Introduction to
AI Risk Management

Let me tell you why this course exists. Across the Caribbean, artificial intelligence is already inside our banks, our hospitals, our classrooms, our call centres, and our government offices. Staff are using it whether or not anyone signed off on it. The tools are powerful and genuinely useful. They are also capable of quiet, expensive mistakes, and almost no one in the region has been taught how to spot those mistakes before they cause harm.

This course closes that gap. It is written for the ordinary professional, the manager, the public servant, the small business owner, the student. You do not need to code. You do not need mathematics. You need about two hours and a willingness to think clearly about a technology that is not going to slow down for us.

Work through the modules in order. Every lesson has something to click, drag, or try, because you learn governance by doing it, not by reading about it. At the end there is a thirty-question exam. Pass it with eighty percent and you earn a certificate signed by me, on behalf of the Association.

Risk is not the same as danger, and it is not a reason to be afraid. In every serious profession, risk simply means the chance that something goes wrong, multiplied by how badly it would hurt if it did. A bank manages credit risk without refusing to lend. A pilot manages flight risk without refusing to fly. AI risk management works the same way. The goal is never to ban the technology. The goal is to capture its value while keeping the harm to a level you can live with.

So what could go wrong with AI? Broadly, three families of harm. The system can be wrong, confidently and invisibly. The system can be unfair, treating some people worse than others. And the system can be misused, leaking private information or being turned to a purpose no one intended. Good risk management is the discipline of finding those failures before your customers, your regulator, or the evening news finds them for you.

Notice the pattern. None of these professionals eliminate risk. They name it, measure it, and put controls around it so the benefit can flow safely. By the end of this course, AI will be one more risk you know how to handle, not a mystery you hope will behave.

You cannot manage a risk you cannot see, so the first real skill is knowing where to look. The most respected map of AI risk in the world comes from MIT. Their AI Risk Repository reviewed seventy-four separate frameworks and pulled more than seventeen hundred documented risks into a single structure. They found that almost every AI risk falls into one of seven domains. Learn these seven and you have a checklist you can run against any AI system, anywhere.

Of the seven domains, two will land on your desk before any of the others. The first is bias. An AI system learns from data, and data is a photograph of the world as it was, unfairness included. Train a hiring tool on twenty years of a company's decisions and it will learn to prefer exactly the people that company already preferred. The machine is not being cruel. It is being obedient to a past we are trying to move beyond. That is why bias is a design and data problem, not a personality flaw in the software.

The second is hallucination. Generative AI does not look up facts. It predicts convincing text. Most of the time convincing and correct line up. Sometimes they do not, and the system will state a false thing with the same calm confidence it uses for the truth. It will invent a court case, a citation, a statistic, a policy clause. It does not know it is wrong, because it does not know anything in the way you do. Your job is to never let a confident answer skip the step of being checked.

Now connect the harm to the fix. For every AI risk there is a practical control, and controls are where risk management stops being theory. Match each risk below to the control that most directly tames it.

Two risks deserve special attention in our region because our circumstances sharpen them. The first is vendor risk. Very few Caribbean organisations build their own AI. We rent it from a handful of foreign giants. That is sensible, but it creates concentration risk. If a single provider changes its price, changes its terms, suffers an outage, or is cut off by an export rule in its home country, your operation can stop with no fallback and no warning. This is not hypothetical. Boards elsewhere have already been surprised by a model they depended on going dark overnight.

The second is privacy. AI is hungry for data, and the fastest way to leak your organisation's secrets is for a well-meaning employee to paste a confidential document into a free public chatbot to summarise it. That data has now left your control. Several Caribbean nations, Jamaica, Barbados, Trinidad and Tobago among them, have Data Protection Acts, and AI does not create an exemption from them. If personal data is involved, local privacy law still applies in full, on top of any AI-specific care you take.

You do not need to invent AI governance from scratch. Serious people have already built the rulebooks, and you only need to understand a few. The most useful starting point is the NIST AI Risk Management Framework, published by the United States National Institute of Standards and Technology. It is voluntary, free, respected worldwide, and refreshingly practical. It organises all of AI governance into four simple functions.

Read them as a loop, not a ladder. You govern always, you map a system, you measure its risks, you manage them, and then you keep going round as the system and the world change. Hold these four verbs in your head and you can walk into any AI project and know what questions to ask.

Risk also enters at specific moments in an AI system's life. Tap through the lifecycle below to see where.

If NIST is the friendly coach, the European Union's AI Act is the referee with a whistle. It is the world's first comprehensive AI law, and its big idea is beautifully simple. It does not regulate all AI the same way. It sorts every AI system into one of four tiers based on how much risk it poses to people, and the rules get stricter as the risk rises.

At the top sits unacceptable risk, which is simply banned, things like government social scoring of citizens. Below that is high risk, where the system affects people's rights or safety, such as deciding loans, jobs, or medical care. These are allowed but tightly controlled. Then limited risk, which mostly means you must be transparent, for example telling people they are talking to a bot. And at the bottom, minimal risk, the vast majority of everyday AI, which is left largely free.

One more thing worth knowing. The Act has real teeth. Breaching the banned-practice rules can cost up to thirty-five million euros or seven percent of a company's global annual turnover, whichever is larger. Governance is cheaper than the fine.

Three more instruments complete the picture, and none of them require you to be a lawyer. The UNESCO Recommendation on the Ethics of Artificial Intelligence, adopted in 2021, was the first global standard on AI ethics, agreed by nearly two hundred countries. It is not a binding law, but it is the shared moral floor, built on human rights, human dignity, transparency, fairness, and human oversight. When you need to explain why governance matters beyond avoiding fines, UNESCO gives you the language.

ISO/IEC 42001 is the newest piece. It is an international management-system standard for AI, the same family as the quality and security standards many Caribbean firms already hold. It turns good intentions into a certifiable, auditable system. You do not need it on day one, but it is the destination a maturing programme walks toward.

And closest to home, your own national Data Protection Act. This is the one with actual legal force over you today. Whatever else you do, your handling of personal data through AI must satisfy local law. Start there.

Here is the uncomfortable truth that separates real governance from a poster on the wall. Accountability cannot be given to a machine, and it cannot be given to a vendor. When an AI system causes harm, a regulator, a customer, or a court will ask a human being why, and the answer cannot be that the computer decided. Every meaningful AI system in your organisation needs a named human owner, and your board or senior leadership must own the oversight of the whole.

How big is this gap in our region? A 2026 PwC survey of Caribbean directors measured it, and the numbers are sobering.

Read those first two numbers again. More than ninety percent of directors in our region know they are not giving AI the attention it needs. That is not a failure of intelligence. It is a failure of process, and process is exactly what you are learning to build. When something does go wrong, and eventually something will, the organisations that cope are the ones with an incident response plan. Put these steps in the right order.

If you take only one practical instrument from this whole course, take the AI risk register. It is not software and it does not need to be. It is a living list of every AI system you use, the risks each one carries, how severe they are, who owns them, and what control is in place. A spreadsheet is enough to start. The power is not in the format. The power is in making invisible risk visible, owned, and reviewed on a schedule, exactly the way your finance team already treats money.

Work the decision below. It is the kind of judgement a risk register is built to support.

You now know more about AI risk than most people sitting on Caribbean boards. The last question is what to do with it. You do not need a budget, a consultant, or permission to begin. Here is a plan any organisation can run in three months.

Days 1 to 30: See what you have

Make a simple inventory of every place AI is already being used in your organisation, official or not. Ask people honestly; you will be surprised. Write a one-page AI use policy in plain language that says which tools are approved and the golden rule that no personal or confidential data goes into public tools. That two-document start already puts you ahead.

Days 31 to 60: Name owners and risks

For each AI system on your inventory, name a human owner and open a row in a risk register. Run the seven domains against it and write down the two or three risks that actually apply. Decide one control for each. Keep it light and real rather than perfect.

Days 61 to 90: Set the rhythm

Put AI risk on a recurring agenda, monthly for the working team, quarterly for leadership. Draft a five-line incident response plan. Pick one high-stakes system and add a human review step. Governance is not a project you finish. It is a habit you keep, and after ninety days you will have the habit.

Thirty questions drawn from everything you have covered. Score eighty percent or higher to earn your certificate. You can retake it as many times as you like, and every question has an explanation so a wrong answer is still a lesson.