- CARICOM has 15 member states and no unified AI framework, creating a patchwork of six distinct regulatory regimes across the major economies.
- Jamaica published the region's first National AI Policy in 2023. Trinidad and Tobago has a Digital Transformation Blueprint (2023-2028). Barbados operates the region's most mature fintech sandbox. Guyana, the OECS states, and others are still forming positions.
- The EU AI Act reached full application in August 2026, creating extraterritorial obligations for any Caribbean company whose AI output reaches EU customers, including those serving Caribbean diaspora financial and healthcare corridors.
- Guyana's GDP grew 57.8% in 2022 on oil revenues. Capital is flooding in faster than regulatory infrastructure can absorb it.
- The companies that build a portable Caribbean compliance architecture now will own an entry barrier that takes two to three years to replicate.
- Maestro AI Lab built compliance in as a design constraint from day one. That was a product decision and an investment thesis simultaneously.
No Region Moves in Lockstep
That is true in politics, in economics, and, as the Caribbean is demonstrating in sharp relief, in AI regulation. CARICOM has 15 member states. They share a regional secretariat, a legal framework for the single market, and decades of integration work. What they do not share is an AI governance framework, or anything close to one.
The result, as of mid-2026, is a patchwork. Across the six major Caribbean economies, each company deploying AI deals with a different regulatory expectation, a different data protection law, a different level of fintech sandbox maturity, and a different government posture on AI risk. For most founders, this is a compliance headache. For investors who read it correctly, it is the map of exactly where the moat sits in Caribbean AI.
This piece maps the patchwork, explains why the EU AI Act has accelerated it rather than resolved it, and makes the case that a company with a portable Caribbean compliance stack is now worth considerably more than its product alone.
Jamaica Moved First
Jamaica's Ministry of Science, Energy and Technology published the National AI Policy in 2023, making it the first CARICOM member state to articulate a formal government position on artificial intelligence. The policy covers AI ethics, data governance, labour market implications, and public-sector deployment. AI Jamaica, the country's dedicated AI industry body, coordinates private-sector engagement and has become one of the most active national AI communities in the region.
What the policy does not yet contain is enforcement machinery. The legal infrastructure around AI is still being built. The Data Protection Act 2020 covers personal data processing, and the Bank of Jamaica's fintech regulatory framework provides a controlled environment for financial product testing. But a company deploying an AI credit-decisioning system in Jamaica today operates under expectations that are directional rather than binding. The regulator is engaged and forming views. The binding rules are not yet written.
That is not a criticism. It is an honest description of where the market is. For an investor, a market where the regulator is paying close attention but the rules are still forming is precisely the moment to be positioned, because companies embedded before mandatory compliance arrives will not be dislodged easily by latecomers building to a specification that did not exist when the early mover started.
Trinidad, Barbados, and Guyana: Three Different Postures
Trinidad and Tobago published a Digital Transformation Blueprint covering 2023 to 2028. The document prioritises government service digitalisation, digital economy growth, and skills development. The Central Bank of Trinidad and Tobago has been among the more active Caribbean regulators on fintech, and the Financial Intelligence Unit uses data analytics for anti-money-laundering monitoring. What T&T has not yet done is separate AI governance as its own regulatory domain. AI is treated as part of digital, not as a distinct area requiring its own framework. The AI Trinidad and Tobago network is working to change that, but legislation has not followed.
Barbados is arguably the furthest ahead on practical regulatory infrastructure, for a specific reason: it is the Caribbean's most internationally integrated financial centre. The Central Bank of Barbados operates a regulatory sandbox that has attracted serious fintech activity, and successive governments have moved early on digital economy diplomacy. Companies headquartered in Barbados that serve UK, Canadian, and EU clients have faced extraterritorial regulatory pressure for years and built compliance muscle accordingly. That creates a ratchet effect: Barbados-based companies already operate to higher governance standards than their less globally integrated peers, which means they are better prepared for what the EU AI Act now demands.
Guyana is the wildcard in any Caribbean investment conversation. GDP grew 57.8% in 2022, driven entirely by oil production from the Stabroek block, and grew roughly 34% in 2023, making it one of the fastest-growing economies on the planet for two consecutive years. That growth has pulled capital into a regulatory environment that was not designed to absorb it at speed. The Bank of Guyana is modernising, but the digital economy regulatory layer remains thin relative to the economic activity flooding in. Guyana presents the highest opportunity and the shortest compliance runway of any CARICOM economy simultaneously.
The Eastern Caribbean states deserve a separate mention. Saint Lucia has participated in international AI safety statements and is building policy capacity through the OECS digital economy framework. Grenada and Antigua and Barbuda both have growing fintech and iGaming sectors with active AI applications in fraud detection and customer management. None of the three has AI-specific legislation. All three face EU AI Act exposure through their financial services sectors.
| Economy | AI Policy Status | Fintech Regulation | EU AI Act Exposure |
|---|---|---|---|
| Jamaica | National AI Policy (2023) | BoJ sandbox; DPA 2020 | Diaspora corridors UK/Canada |
| Trinidad & Tobago | Digital Blueprint 2023-2028 | CBTT active; FIU analytics | Energy sector EU joint ventures |
| Barbados | Sandbox-led; forming policy | CBB sandbox; highest maturity | High: UK/EU financial services |
| Guyana | Early formation | Modernising; thin digital layer | EU oil sector partnerships |
| Saint Lucia / OECS | OECS digital framework | ECCB; early-stage | Financial services exposure |
The EU Effect: A 2026 Problem, Not a 2028 One
Here is the factor that makes Caribbean AI governance an urgent concern rather than a deferred one.
The EU AI Act entered into force in August 2024. Enforcement phased in through 2025 and early 2026. Full application for high-risk AI systems, covering financial services, healthcare, critical infrastructure, and border management, arrived in August 2026. The Act carries explicit extraterritorial reach: it applies to any AI system whose output is used within the EU, regardless of where the system was built or where the provider is headquartered.
For Caribbean AI companies, this creates a new operating fact. Any product with EU-facing customers now carries EU AI Act compliance obligations. The Caribbean's deep diaspora connections mean there are more such products than most founders realise: a Jamaican credit app used by diaspora members managing remittances from the UK; a T&T insurance platform writing policies on assets held partly in EU territories; a Barbados wealth management tool serving clients across the Atlantic. These are not edge cases. They are the normal shape of Caribbean financial services.
The Act requires conformity assessments for high-risk AI systems, transparency documentation, human oversight provisions, and in some cases pre-market registration with EU authorities. Companies that can produce that documentation, because they built for auditability from the start, enter each conversation with regulators already prepared. Companies that did not have a reckoning ahead of them, often at the worst possible moment: when a client relationship or a market expansion depends on demonstrating compliance quickly.
"A compliance architecture built before the rules arrive is a product advantage. One built after the rules arrive is catch-up work at competitor-paced cost."
The Six Dimensions of the Patchwork
Jamaica's DPA 2020, T&T's Data Protection Act, the ECCB data framework for Eastern Caribbean states, and the EU GDPR for extraterritorial processing all impose different personal data obligations. A compliant regional data architecture has to satisfy the strictest of them by design.
BoJ, CBB, CBTT, and ECCB each run their own fintech engagement frameworks, with different approval criteria, different reporting requirements, and different product categories in scope. A credit AI product needs four separate conversations before it can operate across Jamaica, Barbados, T&T, and the OECS.
Jamaica's National AI Policy is the only country-level AI ethics document in CARICOM. Everyone else is working from international principles (OECD, UNESCO, EU AI Act by reference) without a local binding framework. The practical result: ethical AI requirements are real but unstandardised across borders.
Full application from August 2026. Caribbean companies with EU-facing products face conformity assessments, transparency documentation, and human oversight requirements that most local regulators have not yet codified. The company that already has documentation satisfies both simultaneously.
CARICOM governments are deploying digital services, tax systems, permit portals, and social service platforms with increasing AI components. None has a procurement standard for AI vendors. The company that helps governments build compliant AI systems sets the standard rather than responds to it.
There is no mutual recognition agreement, no portability standard, and no regional certification scheme for AI products across CARICOM. The first company to publish a portable compliance framework for the region, one regulators in multiple jurisdictions will accept, owns the standard until someone else publishes a better one.
The Historical Parallel: Financial Services in the 1990s
A historical comparison is useful here, because the Caribbean has been through this before.
Caribbean financial services fragmentation was the dominant risk narrative in the 1990s and early 2000s. Correspondent banking operated under different rules in each territory. Regulatory arbitrage was common. Operating across borders meant assembling a patchwork of local counsel, local banking relationships, and local registrations for each market. The companies that built regional infrastructure, regional know-your-customer systems, regional legal frameworks, captured value that lasted for decades. CARICOM's single market effort and the OECS regulatory harmonisation project were both driven, in part, by the economic cost of that fragmentation.
AI governance is following the same curve, roughly ten years faster. A company that builds a compliance architecture portable across Jamaica, T&T, Barbados, Guyana, and the OECS in 2026 owns an asset that would take a competitor two to three years to replicate, assuming they started today. The compliance architecture is the moat. The product is how you reach customers. The governance layer is what keeps the product in business when the rules firm up.
The Caribbean AI Association is building the policy coordination layer. The Caribbean AI Risk Management Council is developing regional governance standards. These are the bodies that, over three to five years, will produce the harmonisation that makes regional compliance simpler. But that harmonisation is not here yet. Right now, first movers set the template.
What StarApple AI and Maestro AI Lab Are Building
StarApple AI, founded by Adrian Dunkley in 2023, is the first AI company established in the Caribbean. Maestro AI Lab, its R&D arm at investors.maestrosai.com, has built with regional compliance as a design constraint from day one, before most Caribbean regulators had published AI-specific guidance. That was not caution. It was a thesis about where the market was going.
Credit Garden builds credit models that produce audit trails reviewable by any major Caribbean regulatory body. The auditability is not a feature added for compliance. It is the architecture the model runs on. Global Safety Score is built under a governance framework designed for regulated Caribbean markets with EU exposure, with documentation ready for both local and EU authorities. Harmonics, the lab's AI agent framework built specifically for regulated Caribbean deployment, has human override, escalation paths, and full audit infrastructure as core product infrastructure rather than optional add-ons. It was built this way because the alternative, retrofitting compliance after a client needs it for a regulator presentation, is expensive and slow in a way that costs enterprise deals.
Data Archaeology, the lab's data recovery and reconstruction product, addresses the upstream problem: the Caribbean's data quality gap. AI models trained on data that does not represent Caribbean populations, Caribbean financial patterns, or Caribbean risk profiles will produce outputs that do not serve those populations accurately. Compliant AI in the Caribbean requires not just compliant architecture, it requires data that actually reflects the region. That is the problem Data Archaeology was built to solve.
The network around Maestro AI Lab matters here too. AI Jamaica, AI T&T, AI Saint Lucia, the Caribbean AI Association, and the Caribbean AI Risk Management Council are building the national and regional policy layer. Maestro AI Lab sits between those governance bodies and the founders who need to deploy AI products inside the rules those bodies are writing. That position compounds the fastest when regulatory requirements arrive.
The Question Investors Should Be Asking
The standard Caribbean AI pitch starts with the market size: $83 billion economy, 44 million people, 30 to 40 percent of adults unbanked, $40 billion in annual remittances. Those numbers are accurate. But the conversation that determines enterprise value in a regulated market always comes back to the same question: what happens when the regulator walks in the door?
For a company whose compliance architecture was designed for six different regulatory regimes from the start, the answer is ready documentation and a clear audit trail. For a company that assumed a single jurisdiction and is now facing cross-border expansion, the answer is six months of legal work and a project to retrofit explainability and oversight into a product that was not built for either.
The patchwork is not a problem the region needs to fix before AI investment makes sense. It is the specific condition that makes early-mover, compliance-first AI companies in the Caribbean more valuable now than they will be once harmonisation arrives. When the rules harmonise, every serious player can comply. Right now, only the companies that built for compliance from day one already do.
That is the investor signal everyone is missing. The fragmentation is not a reason to wait. It is the reason to move.