The AI Governance Stack: Principles, Policies, and Procedures for Caribbean Boards

Why Architecture Matters

Many Caribbean enterprises have responded to AI governance pressure by publishing a values statement or appointing a digital ethics champion. These are useful signals of intent, but they are not governance. Governance requires architecture — a layered, interlocking set of principles, policies, procedures, roles, and controls that together create the institutional conditions for accountable AI.

Dawgen Global conceptualises this architecture as the AI Governance Stack: four interdependent layers, each building on the one below, that together translate boardroom intent into operational reality.

 

The Dawgen Global AI Governance Stack

• Layer 1 — Principles: The ethical and strategic commitments that define the organisation’s AI posture

• Layer 2 — Policies: Board-approved rules and standards that operationalise principles

• Layer 3 — Procedures & Controls: The processes, tools, and oversight mechanisms that implement policies

• Layer 4 — Assurance & Accountability: The independent oversight, audit, and reporting functions that verify the stack is working

Layer 1: Principles — The Ethical Foundation

AI principles are the foundational commitments an organisation makes about how it will develop, deploy, and use AI. They are not aspirational marketing copy — they are governance instruments that should be adopted by the board, published publicly, and used as touchstones when specific AI decisions are contested.

Dawgen Global recommends that Caribbean enterprises structure their AI principles around five core dimensions:

Principle	Governing Commitment
Fairness	AI systems must not discriminate unlawfully or produce systematically biased outcomes across protected characteristics
Transparency	Those affected by AI decisions have a right to understand, in accessible terms, how those decisions were made
Accountability	Every AI system has a named human accountable for its performance and impact — no decision is orphaned to the algorithm
Safety & Reliability	AI systems are tested rigorously before deployment and monitored continuously in operation
Human Oversight	Consequential AI decisions are subject to meaningful human review, with clear escalation and override mechanisms

 

These principles should not be designed in isolation by a technology team. They require input from the board, senior leadership, legal counsel, HR, risk management, and — where appropriate — customer and community stakeholders. The process of developing principles is itself a governance act.

Layer 2: Policies — Translating Principle into Rule

Policies are the board-approved rules that translate principles into specific organisational requirements. They answer the question: given our principles, what must we do (and not do)? Effective AI governance requires a suite of interrelated policies, including:

• AI Use Policy — defining permitted and prohibited AI applications across the enterprise
• AI Risk Classification Policy — categorising AI systems by risk level and prescribing corresponding governance requirements
• Data Governance Policy — governing the collection, quality, retention, and use of data that trains and feeds AI systems
• AI Procurement & Vendor Management Policy — setting standards for the governance of third-party AI systems and AI-as-a-service providers
• AI Incident Response Policy — defining how the organisation identifies, escalates, and responds to AI system failures or adverse outcomes

 

Critically, AI policies must be integrated with — not siloed from — the enterprise’s existing governance policy framework. AI risk is enterprise risk; AI data governance is part of information governance; AI vendor management falls within the procurement risk framework. Siloed AI policies create inconsistency and gaps.

Layer 3: Procedures and Controls

Procedures and controls are the operational machinery through which policies are implemented. This is where governance becomes concrete and verifiable. Key control domains include:

AI Lifecycle Controls

Each stage of the AI system lifecycle — design, development, testing, deployment, monitoring, and retirement — should have defined control requirements. For high-risk systems, this includes mandatory ethical impact assessments prior to deployment, independent model validation, and documented sign-off by the accountable executive.

Model Risk Controls

Following established model risk management practices (such as the SR 11-7 framework used in financial services), organisations should maintain a model inventory, conduct regular model validation, and track model performance against defined metrics. Any material model changes should trigger re-validation.

Explainability Controls

For AI systems making consequential decisions — credit approvals, insurance underwriting, employee assessments — the organisation must be able to produce an intelligible explanation of any specific decision. Technical explainability (understanding what the model is doing) and communicative explainability (being able to explain it to a customer or regulator) are both required.

Monitoring and Drift Detection

AI models trained on historical data can degrade as the world changes around them — a phenomenon known as model drift. Controls must include ongoing performance monitoring, statistical drift detection, and defined thresholds that trigger human review or model retraining.

Layer 4: Assurance and Accountability

The top layer of the governance stack is assurance — the independent function that verifies the other three layers are operating as designed. This includes internal audit, external AI assurance review, regulatory examination, and board-level reporting on AI governance performance.

Effective AI assurance requires auditors with both governance expertise and sufficient technical literacy to assess AI controls meaningfully. This is a demanding combination — and one that Dawgen Global’s AI Assurance practice is specifically designed to provide.

AI governance without assurance is policy without verification. The board needs independent evidence that the governance stack is functioning — not just assurance that it exists on paper.

The Governance Committee Imperative

Caribbean boards should consider whether existing committee structures — typically Audit, Risk, and Remuneration — are sufficient to provide meaningful oversight of enterprise AI. Many organisations are establishing dedicated AI Governance Committees, or expanding the mandate of the Risk Committee, to include AI-specific oversight responsibilities. Board-level AI governance should address:

• Approval of the AI Risk Appetite and Classification Policy
• Receipt of periodic reports on AI system performance and incidents
• Oversight of the AI Assurance programme and findings
• Review of emerging regulatory requirements and their implications
• Executive accountability for AI governance performance

Next in the Series — Article 3: Algorithmic Accountability: Who Answers When AI Gets It Wrong?

About Dawgen Global