What is AI regulation in Trinidad and Tobago?
AI regulation: countries and regions
Trinidad and Tobago has no dedicated artificial intelligence statute. AI is governed indirectly by existing law: the partially proclaimed Data Protection Act 2011, the Computer Misuse Act, sector regulation and constitutional privacy rights. A national AI policy is in development through a National AI Assessment led by the Ministry of Public Administration and Artificial Intelligence with UNESCO and the UNDP. The country aligns with regional and international ethics instruments rather than binding AI-specific rules.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
AI regulation in Trinidad and Tobago is best understood as a work in progress built on borrowed foundations. There is no AI Act, no AI regulator and no risk-based classification scheme of the kind the European Union has adopted. Instead, anything an organisation does with AI is constrained by general laws that were written for other purposes: data protection, computer crime, telecommunications, financial services and the constitution.
The government has, however, signalled clear direction. As of 23 May 2025, documented in Gazette #81 and with Senator the Honourable Dominic Smith as Minister, the Ministry of Public Administration and the Ministry of Digital Transformation merged to form the Ministry of Public Administration and Artificial Intelligence, putting "Artificial Intelligence" in a ministry name for the first time. That ministry is now running a National AI Assessment with the United Nations Educational, Scientific and Cultural Organization (UNESCO) and the United Nations Development Programme (UNDP) to measure national readiness and to inform a future national AI policy.
So the honest picture is this: durable obligations today come from existing law, not from AI-specific rules. The AI-specific layer is at the assessment and policy-design stage, anchored in ethics frameworks and regional coordination rather than in enforceable statute.
Why it matters
For anyone deploying or buying AI in Trinidad and Tobago, the absence of a dedicated AI law is not the same as a legal vacuum. It means your AI risk is distributed across several older instruments, each with its own regulator, gaps and uncertainties. That makes compliance harder to map, not easier.
The data protection position is the sharpest example. The Data Protection Act 2011 is only partially in force, the Office of the Information Commissioner has long lacked a permanent appointee, and the enforcement provisions that would discipline automated processing have not been proclaimed. Organisations therefore cannot rely on a mature privacy regulator to set guardrails for profiling, automated decision-making or training-data use. The practical effect is that good AI governance in Trinidad and Tobago is largely voluntary and reputational today, backed by constitutional privacy rights, contract, consumer law and criminal offences rather than by a purpose-built AI rulebook.
For founders, advisers and policy leads, this also means the rules are likely to change. A national AI policy is being designed, the data protection law is under review, and a new cybercrime statute has repeatedly been proposed. Decisions taken now should anticipate a tightening regime rather than assume the current looseness will persist.
How it works
No dedicated AI statute yet
Trinidad and Tobago has not enacted an AI-specific law and has not adopted a horizontal, risk-based AI framework. There is no statutory definition of an "AI system" in domestic law, no mandatory conformity assessment, no high-risk classification and no AI regulator. This places the country among the many jurisdictions that govern AI through general law while policy work proceeds.
Data protection law and the Information Commissioner
The central instrument touching AI is the Data Protection Act 2011 (Chapter 22:04). It was only partially proclaimed: Legal Notice 2 of 2012 brought into force Part I and a limited set of Part II and Part III provisions, and section 42(a) and (b) were operationalised in August 2021. The bulk of the enforceable controller obligations and enforcement machinery remain unproclaimed. The Act sets out General Privacy Principles, including consent, purpose limitation, accuracy and security, and it establishes the Office of the Information Commissioner as the intended data protection authority. The Act does not grant rights such as data portability, erasure or a right not to be subject to solely automated decisions, and it does not require privacy by design. Penalties are capped at a fine of up to TTD 50,000 (around US$7,219) and up to three years' imprisonment on summary conviction, which is modest by international standards. A government review in 2018 found the Act inconsistent with international best practice, and stakeholder consultations followed in 2019, but the remaining sections have not been proclaimed. For AI specifically, this matters because the provisions that would most directly discipline profiling and automated processing are not in force.
Cyber and computer-misuse law
The Computer Misuse Act (Chapter 11:17) criminalises unauthorised access, interception, modification and misuse of computer systems and data. It is the live instrument that would apply to AI-enabled intrusion, scraping that involves unauthorised access, or model attacks. A Cybercrime Bill has been proposed repeatedly (2014, 2017 and reintroduced subsequently) to repeal and replace the Computer Misuse Act, but it has not been passed and has attracted sustained criticism from media and press-freedom groups over provisions seen as threatening journalism and legitimate security research. Until it passes, the Computer Misuse Act remains the governing cyber-offences law.
Constitutional and sector rules
The Constitution protects the right of the individual to respect for private and family life, which underpins privacy claims even where statute is incomplete. The Interception of Communications Act regulates lawful interception. Sector regulators also matter: the Telecommunications Authority of Trinidad and Tobago (TATT) regulates telecommunications and broadcasting, sets industry standards and manages spectrum, and the Central Bank of Trinidad and Tobago, with the Trinidad and Tobago Securities and Exchange Commission and the Financial Intelligence Unit, runs a Joint Regulatory Innovation Hub and a Regulatory Sandbox for financial technology, including provisional registration of electronic-money issuers. These sector mechanisms govern AI applications in finance and communications without naming AI.
The National AI Assessment and a future policy
The AI-specific policy layer is being built through the National AI Assessment, led by the Ministry of Public Administration and Artificial Intelligence (MPAAI) with UNESCO and the UNDP. It uses two methodologies: the UNDP AI Landscape Assessment (AILA) and UNESCO's Readiness Assessment Methodology (RAM), which operationalises UNESCO's Recommendation on the Ethics of Artificial Intelligence (2021). The assessment evaluates readiness across dimensions including governance, policy, infrastructure, ethics, institutional capacity and inclusion, and is intended to inform a national AI policy and strategy. The National Digital Transformation Strategy 2024-2027 commits to developing an "AI Policy Strategy" and to supporting the ethical use of emerging technologies, but treats AI as a priority within emerging technologies rather than as a standalone governance pillar.
Regional and international alignment
Trinidad and Tobago is not an adherent to the OECD AI Principles; OECD analysis has grouped it among countries needing significant effort to advance public-sector AI. Its alignment is instead regional and UN-centred. The country participates in CARICOM's digital agenda and the Single ICT Space, and is covered by the UNESCO Caribbean AI Policy Roadmap (2021), published with the Broadcasting Commission of Jamaica and developed through consultation with over 1,000 institutions and individuals across 20 Caribbean countries, structured on four pillars: Culture and Creativity, Governance and Transformation, Upskilling and Education, and Resilience and Sustainability. It also engages the Caribbean Telecommunications Union (CTU) Caribbean AI Task Force, launched on 18 July 2025 and chaired by Dr Craig Ramlal of The University of the West Indies, St. Augustine. That task force released its interim report, "Toward Harmonised AI Policies and Recommendations for the Caribbean," on 13 December 2025, drawing on more than thirty-five experts and a mandate approved at the CTU's 31st General Conference of Ministers in October 2025, and calling for a harmonised, CARICOM-wide AI governance framework that is human-centric, rights-based, inclusive and resilient, supported by model laws and shared oversight. At the hemispheric level, the Organization of American States (OAS) has adopted a declaration and launched an initiative on AI policy frameworks for the Americas. None of these instruments is binding AI law; they are soft-law and coordination frameworks.
Examples
Public-sector chatbots and service automation: Government digital initiatives have included chatbot and software development using AI for citizen services, run through bodies such as iGovTT under the digital transformation agenda. These deployments are governed by general public-administration duties and the partially proclaimed data protection principles rather than by an AI-specific assurance regime.
Fintech and automated financial services: A company seeking to deploy AI-driven or technology-enabled financial services, including electronic money, engages the Central Bank's Joint Regulatory Innovation Hub and Regulatory Sandbox, obtaining provisional registration and testing under regulator supervision. AI tools such as automated advisers fall within this financial-supervision perimeter rather than a dedicated AI law.
National readiness and policy design: Through 2025 and into 2026 the MPAAI ran stakeholder surveys, consultation sessions and a validation workshop at The University of the West Indies under the UNESCO RAM and UNDP AILA, feeding into a national AI policy. This is the workflow through which AI-specific rules are being shaped.
Common misunderstandings
"Trinidad and Tobago has an AI law." It does not. AI is currently governed by general law, and an AI policy is still in development.
"There is no privacy law, so AI use is unregulated." The Data Protection Act 2011 exists and parts are in force, the constitution protects private life, and other instruments apply. The problem is partial proclamation and weak enforcement, not total absence.
"The Office of the Information Commissioner is an active AI or privacy enforcer." The enforcement provisions of the data protection regime are not all in force and the office has faced long-standing appointment and resourcing gaps, so do not assume robust regulatory oversight of automated processing.
"The Computer Misuse Act has been replaced." The Cybercrime Bill has been proposed several times but not enacted; the Computer Misuse Act remains in force.
"Adhering to the OECD AI Principles is part of the national framework." Trinidad and Tobago is not an OECD AI Principles adherent. Its alignment runs through UNESCO, CARICOM, the CTU and the OAS.
Risks and boundaries
The single biggest boundary is legal uncertainty. The data protection regime is only partially in force, so the rights and obligations most relevant to AI, including automated decision-making, are not reliably enforceable. Treat the current state as transitional.
This page covers national AI governance architecture, not generic data-protection compliance detail, which belongs on privacy-specific pages. It also does not constitute legal advice or implementation design for any specific deployment.
Several items are pending or forward-looking and should not be presented as settled law: the national AI policy is in development, the Data Protection Act is under review, the Cybercrime Bill is unpassed, and the CTU task force's model-law recommendations are proposals. Verify current status before relying on any of these.
Finally, be cautious about secondary commentary that describes Trinidad and Tobago as having a comprehensive or GDPR-equivalent regime. It does not, and several widely cited summaries conflate the text of the 2011 Act with what is actually in force.
What to do next
Map your AI use to existing law first: data protection principles, the Computer Misuse Act, sector rules (financial services, telecommunications) and constitutional privacy. Do not wait for an AI Act to set baseline controls.
Adopt voluntary best practice now. Because enforcement is weak, governance is reputational and contractual. Apply purpose limitation, security, human oversight of consequential decisions and documentation as if a stricter regime applied, because one is being designed.
Engage the relevant regulator early where you operate in a regulated sector, especially the Central Bank's Innovation Hub and Sandbox for fintech.
Track three moving parts: the national AI policy emerging from the National AI Assessment, the review and possible replacement of the Data Protection Act, and the Cybercrime Bill. A change in any of these is the trigger to revisit your controls.
Watch regional instruments, particularly the CTU Caribbean AI Task Force outputs and CARICOM digital coordination, because harmonised model laws could shape future national obligations.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Trinidad and Tobago have an AI law?
No. There is no dedicated AI statute and no risk-based AI framework. AI is governed by general law while a national AI policy is developed.
Which law most affects AI today?
The Data Protection Act 2011 is the most relevant, but it is only partially proclaimed. The Computer Misuse Act governs computer-related offences and is fully in force.
Is there an AI or data protection regulator?
The Office of the Information Commissioner is the intended data protection authority, but the regime is only partially in force and the office has faced appointment and resourcing gaps. There is no dedicated AI regulator.
Who leads AI policy?
The Ministry of Public Administration and Artificial Intelligence, created in May 2025, leads, working with UNESCO and the UNDP on a National AI Assessment.
Is Trinidad and Tobago an OECD AI Principles adherent?
No. It aligns instead with UNESCO's ethics recommendation, CARICOM and CTU regional work, and OAS hemispheric initiatives.
What governs AI in finance?
The Central Bank, the Securities and Exchange Commission and the Financial Intelligence Unit, through fintech policy, a Joint Regulatory Innovation Hub and a Regulatory Sandbox.
Is a new cybercrime law coming?
A Cybercrime Bill has been proposed multiple times but has not been enacted. The Computer Misuse Act remains the governing law.
Will the rules change soon?
Likely. A national AI policy, data protection reform and cybercrime legislation are all in motion, so expect a tightening regime.