CAIRMC AI Risk Repository
The Caribbean AI Risk Register
A structured, searchable register of 522 artificial intelligence risks, each described with its mechanism, its root cause, and the first control CAIRMC recommends. Every entry is classified against the seven-domain taxonomy established by the MIT AI Risk Repository, and then placed where it actually lands: in a sector, in a jurisdiction, at a level of severity and likelihood that a Caribbean board or ministry can act on.
522
Risks catalogued
7
Risk domains
24
Subdomains
20
Sectors covered
How to read this register
Each risk is classified twice. The causal taxonomy records how the risk comes about. The domain taxonomy records what the harm is. A risk can be serious without anyone intending it, and most of the entries below are of exactly that kind.
Causal taxonomy
Entity
Whether the risk is brought about by a person, by the AI system itself, or by something else, such as a shared environment or an unowned market dynamic.
Causal taxonomy
Intent
Whether the harmful outcome was a deliberate objective, an unintended side effect, or neither. Most institutional AI harm is unintentional.
Causal taxonomy
Timing
Whether the risk arises before the system is put into use, during training, procurement, and design, or after it has been deployed and is in service.
The seven domains
Select a domain to filter the register to it.
Severity profile
The register
Filter by domain, sector, jurisdiction, severity, and cause.
522 risks
Page 1 of 21
1–25 of 522
Method, and what this register is not
The domain and causal taxonomies are those of the MIT AI Risk Repository, a meta-review that consolidated more than 1,600 risks from dozens of published frameworks into a single structure. We have adopted it deliberately rather than inventing a Caribbean scheme, because a region with limited regulatory capacity gains more from speaking the same language as the rest of the field than from having a taxonomy of its own.
What CAIRMC has added is the part a global repository cannot carry. Every entry names the industries in which the risk actually lands, the jurisdictions where it is most acute, and a root cause written in terms of the mechanism rather than the symptom. Entries marked region-wide apply across CARICOM and appear under every jurisdiction filter. Severity and likelihood are CAIRMC assessments of regional exposure, not vendor claims and not incident counts.
This register is not a compliance checklist, and clearing every control listed here would not make an organisation compliant with any particular statute. It is a starting inventory: the set of things a Caribbean board, ministry, or regulator should be able to say it has considered. The right use is to filter to your sector and jurisdiction, take the entries at critical and high severity, and ask what evidence exists that each one is being managed.
The register is maintained as a living document. Corrections, additional risks, and regional incident evidence are welcome, and are the fastest way to make it better.
Turn the register into a control set
The Caribbean AI Risk Management Standard sets out how to assess, treat, and evidence these risks in a Caribbean organisation. Our certification programme trains the people who will have to do it.