Tunisia AI Regulation Overview

Overview

Tunisia's framework surrounding artificial intelligence and digital technology is structured through national strategic policies, cybercrime legislation, and targeted support for technological entrepreneurship. Rather than relying on a standalone comprehensive AI law, the regulatory landscape is driven by policy blueprints such as the National AI Strategy and Roadmap (2021–2025), alongside broad digital and security statutes like Decree-Law No. 2022-54 on cybercrime and Law No. 2018-20 (the Startup Act).

The national regulatory approach balances innovation promotion—aiming to position Tunisia as a regional digital hub—with state oversight, cybersecurity enforcement, and electronic surveillance powers. Government initiatives emphasize workforce skills development, digital infrastructure enhancement (such as high-performance computing capacity and the E-Houwiya digital identity system), and support for innovation ecosystems through public-private governance.

Regulatory Approach

Tunisia has adopted a policy-driven, non-binding strategic vision for AI development, combined with binding cybercrime regulations that impact digital systems. The National AI Strategy and Roadmap (2021–2025) operates as a policy framework focused on five primary pillars: talent and skills development, infrastructure expansion, comprehensive data policy adoption, ecosystem networking, and sector-specific deployment across domains like healthcare, agriculture, transportation, and education.

In contrast, binding legal obligations for digital systems are enforced through hard law instruments such as Decree-Law No. 2022-54. This decree establishes criminal liability for information system offences, mandates data retention for service providers, and authorizes broad investigatory and interception powers. In addition, Law No. 2018-20 (Startup Act) provides statutory incentives, tax exemptions, and exchange control derogations for labeled innovative technology ventures.

Key AI Legislation

• National AI Strategy and Roadmap (2021–2025): A policy document setting out a multi-year plan to build Tunisia's AI ecosystem through five key pillars: skills development, infrastructure investment, data policy adoption, ecosystem networking, and sector deployment in healthcare, agriculture, transportation, and education.
• Decree-Law No. 2022-54 on Combating Offences Relating to Information and Communication Systems: A binding criminal decree regulating information systems, establishing mandatory data retention obligations (minimum 2-year baseline for traffic/access data), real-time interception powers, and criminal penalties for offences including data tampering and dissemination of false news (Article 24).
• Law No. 2018-20 (Startup Act): An act facilitating technological entrepreneurship by defining eligibility criteria for innovative startups, providing corporate income tax exemptions for up to eight years, enabling special foreign currency accounts, state-funded social security, and establishing the Labeling Committee.

Governance & Enforcement Bodies

Implementation and oversight of digital regulations and AI initiatives in Tunisia are distributed across several government entities and specialized bodies. The Ministry of Industry, Mines, and Energy, alongside the Ministry of Communication Technologies, Ministry of Economy, and Ministry of Higher Education and Scientific Research, coordinate national strategic goals under interministerial arrangements, including a 2022 Memorandum of Understanding.

For security and cybercrime enforcement under Decree-Law No. 2022-54, authority rests with judicial bodies (public prosecutors and investigating judges), police and military judicial officers, and specialized services within the Ministries of Interior and Defence. The High Authority for Public Procurement oversees government adoption of AI, while the Labeling Committee (Comité de Labellisation) manages the evaluation and granting of startup status under Law No. 2018-20.

Penalties & Enforcement

Penalties for digital and information system violations are set forth primarily in Decree-Law No. 2022-54. The law establishes a catalogue of criminal offences including illegal access (Article 16), unlawful interception (Articles 18–20), data tampering, diversion, and fraud (Articles 22–23), dissemination of rumors or false news using information systems (Article 24), and unlawful disclosure of professional secrets. Penalties include graduated custodial terms and fines, with severe aggravations for public officials, as well as corporate remedies under Article 32 such as pecuniary sanctions, activity suspension, or corporate dissolution.

Procedural rights and appeals mechanisms vary by domain. Under the Startup Act (Law No. 2018-20), rejected applicants receive detailed justifications from the Labeling Committee, retaining rights to request reconsideration or file administrative appeals in court against decisions revoking labels or denying benefits. Enforcement under Decree-Law No. 2022-54 involves judicial authorization for data seizure and real-time interception, with extraterritorial jurisdiction applying when offences target Tunisian interests or involve Tunisian residents.

Data Protection Framework

The corpus holds no record of a general standalone data protection statute; however, data management, access, and retention obligations are regulated across existing digital decrees and strategy documents. Decree-Law No. 2022-54 imposes mandatory data-retention obligations on telecommunications and internet service providers, establishing a baseline requirement to retain traffic and access metadata for a minimum of two years. It also grants prosecutors and judicial officers powers to order preservation, real-time collection, and seizure of electronic data.

At the policy level, the National AI Strategy and Roadmap (2021–2025) highlights data policy as a core pillar, aiming to establish frameworks for responsible data collection, management, and utilization to support AI training and deployment. Additionally, the strategy outlines national digital infrastructure projects, such as the nationwide digital identity system E-Houwiya, while emphasizing cloud computing and high-performance computing capacity building in Tunis, Sfax, and Monastir.

Sector-Specific Rules

Sector-specific AI guidelines and targets are addressed principally through policy initiatives within the National AI Strategy and Roadmap (2021–2025). The strategy identifies priority sectors for AI deployment, specifically targeting healthcare, agriculture, transportation, and education. Practical infrastructure support for sector deployment includes the Novation City AI innovation hub, which provides DGX infrastructure and developer training.

The corpus holds no record of specific statutory codes or rules dedicated exclusively to autonomous vehicles, employment AI, or specialized financial AI algorithms outside of the general startup incentives, research programs, and cybercrime enforcement provisions.

International Alignment

Tunisia aligns its digital and AI strategies with international standards and benchmark organizations. The National AI Strategy and Roadmap (2021–2025) adopts internationally recognized definitions for key concepts like artificial intelligence, machine learning, and high-performance computing. Tunisia monitors its implementation progress through international benchmarking platforms, including participation in the OECD AI Policy Observatory.

International collaboration plays a significant role in Tunisia's ecosystem development. The Future Society has partnered with Tunisian authorities through stakeholder consultation workshops to guide strategy implementation. Furthermore, the Startup Act (Law No. 2018-20) facilitates alignment with international innovation networks, such as the European Commission's Startup Nations Standard, and has served as a legislative model for other African nations.

Future Developments

As the National AI Strategy and Roadmap (2021–2025) approaches its endpoint, a comprehensive evaluation is slated to trigger the formulation of a successor national AI strategy. Ongoing monitoring tracks research outputs (such as recorded AI publications) and computing infrastructure deployment across hubs in Tunis, Sfax, and Monastir to inform future policy revisions.

Under Decree-Law No. 2022-54, operational details for data retention and technical interception procedures depend on executive rule-making through forthcoming joint ministerial orders from the Ministries of Defence, Interior, Justice, and Telecommunications. These orders will further specify operational retention durations, technical specifications, and procedural safeguards.

Enforcement Bodies