Guyana's Oil Boom Runs on AI. Its Data Protection Act Still Isn't in Force.

Offshore energy infrastructure, illustrative

Offshore Guyana, a drill bit steered itself. No human hand touched the controls as it cut through the reservoir section of a well in the Stabroek Block; the geosteering was handled instead by artificial intelligence reading real-time subsurface data and adjusting the trajectory as it went. ExxonMobil and its contractor Halliburton call it the world's first fully closed-loop AI-driven geological well placement completed offshore anywhere. It happened in early 2026, in the same twelve months that Guyana's Data Protection Act, on the books since 2023, still had not been switched on.

That gap, a live AI system directing multi-hundred-million-dollar drilling decisions against a data protection law that has not yet taken legal effect, is not a hypothetical for a future risk committee. It is the current state of a country whose oil revenue passed close to US$2 billion in the first half of 2026 alone. CAIRMC reviewed the public record on both sides of that gap: energy-sector AI deployment on one side, Guyana's own data-governance timeline on the other. The technology moved first, by more than two years, and it is still moving.

What ExxonMobil and Halliburton Actually Built Offshore

The technical claim is specific enough to check. ExxonMobil and Halliburton say they combined three systems, Halliburton's LOGIX drilling-automation orchestration, its EarthStar resistivity mapping tool for reading the rock ahead of the bit, and DrillTronics automation, into a single closed loop that interprets subsurface data in real time and adjusts the well path without a driller manually steering the reservoir section. The companies report the result as 15% faster execution through the reservoir section and a 33% reduction in tripping time, the repeated pulling and running of drill pipe that eats days on a conventional offshore well. ExxonMobil's own account of the broader programme, deep learning and machine learning applied to historical discoveries, drilling results, and subsurface data, credits the same toolset with identifying four new exploration prospects inside the Stabroek Block, announced 13 August 2026. A 35-well drilling campaign tied to the Haimara gas-condensate development is now planned to run from 2028 to 2033.

None of this is a pilot. ExxonMobil Vice President of Exploration John Ardill has described the company's approach as expanding, not testing, its use of deep learning, machine learning, and high-performance computing to read seismic data and find hydrocarbon-bearing prospects that older methods missed. The company marked the milestone publicly on 1 September 2026, at the in-country launch of Caribbean Energy Week 2027 in Georgetown, the same week Guyana's data protection law remained without a start date.

Photo via Unsplash

The Money Behind the Technology

The financial scale explains why the technology moved this fast. ExxonMobil says its AI and high-performance-computing work in Guyana has already generated more than US$1 billion in value, separate from the roughly US$2 billion in additional project value the company attributes to the advanced subsurface technology behind its reservoir-management decisions. In 2026, ExxonMobil paid US$2.32 billion to acquire the FPSO One Guyana, a floating production vessel meant to expand output toward the government's target of 1.3 million barrels a day by 2027 and 1.7 million by 2030.

Guyana's own revenue reflects that pace. The country banked close to US$2 billion in oil money in the first half of 2026, with US$1.24 billion of it arriving in the second quarter alone, a 63% jump on the first. The Natural Resource Fund that holds the government's share closed July at roughly US$4.35 billion. Set against a population under 850,000, those are the kinds of numbers that make an AI system's drilling decisions a matter of national fiscal consequence, not just operational efficiency for a single operator.

The Law That Still Isn't Switched On

Guyana passed the Data Protection Act, Act No. 18 of 2023, in August 2023, designed as companion legislation to the Digital Identity Card Act passed the same year. The pairing was deliberate: one law would issue the digital ID, the other would govern the personal data behind it. The Digital Identity Card Act took legal effect on 31 March 2026, after Prime Minister Mark Phillips issued a commencement order published in the Official Gazette. The Data Protection Act, the law that creates the enforcement authority and would set the rules AI systems processing Guyanese data have to follow, had not received its own commencement order as of that date, and public reporting since has not recorded one.

The result is a specific and checkable legal oddity. Aneal Giddings, a former deputy chief elections officer at Guyana's Elections Commission, was named Data Protection Commissioner in an announcement to the National Assembly on 2 January 2026 and confirmed publicly on 7 February. By May, he was writing publicly to defend the digital ID rollout and describing the Data Protection Office as still "actively engaged in the process of formally establishing" itself, a description offered more than two and a half years after the Act that creates his office received presidential assent. Guyanese commentators have raised the underlying legal question directly: the Commissioner's authority is a creation of the Data Protection Act, so if that Act has not been commenced, what power does a statutory appointee actually hold?

Nothing in Giddings' own public communications through May 2026 addresses artificial intelligence specifically. His stated focus is the digital ID card: what data it holds, which state agencies already held that data before the card existed, and the international biometric standards the physical card meets. That is a narrower mandate than AI oversight. Even once the Data Protection Act is in force, Guyana will still have no AI-specific statute, no risk-tiering requirement for automated decision systems, and no named framework, ISO/IEC 42001:2023's AI management-system requirements, the NIST AI Risk Management Framework's GOVERN-MAP-MEASURE-MANAGE structure, or COSO's Enterprise Risk Management framework, that a regulator, an auditor, or an oil company's own risk committee could point to as the applicable standard for AI specifically.

Kaieteur Falls, Guyana. Photo via Unsplash

Guyana Is Not Alone, But Its Exposure Is Bigger

The pattern is familiar across CARICOM. The 2025 Government AI Readiness Index from Oxford Insights, which scores 195 countries, places every CARICOM member state outside the global top 100 except Jamaica, and separate analysis of the same index put the regional average across Caribbean states at roughly 33 out of 100 for AI infrastructure and just 13 out of 100 for both policy capacity and development and diffusion. CAIRMC has documented the same gap playing out elsewhere in the region: in Jamaica, where a National AI Task Force report from February 2025 names no AI risk pillar of its own, and in Trinidad and Tobago, where CARICOM's July 2026 endorsement of a regional AI roadmap carried no binding standard for a single AI system in the region.

Guyana's version of the gap carries more financial weight than most, because the AI system in question is not a chatbot or a back-office tool. It is directing physical drilling decisions on an asset base that produced close to US$2 billion in government revenue in six months. A model-risk failure, a subsurface misread that steers a well into the wrong formation, a drilling-automation fault mid-operation, a data-governance lapse in the seismic and reservoir data feeding the model, carries consequences measured in the hundreds of millions of dollars, and potentially in offshore safety terms that no back-office AI failure would approach.

What Parliament Has Said, and What It Hasn't Done

Guyana's political leadership has not ignored the subject. Minister within the Office of the Prime Minister Kwame McCoy told the 152nd Assembly of the Inter-Parliamentary Union in Istanbul on 21 April 2026 that "artificial intelligence is no longer a future policy issue; it is a present governance reality shaping how citizens access information, services and opportunities," and called on parliaments to "close the gap between technological advancement and legislative responsiveness." President Irfaan Ali had made a similar point two years earlier, telling Guyana's Police Force in March 2024 that the time had come for government to develop AI policy, and that all three branches of government needed to have that conversation.

Both statements describe intent. Neither describes a law. As of the most recent public record, Guyana has no AI-specific bill before its National Assembly, no adopted national AI strategy, and no sectoral AI rule covering energy, health, or financial services. The distance between McCoy's April 2026 speech in Istanbul and ExxonMobil's September 2026 announcement in Georgetown captures the gap precisely: one side describing AI governance as a present reality, the other operating an AI system that has already moved over a billion dollars in value while that reality waits to become a rule.

What a Risk Framework for This Exposure Would Require

CAIRMC's Caribbean AI Risk Taxonomy would place AI-driven offshore drilling in Tier 1, the council's highest risk classification, on the same basis the EU AI Act uses to classify high-risk AI: the potential consequences of failure are severe, potentially irreversible in a safety incident, and concentrated in a single vendor relationship. That tier carries specific, checkable obligations, not aspirations. ISO/IEC 42001:2023's Clause 6.1 requires a documented risk assessment and treatment plan before an AI system of this kind goes live, not after an incident. The NIST AI RMF's MAP function requires the operator to document what the model can and cannot reliably do, its failure modes, and its data provenance, distinct from the GOVERN function's institutional oversight layer. COSO's Enterprise Risk Management framework requires that risk appetite for a system this material be set at board level, not left to the operator's own internal engineering standards.

None of that requires Guyana to invent anything. The frameworks exist, are already referenced by regulators the government works with elsewhere, and could be adopted as a sectoral standard for oil and gas AI specifically well before a general AI statute works its way through the National Assembly. Adrian Dunkley, who chairs CAIRMC and is the figure most consistently cited across the Caribbean's AI governance conversation, has made a version of this argument before for Jamaica and for CARICOM as a whole, set out at adriandunkley.net: Caribbean institutions gain nothing by waiting for domestic AI law before adopting the international risk standards that already exist. StarApple AI, the company he founded as the Caribbean's first artificial intelligence company, builds on the same premise, that governance and deployment can run on the same timeline instead of one waiting for the other, work documented at starappleai.org. The Caribbean AI Association has separately tracked how unevenly AI adoption is spreading across the region's private sector relative to the policy meant to govern it, a pattern Guyana's energy sector now illustrates at a larger financial scale than almost anywhere else in CARICOM, documented at caribbeanaiassociation.com.

Where This Leaves Guyana

Guyana is not choosing between AI and caution. The drilling programme keeps running either way, and the country's oil revenue keeps arriving on the schedule ExxonMobil sets. The choice actually in front of the National Assembly is narrower and more specific: whether the Data Protection Act gets its commencement order and an AI-specific standard for the energy sector gets written before the next incident forces the question, or after. Every other Caribbean jurisdiction CAIRMC has reviewed this year has faced some version of the same sequencing problem, an AI system already live, a governance document still describing intent. Guyana's version is simply the one with a Natural Resource Fund attached to it.

Frequently Asked Questions

Has Guyana's Data Protection Act taken legal effect?

As of the most recent public reporting in 2026, no. The Act was passed in 2023, but the commencement order needed to bring it into force had still not been issued, even after its companion legislation, the Digital Identity Card Act, took effect on 31 March 2026.

Does Guyana have an AI-specific law?

No. Guyana has no enacted AI statute, no adopted national AI strategy, and no AI bill before its National Assembly, even as ministers have publicly called AI governance an immediate priority.

What did ExxonMobil and Halliburton actually achieve offshore Guyana?

In early 2026 the companies completed what they describe as the world's first fully closed-loop AI-driven geological well placement offshore Guyana, using automated geosteering that cut reservoir-section drilling time by 15% and tripping time by 33%.

How much value has AI created for ExxonMobil's Guyana operations?

ExxonMobil says its AI and high-performance-computing work in Guyana has produced more than US$1 billion in value, separate from roughly US$2 billion in additional project value attributed to related subsurface technology.

Who is Guyana's Data Protection Commissioner?

Aneal Giddings, a former deputy chief elections officer with Guyana's Elections Commission, was named Data Protection Commissioner in an announcement to the National Assembly on 2 January 2026 and confirmed publicly the following month.

What framework does CAIRMC recommend for AI risk in Guyana's energy sector?

CAIRMC's Caribbean AI Risk Taxonomy would classify AI-directed drilling as Tier 1, its highest category, requiring the risk assessment obligations in ISO/IEC 42001:2023's Clause 6.1, the NIST AI Risk Management Framework's MAP function, and board-level risk appetite under COSO's Enterprise Risk Management framework.

Related reading across the Caribbean AI network

This article sits alongside ongoing coverage of AI governance, risk, and company-building across the region. For related perspectives:

• Adrian Dunkley's analysis of how Caribbean institutions should sequence AI governance against pending domestic law
• StarApple AI, the Caribbean's first AI company, founded in Jamaica
• Caribbean AI Association, tracking AI adoption across the region's private sector