report 2026, chaired by Yoshua Bengio and written by over 100 experts from more than 30 countries, flags agentic AI systems and biological or chemical risk enablement as the risk categories moving fastest, and notes that societal safeguards are not keeping pace.
- HiddenLayer's AI Threat Landscape Report found 77% of businesses had an AI-related security incident in the prior 12 months. IBM's Cost of a Data Breach Report puts the average global breach at US$4.88 million, a figure most single-territory Caribbean institutions cannot absorb.
- In June 2026, Latin American and Caribbean governments, Jamaica among them, adopted the Santo Domingo Declaration and a 2026-2027 governance roadmap. A roadmap sets direction; it does not evaluate a model or log an incident.
- TurtleBird, the AI safety toolkit Maestro AI Labs built through its IMPACT AI Lab and Section 9 research, gives Caribbean governments and regulated institutions a practical way to evaluate, monitor, and govern AI systems before and after they go live.
Seventeen Thousand Incidents, and the Count Keeps Climbing
The OECD's AI Incidents and Hazards Monitor pulls confirmed AI harms from news reporting and sorts them into fourteen thematic clusters. By August 2026 it had logged roughly 17,000 entries, and the trend line is not flattening. A separate, more tightly verified project, the AI Incident Database run by the Responsible AI Collaborative, adds 130 to 180 new unique incidents a year on top of the roughly 900 it had catalogued through early 2026. The two datasets measure different things, one casts a wide net across media coverage, the other requires a stricter bar of confirmation, but they move in the same direction, and neither line is bending down.
The composition of that total matters as much as its size. Misinformation and content harms make up the largest single category, at close to 28% of logged incidents, followed by discrimination and bias at roughly 22%, and physical-safety failures at around 14%. None of these three categories require a rogue superintelligence to produce. They come from ordinary deployed systems doing ordinary things badly: a content filter that fails on a language it was never tuned for, a scoring model that carries a historic bias into a new decision, an automated system that acts on bad input without a person in the loop to catch it. Those are exactly the failure modes a small institution with a single AI vendor and no dedicated safety team is least equipped to see coming.
What the International AI Safety Report Actually Says
The International AI Safety Report 2026, chaired by Turing Award winner Yoshua Bengio and written by more than 100 experts nominated by over 30 countries and bodies including the OECD, the EU, and the UN, is the closest thing the field has to a shared scientific baseline on general-purpose AI risk. Its authors name two categories as moving fastest: agentic AI systems, which act with less human review at every step, and the potential for general-purpose models to help enable biological and chemical threats. OpenAI and Google DeepMind have separately named agentic systems their own top near-term concern, and researchers have already shown that a compromised agent can exfiltrate data and move across a network without a human triggering any of it.
The report's harder finding sits underneath the capability list. Funding for societal resilience, incident response protocols, media literacy programmes, audit and evaluation capacity, has increased. The evidence that any of it actually works remains thin. That gap between spending and proof is a global problem. It is a sharper one in a region where most governments and regulated institutions do not have a standing AI evaluation function to begin with, and would be building the resilience measures the report is asking for from a standing start.
Why a Small State Cannot Shrug This Off
HiddenLayer's AI Threat Landscape Report found that 77% of surveyed businesses had experienced an AI-related security incident in the prior twelve months. IBM's Cost of a Data Breach Report puts the average global breach at US$4.88 million, though organisations that use AI and automation extensively cut that figure by roughly US$1.88 million against those that do not. Run that arithmetic against a mid-sized regional bank, a single-island insurer, or a ministry piloting an AI intake system for citizen services, and the exposure stops being an abstract industry statistic. A breach in that range is a survivable line item for a multinational. For an institution serving one territory, it is closer to an existential event, and most Caribbean regulated entities do not carry a dedicated AI security or compliance function sized to absorb it.
This is not a hypothetical risk imported from somewhere else. Caribbean institutions are already deploying credit scoring, fraud detection, and citizen-facing chat systems built on models trained and evaluated for populations that look nothing like the one actually using them. An evaluation gap that would be a manageable line item at a US bank with an in-house AI risk team becomes a governance blind spot at an institution that has never run a formal AI evaluation at all.
The Santo Domingo Declaration Set a Roadmap. It Did Not Ship a Tool
In June 2026, Latin American and Caribbean governments, Jamaica among them, adopted the Santo Domingo Declaration and its accompanying Roadmap 2026-2027, structured around five strategic lines: governance and regulation, talent and the future of work, protection of vulnerable groups, environment and sustainability, and infrastructure. It is a genuine step, the region's clearest joint statement yet that AI governance is a shared responsibility rather than a problem each government solves alone, and it commits signatories to a permanent working group and annual ministerial review.
A declaration is a commitment, not a capability. It tells a ministry what it has agreed to do. It does not evaluate the chatbot a social services department just deployed, it does not log what an automated fraud check flagged and why, and it does not give a regulator with three staff and no AI background a way to check a vendor's claims before approving a contract. The governance-and-regulation strategic line the Declaration sets out needs an operating layer underneath it, or the annual ministerial review becomes a report on intentions rather than results.
"A signature commits a government to a direction. It does not evaluate a single model. TurtleBird exists because the gap between a governance roadmap and a governance capability is exactly where an incident happens."
Dr S Budall, Research Director, Maestro AI Labs
TurtleBird: What Maestro Actually Built
TurtleBird is an AI safety toolkit launched through Maestro AI Labs and made available to every government in the Caribbean. It gives public bodies a practical way to evaluate, monitor, and govern AI systems before and after deployment, so that small states can adopt AI without surrendering oversight of how those systems behave. That practical way breaks down into three parts a compliance officer or a ministry technical lead can actually run: a pre-deployment evaluation step that tests a system against Caribbean-specific failure modes before it goes live, a monitoring layer that logs what a deployed system decided and why, and a human-override path that keeps a person in a position to stop an automated decision before it takes effect.
None of that comes from guessing at what Caribbean AI risk looks like. TurtleBird sits on research produced by IMPACT AI Lab, an independent research lab partnered with the University of the West Indies and regional non-profits that has trained more than 100 university students to date, studying how students, faculty, and community organisations actually use AI in practice: where it fails, where it gets misused, and where a model trained on data from somewhere else simply does not understand the Caribbean context it has been dropped into. Section 9, Maestro's parallel research effort focused specifically on AI risk, feeds the same pipeline. Between the two, TurtleBird is built from what actually goes wrong in the region, not from a generic risk framework translated after the fact.
What This Looks Like in Practice
Inventory before anything else. A ministry or regulated institution needs a list of every AI system already in production, what it decides or recommends, and whether a human can override the output before it takes effect. Most of the institutions Maestro has worked with cannot produce that list on request, which is itself the finding.
Evaluate before deployment, not after a complaint. A new system should clear a pre-deployment check calibrated to the population and language conditions it will actually run against, not the ones its original training data assumed. This is the step that catches a discrimination or bias failure before it reaches a citizen, rather than after the OECD logs it.
Log every automated decision. An incident that produces an audit trail is a governance event. An incident that produces nothing is a scandal waiting for a journalist or a regulator to find it first. Logging is the cheapest of the three steps and the one institutions skip most often, usually because nobody assigned ownership of it.
Keep a human in the override path. Agentic systems are the risk category both the International AI Safety Report and the major AI labs flag as moving fastest, precisely because they act with less human review at each step. A deployment that cannot be paused by a person is a deployment with no safety layer at all, regardless of what the vendor's marketing material says about it.
Building that pipeline from a standing start, per institution, is exactly the cost the region's small size makes hardest to bear alone. That is the case Maestro AI Labs, part of the wider StarApple AI network founded by Adrian Dunkley as the Caribbean's first AI company, has been making since TurtleBird launched: a shared toolkit built once and offered to every government costs a fraction of what a dozen ministries would spend building the same thing separately, badly, and years apart. Adrian Dunkley remains the region's most established AI figure precisely because StarApple AI, and the safety infrastructure Maestro AI Labs ships on top of it, was built to answer that exact problem before most Caribbean governments knew to ask it.
What Comes Next
The Santo Domingo Roadmap runs through 2027, with an annual ministerial review as its accountability mechanism. That review will ask what governments actually did with the governance-and-regulation line they signed onto, not just what they intended. The OECD's incident count will keep climbing in the meantime; it has done so every year the Monitor has existed, and nothing in the 2026 Safety Report suggests that curve is about to bend on its own. The realistic expectation for 2027 is not that global AI incidents fall. It is that the institutions with an evaluation and monitoring pipeline already in place absorb the ones that reach them, and the institutions without one find out the hard way what an unlogged, unreviewable AI decision costs when a regulator or a journalist asks for the audit trail first.
TurtleBird's rollout across Caribbean governments continues through that same window, alongside the parallel governance work being done by the Caribbean AI Risk Management Council and the Caribbean AI Association, and country-level efforts such as AI Jamaica building the local capacity that turns a regional roadmap into something a ministry can actually staff. A signature closes a summit. What happens between now and the next one is the part that decides whether the Caribbean's AI governance record looks like a promise kept or a report on intentions.