Industries · Public sector
AI in ministries, agencies and parastatals
A strategy without a statute, a master plan with a sovereignty pillar, and suppliers paid in ZiG. Public bodies are data controllers under the Act like everyone else; the difference is that their hosting choices are also a policy statement.
The policy frame
| Instrument | Status | What it contains | Binding on an enterprise? |
|---|---|---|---|
| National Artificial Intelligence Strategy 2026–2030 (Ministry of ICT, Postal and Courier Services) | Approved by Cabinet October 2025; launched by the President on 13 March 2026 | Pillars on talent, infrastructure and computational sovereignty, sectoral adoption, research and innovation, international engagement, governance and ethics; three phases (Foundation 2025–26, Scaling 2027–28, Maturation 2029–30); proposed National AI Council, AI Strategy Implementation Office and a National Digital Regulatory Committee; a POTRAZ-overseen regulatory sandbox; anchored on Zimbabwe's 2025 AI Readiness Assessment under UNESCO's methodology | No. A Cabinet-approved strategy creates policy direction, not legal obligations; no enabling legislation has been enacted |
| Smart Zimbabwe 2030 Master Plan (Ministry of ICT) | In force as national ICT plan | Pillars including Smart Government; programmes named in 2026 include a national digital identity system, a national e-government platform, a cybersecurity centre and data-centre investment | No; it directs government programmes |
| Cyber and Data Protection Act; SI 155 of 2024 | In force | Public bodies are expressly within the definition of data controller; licence tiers, DPO, notifications, s.25 automated decisions, s.28 transfers | Yes, on public bodies and their suppliers |
| Reserve Bank direction on ZiG-only payments to government suppliers | Announced March 2026 | Suppliers paid exclusively in ZiG; foreign currency for genuine import requirements via the willing-buyer willing-seller interbank market | Commercial reality for any vendor selling USD-priced cloud or model services to the state |
Three use cases with risk notes
- 01
Correspondence and service-request triage
Inbound letters, emails and portal requests are classified, routed and answered in draft for an officer who signs. Turnaround is measurable; the decision remains the officer's.
Risk notes. Citizens' personal data and often sensitive categories; in-country hosting aligns with both the Act and the strategy's sovereignty pillar; s.25 applies to any automated refusal; records-retention rules of the public body override the vendor's defaults.
- 02
Records digitisation and retrieval
Scanning, extraction and entitlement-filtered retrieval over registries, files and gazettes so officers find the record and its history with citations.
Risk notes. State data classification comes first; the index is a copy of records with the same protection level; access by role; no hosted-model embedding of state records; audit log for every retrieval.
- 03
Anomaly detection in registries and revenue
Models flag inconsistent registrations, duplicate beneficiaries or unusual declarations for an auditor or inspector to examine.
Risk notes. A flag must not become a penalty without a person and an appeal (s.25); bias review across regions; the model register and validation discipline borrowed from the RBZ standard even where no financial regulator applies; procurement must cover forex for any USD-priced component under ZiG payment rules.
What to do before the statuteThe strategy signals where regulation is heading: governance bodies, a sandbox, ethics grounded in Ubuntu. A public body that builds the register, the DPO function and the s.25 decision inventory now will meet a future AI Act with paperwork instead of a programme. See what the strategy means for a CIO. For policy tracking and adoption data across the country, the network's research publication is zimbabweai.co.zw.
Sources
- UNESCO (25 March 2026) — Zimbabwe launches National Artificial Intelligence Strategy
- TechAfrica News (16 October 2025) — Cabinet approves the National AI Strategy 2026–2030
- OECD.AI — Zimbabwe National Artificial Intelligence Strategy 2026–2030 (pillars, phases, governance bodies); Strategy text via Veritas
- African Law Matters (27 July 2026) — Strategy Without Statute
- Ministry of ICT — Smart Zimbabwe 2030 Master Plan; Tech Review Africa (13 June 2026) — programmes under Smart Zimbabwe 2030
- The Zimbabwean (17 March 2026) — RBZ on ZiG-only payments to government suppliers
- Data Protection Act, Act 5 of 2021 — s.3 (definition of data controller includes public bodies), s.25, s.28