When the framework doesn't fit: AI governance for the rest of the world

Every country in the world is trying to figure out artificial intelligence governance. The model most nations look to first is the EU AI Act as it is the most detailed, ambitious and increasingly treated as the global benchmark. 

But it was built for countries with dedicated regulators and assessment bodies, and most countries do not have any of these — including mine. 

I lead the AI and intelligence strand of the Cayman Islands' National Digital Transformation Strategy Taskforce and have spent the past few years learning what AI governance looks like when building it in a jurisdiction of 89,000 people with a small civil service and no dedicated regulator.

It looks nothing like the frameworks coming out of Brussels or Washington, D.C., as the global conversation about AI governance is being shaped by and for countries that already have the machinery to implement it. The rest of us are expected to follow rules we had no hand in writing, using infrastructure we do not have. According to the United Nations' Governing AI for Humanity 2024 report, 118 countries, predominantly in the Global South, remain entirely absent from significant international AI governance initiatives across seven major non-UN AI governance initiatives. In other words, most of the world is left out.

On 7 May 2026, the European Parliament and Council reached a provisional agreement to delay the application of high-risk AI obligations to 2 Dec. 2027 for stand-alone systems, and to 2 Aug. 2028 for those embedded in regulated products. Many member states missed the deadline to appoint competent authorities, and only 8 of 27 had designated single points of contact. Even the EU's own AI Board fell behind on issuing the guidance organizations need to understand their obligations. If Europe is struggling to implement its own framework on schedule, we should be honest about whether this model can be exported to jurisdictions with a fraction of those resources.

In the Cayman Islands, we face every AI risk that larger jurisdictions face. Our financial services sector processes globally significant transactions and our residents use the same platforms and automated decision-making systems as people in London or New York. The difference is not in our exposure to risk; it is in the institutional capacity in which we must respond. 

Rather than this being a blockage, it forced us to think differently. Rather than trying to build a standalone AI regulator, which would be illogical at our scale, we are looking to embed governance within existing regulatory structures. The Cayman Islands' financial services regulator already understands risk-based frameworks and its Office of the Ombudsman already manages cross-border compliance. Therefore, the question for us is not whether to create new institutions but how to equip the ones we have with the knowledge and tools to handle AI-specific risks.

I have also heavily invested in international networks. I am building a peer network connecting the Cayman Islands to the U.K.'s former government chief technology officer, leadership at AI Singapore and Malta's National AI Coordinator, and the team at the Digital Isle of Man, among other global experts. Their models of educating the nation first and governing flexibly gave us both direction and confidence. The governance structures already executed by small jurisdictions show how smaller countries can adapt rather than trying to build from scratch.

What I have learned is that many small countries prioritize AI literacy and education before regulation on the basis that regulation without understanding does not produce genuine protection. I also believe in building stakeholder engagement before policy, because policy without buy-in creates upheaval and distrust. And small jurisdictions have something that gets overlooked: speed. Agility is often a serious advantage in practice. In Cayman, we can get every relevant decision-maker in one room, and we can pilot an approach, test it and iterate within months.

The EU allocated roughly 1 billion euros for the enforcement and implementation of the AI Act and still fell behind. Smaller jurisdictions that can quickly test frameworks and adapt in real time have something to contribute to this conversation — not just as recipients of guidance from larger authorities, but as sources of practical evidence about what works and, just as importantly, what does not.

I truly believe small states should not be an afterthought. They should be treated as testing grounds for new approaches to governance, not as implementation problems to be solved once the major frameworks are done. Capacity building for smaller nations needs to be funded properly. The UN Global Dialogue on AI Governance, established under Resolution 79/325, is a promising step, but promises need resources behind them. International standards need to be designed for all nations from the start, not adapted later for countries that do not fit the original template.

I am currently developing a proposal for an international summit on AI governance for smaller nations — not because we need a separate conversation, but because the mainstream one has yet to address the reality that most of the world faces. We are not asking for a lower standard; we are looking for a different route to the same destination. And the countries working this out with the fewest resources may end up writing the playbook everyone else needs.