The Caribbean AI Risk Index

CARI's risk domains map onto the MIT AI Risk Repository (Slattery et al., 2024) taxonomy; its risk framing follows the NIST AI Risk Management Framework; its construction follows the OECD/JRC Handbook on Composite Indicators; its readiness logic inverts the IMF AI Preparedness Index and Oxford Insights Government AI Readiness Index; and its labour-exposure coefficients derive from the ILO's occupational GenAI-exposure research (Gmyrek et al., WP96/WP140). Input data are drawn from the ITU, UN DESA, the World Bank, Oxford Insights, the ILO, the WTTC, DataReportal, the IMF, INSEE, national legislation records, and the peer-reviewed psychology literature; the full source register with document-level citations is held in the project archive and is available on request.

• Formula: CARI = 100·√((E′/100)·(F′/100)), where E = mean of the three exposure pillars, F = mean of the two fragility pillars, and p′ = 1 + 0.99p. The composite is then stretched so the regional minimum and maximum sit at 20 and 88. The stretch changes nothing about ranks or tiers; it makes the differences between countries visible. Integer scores only, since decimals would be false precision at this sample size.
• Tiers are set at quintiles of the observed score distribution and labelled in explicitly relative language. There is deliberately no “Severe” tier.
• Missing data is never silently imputed: pillar weights are redistributed, the redistribution is disclosed, and each country carries a data-coverage percentage, a confidence grade (A≥85%, B 65–84%, C<65%), and a provisional flag where an anchor indicator is absent.
• Sensitivity: exposure/fragility weight tilts of ±25% and an alternative arithmetic aggregation are re-run, and each country's resulting rank range is published in its profile.
• Simulation: 1,000 Monte Carlo draws perturb every continuous input by a uniform ±10% and move every ordinal coding one step with probability 0.25, then recompute the full pipeline, normalisations included. The 10th–90th percentile of the simulated score distribution is published in each profile as the simulated score interval; these stored ranges describe the reported perturbation exercise, not confidence intervals or probabilities of future harm. Seeds, draws and generating code are still needed to verify them.
• Scored with coverage flags: ransomware leak-site listings, normalised per million population, enter the threat pillar. Where regional monitoring explicitly obtained no data for a state, the input is recorded as missing rather than zero and the pillar weight is redistributed.
• Deliberately unscored: broader cyber incident narratives (they track disclosure rather than safety), election-cycle AI incidents (calendar effects), and psychosocial impacts (no Caribbean-level evidence yet). All three appear as documented context instead.

The original page reports review from seven disciplinary perspectives. The underlying review records have not been inspected. These are historical claims, not verified external peer review. The narrative says tourism was removed from labour exposure, but the released metadata retains a 0.22 tourism coefficient. The original calculation records are needed to resolve that conflict. Psychosocial information is unscored. Geometric aggregation and the separate extreme-fragility flag must not be conflated.

Independence disclosure: Maestro AI Labs provides commercial AI services in the region; the Caribbean Artificial Intelligence Association is a membership advocacy body. No government paid for, reviewed, or influenced any score. The displayed outputs and descriptive method are public; full computational reproducibility has not yet been established. Corrections are welcome and will be logged publicly.

• Scores are relative within the Caribbean. “Comparatively Lower” does not mean low risk in absolute terms, and “Very High” is a regional comparison rather than a condemnation.
• Small-state statistics gaps are real: several microstates lack ILO labour estimates, and regional cyber monitoring explicitly obtained no data for five countries. Coverage grades disclose this; they cannot cure it.
• Composite indices cannot capture everything. Haiti's crisis dynamics and Cuba's state-controlled information environment both exceed what public indicators measure, and both carry explicit caveats.
• Tourism figures mix WTTC reference years (2022–2024); Guyana's income statistics are oil-distorted; both are flagged where used.
• Version 2.0 added cybercrime-legislation status, AI-literacy provision, verified public investment, the domestic expertise base, Herfindahl–Hirschman diversification, per-capita ransomware incidence, and the Monte Carlo simulation. The remaining roadmap covers government-domain email-security (DMARC/DNSSEC) scans, FIRST CSIRT membership, financial-fraud readiness (CFATF), Creole-language AI exclusion, data-sovereignty indicators, and a Caribbean youth psychosocial study, which is CAIA's standing research call.
• Montserrat is a full CARICOM member but a UK overseas territory, so it is not scored as a sovereign state; territories (Puerto Rico, USVI, Cayman, Aruba, Curaçao, Martinique, Guadeloupe and others) are governed under US/EU/UK/Dutch AI and data frameworks and are outside a sovereign-policy index.