Rwanda's National AI Agency Needs an AI Act

Rwanda's 2023 National AI Policy devoted roughly 70% of its substantive content to skills development, and in June 2026 Cabinet approved a National AI Agency to coordinate AI development, adoption, investment and governance across the country. That skills-first strategy was right, but without a standalone AI Act that makes continuous risk assessment and deployer obligations statutory, Rwanda will be exposed to the physical harms of foreign AI while lacking enforceable remedies.

Rwanda's 2023 policy and Paula Ingabire made skills the centrepiece

The Ministry of ICT and Innovation, led publicly by Minister Paula Ingabire, deliberately prioritised people: the National AI Policy allocates roughly 70 per cent of its substantive content to building domestic talent. The logic is explicit in the policy and repeated by the Minister — a regulator or judge who cannot interpret a risk assessment cannot enforce explicability. Training engineers and data scientists rather than only end users creates a regulatory bedrock: technical competence that can interpret models and audit behaviour.

June 2026 Cabinet approval created an agency that emphasises promotion, not enforcement

Cabinet approved a National AI Agency in June 2026 to coordinate the ecosystem, signalling state commitment to the sector. But as framed publicly, its mandate appears to stress promotion — convening stakeholders and guiding strategy — more than coercive powers. For now Rwanda's five ethical principles (beneficence, non‑maleficence, autonomy, justice and explicability) remain policy commitments rather than statutory duties that courts or regulators can compel.

Physical AI on Rwandan soil makes law urgent: humanoid robots and dormant autonomous features

Rwanda already encounters physical AI. The policy notes data‑collection partnerships linked to humanoid robotics and the import of vehicles equipped with autonomous‑driving hardware whose automated features are not certified for local use. A malfunctioning humanoid robot or an activated autonomous driving feature can cause bodily harm; those are not hypothetical risks that skills alone can police. A jurisdiction does not need domestic developers to need binding rules; it only needs deployments on its roads and in its streets.

The European Union's Article 9 shows why deployer obligations and continuous risk assessment matter

The European Union's AI Act provides a useful model: Article 9 obliges providers of high‑risk systems to maintain a continuous risk‑management process and places equivalent duties on deployers, not only developers. That distinction is critical for Rwanda because much physical AI encountered there will be manufactured abroad. If a vehicle's autonomous feature activates on a Rwandan road, liability, certification and continuous risk management must be clear — aspiration alone will not settle who pays for harm or who recalls systems.

Global enforcement trends underscore this gap. Regulators and enforcement bodies increasingly expect organisations to translate principles into measurable controls. In other jurisdictions agencies such as the FTC have signalled they will enforce existing authorities against automated systems, and governance experts note that companies inevitably become the authors of operational policy when they set thresholds, review rules and escalation paths. Skills enable interpretation and enforcement only if the legal framework demands evidence that controls work in practice.

Some will defend Rwanda's sequenced approach: build capacity first, then legislate later, to avoid stifling nascent local innovation. That is a reasonable concern. Unfinished or heavy‑handed laws applied prematurely can entrench compliance‑for‑show and push developers offshore. Yet sequencing must not become an excuse for open‑ended delay. When physical AI with injury potential is already present, the policy window for shaping deployer behaviour and import certification is closing. Leaving regulators with expertise but without statutory powers hands the initiative to foreign providers and importers who operate under the laws of their home markets unless host jurisdiction rules bite.

Rwanda should now convert competence into legal force. The National AI Agency should draft and the Rwanda Cabinet should adopt a standalone AI Act that translates the five principles into enforceable obligations, anchoring explicability in evidential duties. The law must require continuous risk assessments across a system's lifecycle, impose duties on both developers and deployers (following Article 9 of the EU AI Act), mandate certification or disablement of imported autonomous features unless cleared for local use, and give the agency clear implementation and enforcement powers to compel audits, impose corrective measures and assign liability.

Skills built by the Ministry of ICT and Innovation are Rwanda's advantage; legislation will be its leverage. The country has invested in human capacity and institutional coordination — now it must give regulators the legal tools to make explicability real, not just aspirational. A statutory framework that binds deployers as well as providers, combined with the technical expertise already growing in Kigali, would allow Rwanda to own its AI stack rather than merely host foreign systems that leave risks and few benefits on the ground.