Maldives AI Regulation Overview

Overview

The Republic of Maldives is in the foundational stages of constructing a national artificial intelligence regulatory framework, combining forward-looking policy masterplans with established statutory instruments for cybersecurity, electronic transactions, and communications. Catalyzed by international partnership, the Maldives became the first country in South Asia to complete UNESCO's AI Readiness Assessment Methodology (RAM). The resulting UNESCO AI Readiness Assessment Report, officially launched on July 31, 2025, provided a baseline evaluation of national capabilities and identified key priorities for ethical, equitable, and inclusive AI adoption across the archipelago.

Building upon the assessment's findings, President Dr. Mohamed Muizzu announced the draft National AI Masterplan 2025-2035 on October 16, 2024. Led by the National Centre for Information Technology (NCIT) under the Ministry of Homeland Security and Technology in collaboration with the Ministry of Economic Development and Trade, the Masterplan outlines a ten-year vision. It centers on mitigating AI deployment risks, introducing comprehensive statutory rules, digitizing national Dhivehi-language content, and tailoring technology governance to the geographic and economic realities of a Small Island Developing State (SIDS).

Regulatory Approach

The Maldives currently employs a hybrid regulatory approach that combines soft-law strategic guidance with sector-neutral statutory foundations. At the policy level, the national approach is guided by principles of human-centric ethics, inclusivity, and risk management aligned with UNESCO's 2021 Recommendation on the Ethics of Artificial Intelligence. Rather than relying on rigid prescriptive constraints, the framework prioritizes establishing institutional oversight mechanisms, public-private advisory structures, and continuous monitoring through standardized benchmarks.

On the statutory side, AI systems operate within legal parameters established by broader digital and technology legislation. Key binding acts—such as the Cyber Security Act (Law No. 17/2023), the Electronic Transactions Act (Law No. 2/2022), and the Communications Authority of Maldives Act (Law No. 42/2015)—provide functional equivalence for digital operations, secure electronic signatures, data integrity standards, and critical infrastructure protection. Together, these measures form a stepping stone toward planned standalone AI legislation.

Key AI Legislation

• National AI Masterplan 2025-2035 (Draft Policy, 2024): Formulated under the leadership of NCIT, this ten-year policy establishes national priorities for AI risk management, legal framework development, independent governance oversight, domestic talent development, and Dhivehi language digitization.
• UNESCO AI Readiness Assessment Report (Policy Report, 2025): Developed jointly by UNESCO and NCIT over a ten-month assessment period, establishing strategic focus areas across AI governance, inclusive oversight, talent development, social equity, and investment ecosystem enhancement.
• Cyber Security Act (Law No. 17/2023): Ratified on November 14, 2023, establishing the National Cyber Security Agency (NCSA) to protect Critical Information Infrastructure (CII), set mandatory cybersecurity standards, and implement compulsory incident reporting regimes applicable to digital platforms and service providers.
• Electronic Transactions Act (Law No. 2/2022): Ratified on April 27, 2022, providing legal recognition and functional equivalence to electronic records, data messages, and signatures, while establishing the Controller of Trust Services to accredit and regulate digital trust service providers.
• Communications Authority of Maldives Act (Law No. 42/2015): Enacted to establish the Communications Authority of Maldives (CAM) as the independent regulator for telecommunications, postal services, and infocommunications infrastructure, including spectrum allocation and equipment type-approval.

Governance & Enforcement Bodies

Institutional oversight for AI and digital policy in the Maldives is centralized under the Ministry of Homeland Security and Technology. The National Centre for Information Technology (NCIT), operating within the Ministry, serves as the primary executive organ responsible for technical standards, drafting the National AI Masterplan 2025-2035, and coordinating international assistance with entities such as UNESCO. Under the proposed Masterplan, the government plans to establish a dedicated, independent AI governance body to act as the primary AI regulatory authority, alongside a multistakeholder advisory council comprising representatives from government, industry, academia, and civil society.

Complementary enforcement and regulatory powers are distributed across specialized statutory agencies. The National Cyber Security Agency (NCSA) oversees cybersecurity resilience and monitors Critical Information Infrastructure operators. The Controller of Trust Services regulates electronic signature and verification providers under the Electronic Transactions Act. Meanwhile, the Communications Authority of Maldives (CAM), which was designated in September 2024 to function under the Ministry of Homeland Security and Technology, regulates physical networks, spectrum allocation, and digital communication services.

Penalties & Enforcement

Enforcement mechanisms in the Maldivian AI and digital ecosystem rely on supervisory powers established under parent statutes. Under the Cyber Security Act (Law No. 17/2023), the NCSA holds extensive monitoring and investigative authority, including powers to conduct compliance audits, inspect CII facilities, access computer systems, seize digital evidence, and issue public notices regarding non-compliant entities. CII operators and service providers are subject to mandatory incident reporting duties and compliance assessments conducted by NCSA-registered independent auditors.

Under the Electronic Transactions Act (Law No. 2/2022), regulatory control over Trust Service Providers is enforced through accreditation, licensing requirements, and audit power held by the Controller of Trust Services. The Act establishes civil liability for Trust Service Providers for failure to verify certificates or revoke compromised credentials, while signatories face civil liability for failing to exercise due care over signature-creation data. Under Law No. 42/2015, CAM holds administrative enforcement powers including issuing corrective directions, levying regulatory fees, and suspending or revoking operator licenses. The provided records do not specify monetary fine ranges or criminal penalty terms for AI-specific violations.

Data Protection Framework

The corpus holds no record of a standalone general data protection law or GDPR-equivalent statute in the Maldives. However, data protection, privacy, and system integrity rules are integrated into existing cybersecurity and electronic transaction frameworks. The Cyber Security Act (Law No. 17/2023) establishes data security duties for entities operating Critical Information Infrastructure, requiring them to implement risk management controls, maintain data confidentiality, and protect shared vulnerability data from public disclosure.

Additionally, the Electronic Transactions Act (Law No. 2/2022) protects data message integrity by setting legal standards for data storage, retrievability, and tamper-detection in electronic records and signatures. As part of the UNESCO AI Readiness Assessment recommendations, the government is focusing on knowledge infrastructure and Dhivehi-language datasets, emphasizing inclusive data collection and cultural preservation while upgrading technical safeguards.

Sector-Specific Rules

The provided context contains no record of standalone sector-specific AI regulations governing healthcare AI, financial AI, autonomous vehicles, or employment automation in the Maldives. Existing technology governance is applied horizontally across sectors through general infocommunications and cybersecurity legislation.

Strategic deployment of AI across key industries is outlined in the draft National AI Masterplan 2025-2035. The Masterplan identifies pilot projects to demonstrate ethical AI integration in primary national economic drivers, specifically tourism, fisheries, and public administrative services. Sectoral communications infrastructure supporting these technologies remains subject to regulatory oversight by the Communications Authority of Maldives under Law No. 42/2015.

International Alignment

The Maldives aligns its national AI and digital policies closely with international standards and multilateral frameworks. The core foundation of the country's AI policy is UNESCO's 2021 Recommendation on the Ethics of Artificial Intelligence, which guides the National AI Masterplan 2025-2035 and formed the benchmark for the 2025 UNESCO AI Readiness Assessment Report. The assessment utilizes UNESCO's standardized Readiness Assessment Methodology (RAM) and the UNESCO Global AI Ethics Observatory for ongoing international benchmarking.

In the domain of commercial technology and electronic trade, the Electronic Transactions Act (Law No. 2/2022) is directly modeled on international standards developed by the United Nations Commission on International Trade Law (UNCITRAL), including the Model Law on Electronic Commerce, the Model Law on Electronic Signatures, and principles from the Model Law on Electronic Transferable Records (MLETR). The Act also establishes mechanisms for recognizing foreign electronic signatures and certificates that offer equivalent reliability standards.

Future Developments

Future developments in the Maldivian AI landscape focus on executing the roadmap outlined in the draft National AI Masterplan 2025-2035 following cabinet review and formal approval. Key legal and institutional milestones include drafting comprehensive legislation dedicated to regulating AI technologies and establishing the proposed independent AI governance body and multistakeholder advisory council.

Implementation plans further emphasize building domestic capabilities through national AI education initiatives, developing technical standards for algorithmic deployment, and undertaking medium-term projects to digitize Dhivehi-language content and datasets. These initiatives aim to ensure that emerging AI systems reflect the nation's linguistic heritage while addressing the connectivity and resource constraints characteristic of Small Island Developing States.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
National Centre for Information Technology (NCIT)	Lead government agency for national ICT development and AI policy implementation under the Ministry of Homeland Security and Technology.	Formulates national ICT policies, leads development of the National AI Masterplan 2025-2035, and coordinates UNESCO AI Readiness initiatives.
National Cyber Security Agency (NCSA)	Lead statutory authority for cybersecurity oversight and Critical Information Infrastructure protection under Law No. 17/2023.	Formulates security standards, inspects facilities, accesses systems, seizes digital evidence, and issues public non-compliance warnings.
Controller of Trust Services	Statutory regulatory authority for Trust Service Providers under the Electronic Transactions Act (Law No. 2/2022).	Issues provider licenses and accreditations, conducts audits and investigations, and maintains the public register of accredited providers.
Communications Authority of Maldives (CAM)	Independent statutory regulator for telecommunications, postal, and infocommunications under Law No. 42/2015.	Grants service and network licenses, allocates radio frequency spectrum, approves equipment, and issues administrative directions or license sanctions.	https://cam.gov.mv/aboutus.htm