Strategy Without Statute: Reading Zimbabwe’s National AI Strategy
Picture Credit: https://veritaszim.net/
Zimbabwe has completed the easier stage of Artificial Intelligence (AI) governance. It published a Strategy.
The difficult phase — legislation, enforcement, institutional readiness, and public understanding — remains incomplete. This is not a failure. It is a moment. The next eighteen months will determine whether the Strategy becomes a foundation or remains a statement of intent.
The National Artificial Intelligence Strategy 2026–2030 was launched on 13 March 2026 at the New Parliament Building in Harare by President Mnangagwa, alongside the United Nations Resident and Humanitarian Coordinator. Cabinet approved the document in October 2025. The Strategy is built around six pillars; talent and capacity, infrastructure, adoption across twelve sectors, governance and ethics, research and innovation, and international engagement. These are structured across three implementation phases running to 2030. Three regional stakeholder consultations were held in Harare, Bulawayo, and Masvingo during August and September 2025.
A Strategy is not a law
This distinction may appear basic, but it is central to this analysis. It is also one of the most important points in understanding the limits of Zimbabwe’s National Artificial Intelligence Strategy.
Sections 116 and 117(1) of the Constitution of Zimbabwe vest legislative authority in the Legislature, which consists of Parliament and the President. A national Strategy approved by Cabinet creates policy direction; it does not create binding legal obligations for the state or private parties. Citizens cannot sue under it. Companies cannot be fined under it. Regulators cannot enforce against it.
The Strategy proposes a National Digital Regulatory Committee (NDRC) as the AI regulator. It does not establish one. The NDRC occupies the same legal space as the National AI Council and the AI Strategy Implementation Office; bodies named in a Cabinet-approved document, but without an enabling Act of Parliament.
What is the law on AI in Zimbabwe today? The Cyber and Data Protection Act [Chapter 12:07] (CDPA), which came in force from March 2022, with POTRAZ designated as the Data Protection Authority. Statutory Instrument 155 of 2024 introduced a licensing framework and required the appointment of Data Protection Officers by December 2024. When an automated decision affects a Zimbabwean citizen's rights — a credit scoring outcome, a recruitment screening, or a fraud flag — the recourse is not the Strategy —it is the CDPA. Many organisations deploying AI are already exposed under its automated processing provisions. A significant number do not know it. That gap; between what existing law already requires and what is being practised, is where AI governance in Zimbabwe is being decided right now.
What Europe built, and how long it took
The European Union (EU) AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. From the publication of the White Paper in February 2020 to entry into force, the process took approximately four and a half years. The Act sits on top of the General Data Protection Regulation (GDPR), which has applied since May 2018, giving the EU over six years of operational data protection enforcement before the AI Act arrived. During that period, fines were issued, case law developed, and compliance habits formed practices became embedded. The AI Act therefore inherits an already function regulatory system.
In May 2026, EU co-legislators agreed to delay the application of certain high-risk AI obligations to December 2027, acknowledging that even the world's most resourced regulatory machine could not meet its original implementation timeline. That is worth sitting with.
Zimbabwe's CDPA has been in force for approximately four years. Publicly visible enforcement actions remain limited. The regulators, case law, trained compliance officers, and entrenched enforcement practices that underpin effective regulation are, in Zimbabwe, still largely in development rather than consolidation. Europe governed after building. Zimbabwe is governing while building. That is more ambitious and it carries higher operational risk. It should not be assumed that Zimbabwe’s timeline can meaningfully compress what took Europe significantly longer to achieve.
What the Strategy gets right
The strategy’s architecture is structurally sound. The Ubuntu ethics framing is genuinely African and not derivative. The political weight is also significant, a Head of State launch signals state-level commitment that matters for budget conversations and inter-ministerial coordination. The five flagship initiatives give the document a degree of specificity. Moreover, the three regional consultations alongside UNESCO’s involvement, places this among one of the more open strategy processes on the continent. These are substantive strengths and deserve acknowledgment before any critique.
What I would challenge
There is no published reference list. Following South Africa's Draft AI Policy being withdrawn in April 2026 after reports that several of its academic citations were AI-generated and pointed to articles that did not exist, citation integrity has become a continental baseline expectation. Publishing a verified reference list costs nothing and protects everything.
The National Digital Regulatory Committee (NDRC) has no enabling legislation. A regulator without a statutory basis cannot regulate. A draft AI Act should be introduced to Parliament within twelve to eighteen months. That is the move that converts this Strategy from policy intent to enforceable reality.
There is no implementation budget. The flagship initiatives remain commitments without financial qualification. In a fiscal environment defined by currency instability and unresolved external debt, the absence of a costed implementation plan is a material governance gap.
There is no public delivery dashboard. The Foundation Building phase 2025–2026 is already more than halfway complete. Yet there is no structured mechanism for the public to track what has been delivered against the phase one milestones.
A difficult question about Ubuntu
The Strategy is rooted in Ubuntu, and that deserves to be taken seriously. The harder question is what Ubuntu requires when an algorithm makes a decision affecting an individual. A credit-scoring model denies someone a loan. A recruitment tool filters out a candidate without explanation. What is the Ubuntu remedy?
The Strategy treats Ubuntu as a values framework. It does not yet translate those values into concrete procedural rights. Article 22 of the General Data Protection Regulation (GDPR) and section 71 of the Protection of Personal Information Act (POPIA) both engage this question, although each has attracted criticism for its limited scope and uneven application. Zimbabwe could go further — not by importing European data protection language wholesale, but by developing procedural rights grounded in its own ethical tradition. One option is a statutory right to an explanation: if an algorithm makes a decision that affects you, somebody should be able to how that decision was reached. Anchoring that right in Ubuntu, rather than borrowing it from Brussels, would allow Zimbabwe to develop an innovative legal model that other countries could look to, rather than simply importing one from elsewhere.
What should happen next
Introduce the NDRC Bill to Parliament within twelve months. Publish the joint CDPA–AI Strategy gap analysis. Develop a quarterly delivery dashboard. Require every institution deploying AI to identify the individuals responsible for explaining AI-assisted decisions. If no one is accountable, then no accountability framework exists, regardless of what the governance document says. Prioritise legal literacy alongside technical training. Establish a structured channel through which Zimbabweans with expertise in AI governance and regulation, including those trained abroad, can contribute to implementation.
Closing
Zimbabwe has done something significant. It has adopted a national AI Strategy. It has also completed the easier stage of AI governance. The more demanding task is to translate that Strategy into legislation, effective institutions, and sustained implementation.
Strategies do not enforce themselves. People do. Statutes do. Regulators that are independent, adequately funded, and legally empowered do. For AI governance in Zimbabwe, those institutional foundations are still being built
That is not a failure. It is an opportunity. The success of Zimbabwe's National AI Strategy will ultimately be measured not by the quality of its vision, but by the strength of the legal and institutional framework that brings that vision into effect
