CARICOM Model Artificial Intelligence Act

Article 1Purpose, interpretation and legal status

1. This model Act proposes safeguards for the development, supply and use of artificial intelligence affecting people in a participating jurisdiction. Its purposes are to protect rights, support useful innovation, preserve democratic accountability and ensure that regional businesses can meet proportionate requirements. The expression “shall” in these clauses describes an obligation proposed for enactment; it does not create an obligation through publication by CAIA.
2. An adopting legislature shall give the Act a national short title, designate its territorial reach and identify its commencement mechanism. References to CARICOM describe the intended regional policy setting. Publication does not establish a CARICOM institution, confer enforcement powers on CAIA, or represent adoption by any government. The Act shall be interpreted consistently with the adopting jurisdiction’s constitution and binding human-rights obligations. Where national provisions provide greater protection, those protections shall continue to apply.

Reference and adaptation note: Revised Treaty of Chaguaramas, Article 240.

Article 2Scope, exclusions and cross-border supply

1. The Act shall apply to public bodies and private organisations that develop, market, import, integrate or deploy AI for use in the adopting jurisdiction. An overseas supplier targeting that market, or supplying a system whose outputs are knowingly used there for decisions affecting persons, shall comply with the applicable supplier duties and maintain an effective service and regulatory contact. Mere accessibility of a foreign website shall not by itself establish targeting.
2. Personal, non-professional use shall be excluded, while conduct otherwise unlawful remains subject to existing law. Controlled scientific research before public deployment shall receive proportionate treatment, with ethics, data and safety duties preserved. A research label, open-source licence or pilot designation shall not exempt a live high-risk service. National security exclusions shall be defined narrowly by national legislation, remain subject to constitutional oversight and prohibit the use of an exclusion to conceal ordinary administrative decisions.

Article 3Definitions and responsibility across the supply chain

1. An AI system means a machine-based system that infers from inputs how to produce predictions, content, recommendations or decisions, with varying autonomy and possible adaptation. The definition shall exclude software that only executes fixed rules without inference. A provider develops a system or has one developed and supplies it under its name. A deployer uses a system within its professional or public functions. An importer introduces an overseas system; an integrator combines components into a service.
2. Intended purpose means the documented task, users, population and operating conditions. A material modification changes that purpose, relevant capabilities or risk controls. Serious harm includes death or injury, significant unlawful discrimination, severe privacy violations, denial of essential services and substantial disruption of critical infrastructure. Responsibility shall follow actual control over a component or decision. Contracts may allocate work and access rights, but shall not extinguish statutory responsibility or an affected person’s remedy.

Article 4AI literacy and accountable leadership

1. Every organisation within scope shall assign an accountable officer for its AI activities and give personnel training appropriate to their role. A small business may assign an existing manager; designation alone shall not require a separate department or paid certification. Boards and senior public officials shall receive enough instruction to understand intended benefits, limits, supplier dependence and the consequences of failure.
2. Training shall address inaccurate outputs, over-reliance, confidentiality, security, discrimination, safe escalation and the organisation’s permitted uses. Staff handling consequential decisions shall practise recognising uncertainty, checking evidence and using a manual alternative. Employers shall provide a confidential route for reporting unsafe instructions without retaliation. Training records shall identify the role, date and demonstrated competence, with refresher instruction after material changes. National authorities shall publish free materials in accessible formats and seek community input on language and delivery.

Article 5Risk classification and review

1. The provider shall document the system’s purpose, foreseeable misuse, affected population and proposed risk category before supply. The deployer shall confirm the category in its own setting before use. Classification shall consider the severity and reversibility of harm, scale, exposure of vulnerable persons and the practical ability to challenge a decision. The categories described above and the high-risk uses in Schedule A are proposed regional rules. Classification attaches to the use of AI rather than its marketing name.
2. Prohibited practices shall not be deployed. High-risk uses shall meet the assessment and assurance duties. Disclosure duties may apply at any permissible risk level. Lower-risk tools shall remain subject to existing law and baseline security and data controls. An authority may review a disputed classification and require reasons or corrective action. Changes to a published risk schedule shall follow consultation, a recorded justification and legislative oversight; they shall not be made through unpublished administrative guidance.

Article 6Prohibited uses and narrowly defined safeguards

1. The following practices shall be prohibited: materially harmful manipulation or exploitation of vulnerability; social scoring that produces unjustified disadvantage across unrelated settings; untargeted collection of facial images to create recognition databases; inference of protected sensitive traits from biometrics; individual criminal-risk prediction based solely on profiling; and emotion inference in employment or education, except a strictly necessary, separately authorised medical or safety use. The proposal also prohibits AI generation or manipulation of child sexual abuse material and non-consensual intimate imagery, with carefully defined evidential handling for lawful investigation.
2. Indiscriminate real-time biometric identification in publicly accessible places shall be prohibited. Any exceptional identification power must be separately authorised by national law for a specified serious threat, require prior independent judicial approval where practicable, and be limited in location, persons and time. Urgent use must receive prompt judicial review. Peaceful protest, political opinion, ethnicity or inability to provide consent shall not justify surveillance. No general “public interest” exemption shall override this clause.

Article 7High-risk uses and the regional schedule

1. A system shall be high-risk where it materially determines or influences access to employment, education, essential credit or insurance, housing, healthcare, social assistance, migration status, justice or a critical public service. Systems controlling safety-critical transport, electricity, water, telecommunications, medical equipment or disaster operations shall also be high-risk. Schedule A includes claims decisions, public-benefit eligibility, worker monitoring used for discipline, examination grading and evacuation prioritisation as proposed regional extensions or clarifications.
2. A tool used only for routine formatting or clerical support may fall outside this category where it cannot materially influence the consequential decision. The deployer shall demonstrate that restriction through system permissions, workflow design and monitoring. A nominal human signature shall not establish an exemption where staff routinely accept an automated recommendation. When a lower-risk assistant is connected to payment, case-management or operational tools, the resulting authority and consequences shall be reassessed before those tools are enabled.

Article 8Fundamental-rights and public-benefit assessment

1. Before a high-risk deployment, the deployer shall prepare a combined impact assessment covering rights, data protection, public benefit, accessibility and operational resilience. It shall describe the service problem, the non-AI alternative, intended users, affected communities, likely harms, safeguards and accountable decision-makers. It shall examine effects on children, persons with disabilities, informal workers, rural communities and groups whose language or circumstances may be poorly represented in the data.
2. Affected people and relevant worker or community representatives shall have a practical opportunity to comment before public-sector deployment. Where urgent action makes prior consultation impossible, the reason and a prompt subsequent review shall be recorded. The assessment shall define measurable acceptance criteria and conditions for stopping use. A public summary shall be published before launch, with narrowly justified redactions. The full assessment shall remain available to competent authorities. An assessment shall be updated after material changes or evidence of harm.

Reference and adaptation note: EU Article 27: fundamental-rights impact assessment.

Article 9Evidence, testing and acceptance thresholds

1. The provider and deployer shall maintain an evidence plan covering the system’s actual task and environment. Before testing, they shall specify acceptable error, foreseeable failure modes, escalation triggers and the groups for whom performance must be assessed. High average accuracy shall not excuse dangerous errors for a smaller community. Where small samples prevent reliable subgroup estimates, uncertainty and operational restrictions shall be documented rather than replaced with unsupported claims of fairness.
2. Testing shall include local cases, difficult inputs, misuse, model updates, loss of connectivity and interactions with connected systems. A high-risk deployment shall not proceed where evidence cannot support its intended use. Providers shall supply sufficient information for proportionate independent scrutiny; deployers shall verify performance in their workflow. Records shall separate vendor claims, independently observed results and unresolved limitations. Monitoring shall continue after launch and compare actual errors and complaints against the original acceptance criteria.

Reference and adaptation note: EU Article 9: risk management.

Article 10Personal data, lawful access and cross-border processing

1. AI use shall satisfy applicable national requirements governing personal data, confidentiality and authorised disclosure. The organisation shall identify a lawful basis, minimise the information used, define retention periods and document who can access the data. Publicly available personal information shall not automatically be treated as available for unrestricted training or profiling. Sensitive information shall receive additional safeguards, including restricted access and an assessment of whether the use is necessary.
2. Before cross-border hosting or supplier access, the organisation shall map processing locations, subprocessors, onward transfers and contractual protections. A supplier shall not reuse confidential public-sector, customer or employee information for unrelated model training without a separate lawful basis and explicit contractual authority. This draft does not impose a universal Caribbean data-localisation requirement. Any localisation rule shall be justified for the relevant risk and reconciled with national law. Shared assessments shall avoid unnecessary duplication while preserving the independent legal requirements of each jurisdiction.

Article 11Caribbean language, inclusion and cultural interests

1. AI used to provide or restrict an essential service shall be assessed for the languages, accents and communication practices of the population it serves. Depending on the jurisdiction and community, this may include English, French, Haitian Creole, Dutch, Spanish, Caribbean Creoles and Indigenous languages. A system shall not treat accent, spelling variation or code-switching as evidence of low ability, dishonesty or fraud without a demonstrable, lawful and task-relevant basis.
2. Deployers shall offer an accessible human channel where language performance is inadequate. Public bodies shall involve relevant communities in testing and decisions about collection or reuse of cultural materials. Indigenous knowledge, oral histories and community archives shall receive safeguards consistent with applicable rights, permissions and community governance. Copyright, performers’ rights and privacy shall apply to synthetic voices, music and likenesses. This clause proposes procedural protections; it does not claim to create or settle a uniform regional ownership regime for cultural knowledge.

Article 12Meaningful human oversight and agent permissions

1. High-risk services shall assign trained reviewers with enough time, information and authority to question an AI output, obtain supporting evidence, override a recommendation and stop unsafe operation. The reviewer’s workload and incentives shall permit those actions in practice. The organisation shall record when the system materially influences a decision and shall check for habitual approval without examination. Professional responsibility shall remain with the authorised person or institution.
2. AI agents with access to money, records, messages or physical controls shall operate within documented permissions. High-consequence actions shall require a separately recorded human authorisation unless a narrowly specified, tested and lawful operating rule permits automation. Access shall use the least privilege needed, with spending limits, revocation and recoverable records. A change in model, connected tool or permission shall trigger review. Emergency stop procedures shall be available to authorised staff and tested before operational use.

Reference and adaptation note: EU Article 14: human oversight.

Article 13Transparency, synthetic media and public communication

1. A person shall receive clear notice when interacting with AI unless the context makes that fact unmistakable. Notices shall explain the service’s purpose, relevant limitations and how to reach a human. Providers of synthetic-media tools shall support technically feasible provenance or machine-readable marking. Persons publishing deceptive synthetic depictions of real people or public events shall disclose material manipulation in a form that remains understandable when shared on mobile platforms.
2. Public-interest notices, political advertising and emergency communications shall identify the responsible publisher. Labelling shall not legalise impersonation, fraud, harassment or a prohibited practice. Evident satire and creative works shall use an appropriate disclosure that preserves expression without misleading audiences about a real person or event. Routine spelling correction shall not require a warning on every sentence. National electoral and media laws shall continue to apply, and any restriction on expression shall require a lawful, necessary and proportionate basis.

Reference and adaptation note: EU Article 50: transparency.

Article 14Rights to notice, reasons and human reconsideration

1. Where AI materially contributes to an adverse decision with legal or similarly significant effects, the affected person shall receive notice of that contribution and an intelligible explanation of the principal reasons. The explanation shall identify the relevant information, the system’s role and the route to challenge an error. It shall address the actual decision rather than offer a generic description of the technology. A provider shall give the deployer enough information to fulfil this duty.
2. The person shall be able to seek human reconsideration by someone authorised to change the outcome, supply additional evidence and correct inaccurate records. No fee shall be charged for a complaint or reconsideration under this model Act. The proposed default response period is 30 calendar days, with faster handling where health, subsistence or another urgent interest is at risk. Any extension shall be justified and communicated. Existing shorter deadlines, stronger rights and access to courts shall be preserved.

Reference and adaptation note: EU Article 86: explanation of individual decisions.

Article 15Provider, importer and deployer duties

1. Providers shall supply an accurate description of intended uses, known limits, model and software versions, evaluation evidence, maintenance arrangements and required safeguards. Importers and distributors shall verify that the necessary documentation and a reachable responsible supplier exist before supplying a high-risk system. Integrators shall assess how components interact and identify who is responsible for updates, monitoring and incidents. Relabelling an overseas product shall not remove these duties.
2. Deployers shall use the system within its assessed purpose, train staff, maintain appropriate input controls and monitor outcomes. A provider shall give advance notice of changes likely to alter performance, access or risk, except where immediate security action is needed. Material modifications shall be reassessed before consequential use resumes. Where a supplier cannot provide the information needed for safe deployment, the deployer shall limit or suspend the use. Evidence of compliance in another market may be reused where relevant, but shall not replace local testing or rights protection.

Article 16General-purpose models and regional systemic risk

1. A general-purpose model provider supplying the adopting market shall make proportionate technical and integration information available to downstream organisations, maintain a policy for compliance with applicable copyright law and publish an informative summary of training-content categories. Disclosures shall support accountability while protecting legitimate confidential information. Open-source release shall receive tailored treatment, with any exemption precisely defined and withdrawn where the model presents systemic risk.
2. Additional evaluation, incident coordination and security duties shall apply where a model’s capabilities or concentration of use could cause widespread regional harm. Designation shall consider capability, critical-service dependence, cross-border reach and the availability of alternatives. A numerical compute threshold from another jurisdiction shall not be imported as the only test. A reasoned designation, consultation and appeal shall be available. Requiring a contact or documentation shall not be presented as a power that CAIA currently possesses.

Reference and adaptation note: EU general-purpose AI obligations.

Article 17Public procurement and register of consequential systems

1. A public body shall record consequential AI systems in a public register before routine deployment. An entry shall identify the responsible institution, purpose, supplier, risk category, affected service, assessment summary, review date and complaint route. Information may be withheld only on a specific lawful ground, with reasons and independent review. Registers shall not publish personal case records, security credentials or information that would create avoidable operational danger.
2. Procurement specifications shall require local validation, documentation access, audit cooperation, change notification, incident support, data export and an orderly exit. Contracts shall state which party pays for remedial work and how essential services continue if a provider withdraws. Public bodies shall assess total costs, including licences, connectivity, staff review, assurance and migration. Procurement shall permit suitable local suppliers and shared regional purchasing without weakening competition or excluding smaller businesses through unnecessary certification requirements.

Article 18Hurricane readiness and continuity of essential services

1. High-risk deployments supporting health, utilities, public benefits or emergency management shall include a tested continuity plan for power failure, connectivity loss, cloud disruption and supplier outage. The plan shall name the person who can switch to an alternative, define minimum service levels and explain how records are reconciled when systems return. An essential service shall not depend on a single inaccessible model with no workable fallback.
2. AI forecasts and recommendations used during a disaster shall show their source, issue time, uncertainty and authorised decision pathway. A generated message shall not impersonate an official warning. Emergency operators shall retain an auditable record of significant automated recommendations and overrides. Temporary changes during a declared emergency shall be necessary, time-limited and reviewed afterwards. Emergency urgency shall not create an unrestricted exemption for surveillance or indefinite retention of displaced persons’ information.

Article 19Cybersecurity, incident reporting and coordinated response

1. Organisations shall maintain safeguards proportionate to their systems’ access, sensitivity and potential consequences. These shall include access control, supplier assessment, secure updates, monitoring and recovery. Systems that ingest untrusted documents, messages or web content shall prevent that content from changing privileged instructions or authorising actions. High-risk agents shall separate data interpretation from permissions to execute transactions or disclose information.
2. A deployer or provider becoming aware of a serious AI incident shall contain the harm and notify the designated authority without undue delay. This proposal sets a default initial notification within 72 hours of awareness, an immediate warning for imminent threats to life or essential services, and a fuller report within 30 days. These are proposed drafting choices; any shorter existing legal deadline remains controlling. Reports shall distinguish confirmed facts from uncertainty, preserve relevant evidence and identify corrective actions. Cross-border notification shall use secure channels and minimise personal information.

Article 20National supervision and a proposed regional support mechanism

1. Each adopting jurisdiction shall designate a competent national authority and a public contact point. It may assign functions to an existing body where expertise, independence and resources are adequate. Allocation shall be explicit where data protection, consumer protection, financial supervision and sector regulators share responsibilities. The designation shall include funding, appointment safeguards, reporting duties and procedures to avoid conflicting orders.
2. Participating governments may establish a jointly funded regional technical support mechanism for evaluation, shared guidance, incident coordination and specialist assistance. This is a proposed arrangement, not an existing CARICOM AI regulator. National authorities shall retain legally assigned enforcement and courts shall retain their jurisdiction. CAIA may contribute public research or convene consultation, with declared conflicts, but shall not decide its own members’ legal compliance. Any use of existing regional institutions shall require their agreement and the necessary legal mandate.

Article 21Assurance, shared testing and mutual recognition

1. High-risk providers shall maintain an assurance file showing how the system meets the Act in its intended use. Evidence shall include risk controls, local test results, oversight arrangements, security, monitoring and unresolved limitations. Independent assessment shall be required for the most consequential uses identified by national regulations, with selection criteria, assessor competence and conflict-of-interest rules published in advance. An assessment shall have a defined scope and review date.
2. Participating jurisdictions may recognise shared technical evaluations to reduce duplicate work. Recognition shall require equivalent assessment methods, access to evidence and an agreement specifying what is accepted. It shall not automatically transfer a foreign authorisation, waive local data law or remove a resident’s complaint rights. Authorities shall be able to restrict a deployment that fails in local conditions. A public register shall distinguish self-declarations, independent assessments, regulator decisions and voluntary certificates so that purchasers can understand what has actually been checked.

Article 22Small businesses, sandboxes and public-interest research

1. Authorities shall provide free templates, practical guidance and a proportionate route for micro and small enterprises. Documentation shall scale with the use and harm, while prohibitions and essential rights apply regardless of organisation size. Small firms shall be permitted to reuse sound supplier evidence and shared assessments, with a short record explaining local applicability. Regulatory fees shall reflect ability to pay and shall not make a low-risk experiment dependent on a costly consultant.
2. A supervised sandbox may permit bounded testing under a written plan specifying participants, consent where required, data controls, duration, safeguards, exit conditions and responsibility for harm. A sandbox shall not authorise a prohibited use or remove constitutional and data protections. Authorities may cooperate on a shared sandbox, subject to national mandates. Research participants shall receive an understandable explanation and access to a remedy. Evaluation findings and lessons shall be published in a form that protects participants and legitimate confidential information.

Reference and adaptation note: EU Article 57: regulatory sandboxes.

Article 23Workers, children and essential-service access

1. Before introducing AI that materially affects recruitment, pay, schedules, discipline or redundancy, an employer shall inform affected workers and consult their representatives where applicable. The assessment shall identify which tasks change, what training is required, how performance will be evaluated and whether human review is sufficient. An employee shall not be penalised solely for questioning an inaccurate or unsafe AI recommendation through the organisation’s authorised process.
2. Systems used by or about children shall give primary weight to their safety and best interests. Schools shall assess educational benefit, accessibility, data practices and the effect on teacher responsibilities before deployment. Essential services shall provide a usable alternative where a person cannot use an AI interface or where the interface fails to accommodate disability or language. These provisions shall operate alongside labour, education, child-protection and equality law and shall not convert a limited model evaluation into a claim of educational or medical effectiveness.

Article 24Complaints, investigation and procedural fairness

1. A person or authorised representative may complain to the deployer or competent authority without first obtaining technical evidence that only the supplier holds. Authorities shall provide accessible channels, acknowledge receipt, identify the applicable jurisdiction and communicate the process. People raising concerns in good faith shall receive protection against retaliation consistent with national law. Cross-border cases shall have a designated lead contact without depriving other competent authorities of their powers.
2. The authority may request relevant records, require a proportionate independent evaluation and order preservation of evidence, subject to lawful limits. A person or organisation under investigation shall receive notice of the alleged breach, a reasonable opportunity to respond and reasons for the decision. Urgent interim restrictions shall be reviewable promptly. Trade secrecy shall not prevent confidential regulatory examination or an intelligible explanation to an affected person. Disclosure procedures shall protect legal privilege, personal data and genuine security interests.

Article 25Remedies, sanctions and appeal

1. Where a breach is established, the authority may require corrective action, restrict or suspend a system, order notification to affected people and refer matters for remedies available under national law. A court or authorised tribunal shall determine compensation and other civil relief within its jurisdiction. Contract terms shall not exclude rights established by the adopting Act. Public bodies shall remain accountable through lawful institutional remedies and oversight of responsible officials.
2. Any administrative monetary penalty shall have an expressly enacted maximum and transparent criteria, considering harm, intent, duration, cooperation, remediation and ability to pay. This consultation draft deliberately leaves numerical maxima and criminal offences for national fiscal, constitutional and legislative scrutiny. EU euro amounts and turnover caps are not proposed as automatic regional penalties. Organisations shall receive reasoned decisions and an effective appeal. A sanction shall not be imposed retrospectively, and the same conduct shall be handled consistently with national rules against impermissible double punishment.

Article 26Commencement, existing systems and periodic review

1. An adopting jurisdiction shall publish a commencement notice identifying the duties that take effect and the authority responsible. The indicative sequence below is a proposal for planning from national commencement, not a statement of current law or a regional deadline. During transition, existing laws remain applicable and an authority may address an immediate serious danger through powers it already lawfully holds.
2. Existing high-risk systems shall be inventoried and assessed within a published transition period. A material modification after commencement shall trigger reassessment; legacy status shall not justify indefinite unsafe operation. The legislature shall require a review of outcomes, compliance costs and institutional capacity after the initial implementation period and at regular intervals thereafter. Amendments shall consider evidence from complaints, incidents and affected communities. Public reporting shall distinguish systems registered, systems independently evaluated, systems restricted and harms remedied so that administrative activity is not mistaken for protection achieved.