🇲🇻MV

Overview

The Republic of Maldives is currently in a foundational stage of developing its Artificial Intelligence (AI) regulatory environment. Historically, the nation’s digital governance was centered on telecommunications and postal services, primarily managed through the Communications Authority of Maldives (CAM) under the Communications Authority of Maldives Act (Law No. 42/2015). However, as part of a broader national shift toward a 'Digital Maldives,' the government has begun to pivot toward a more holistic approach to emerging technologies. This shift is characterized by an emphasis on digital transformation, the integration of AI into public administration, and the establishment of robust cybersecurity frameworks to support a data-driven economy. The Maldives, as a small island developing state (SIDS), faces unique geographical and logistical challenges that AI is uniquely positioned to address, from decentralized healthcare delivery to automated environmental monitoring of its fragile coral reefs. The government's vision, as articulated in various strategic action plans, is to transform the Maldives into a tech-enabled hub in the Indian Ocean, leveraging AI to diversify the economy beyond its traditional reliance on tourism and fisheries. This involves a multi-year roadmap that includes upgrading physical infrastructure, enhancing digital literacy, and creating a legal environment that fosters innovation while protecting national security. The current administration has prioritized the 'Digital Maldives' project, which serves as the umbrella for all AI-related initiatives, ensuring that the country remains competitive in an increasingly automated global economy.

Regulatory approach

The Maldives employs a sectoral and technology-neutral regulatory approach. Rather than implementing a single, horizontal AI regulation similar to the EU AI Act, the country utilizes existing statutes to govern different aspects of digital systems. The primary focus is on the underlying infrastructure, electronic transactions, and the security of information systems. This means that AI applications are currently subject to the rules governing the specific sector in which they operate, such as telecommunications, finance, or cybersecurity. For instance, AI used in telecommunications networks is governed by the CAM Act, while AI systems that handle sensitive national data are increasingly falling under the purview of the Cyber Security Act (Law No. 17/2023). This regulatory philosophy is largely 'enabling' rather than 'restrictive,' aiming to attract foreign investment and encourage local startups to experiment with AI solutions. The government relies heavily on 'soft law' instruments, such as guidelines and strategic master plans, to provide direction to the industry without imposing overly burdensome compliance costs. However, there is a clear trend toward formalizing these guidelines into binding law as the technology matures. The regulatory framework is designed to be flexible, allowing for rapid adjustments as new AI capabilities emerge. This is particularly important for the Maldives, where the impact of technology on the environment and social fabric must be carefully managed. The government’s approach also emphasizes 'compliance by design,' encouraging developers to integrate ethical considerations and security features into the early stages of AI system development. The governance of AI in the Maldives is distributed across several key institutions, with the Ministry of Homeland Security and Technology serving as the lead executive body. This Ministry is responsible for the overall policy direction of the nation’s digital and technological landscape, ensuring that AI development aligns with national security interests and broader economic goals. Under its umbrella, the Communications Authority of Maldives (CAM) acts as the technical regulator. CAM’s mandate includes the licensing of services, management of the radio frequency spectrum, and the setting of technical standards for equipment. While CAM’s traditional focus was telecommunications, its role has expanded to include the oversight of digital platforms and the technical infrastructure that supports AI applications. Additionally, the National Centre for Information Technology (NCIT) plays a crucial role in the implementation of government-wide digital initiatives. The NCIT is tasked with the development of the 'Digital Maldives' infrastructure, which includes the integration of AI into e-government services to improve efficiency and accessibility. Furthermore, the newly established National Cyber Security Agency (NCSA), created under the Cyber Security Act of 2023, is responsible for enforcing security standards across all digital systems. These bodies work in coordination to ensure that AI development is safe, secure, and beneficial to the public. The enforcement powers of these agencies include the ability to issue directives, revoke licenses, and impose administrative penalties for non-compliance with technical or security regulations. This multi-layered governance structure ensures that both the policy and technical aspects of AI are adequately addressed, providing a stable environment for technological growth.

Enforcement & penalties

Enforcement mechanisms for digital and AI-related activities in the Maldives are primarily administrative and civil, though the Cyber Security Act introduces more stringent penalties for breaches involving critical infrastructure. Under the Communications Authority of Maldives Act and the Telecommunications Act, the CAM has the power to impose administrative fines, suspend or revoke licenses, and issue cease-and-desist orders for violations of regulatory standards. These penalties are typically scaled based on the severity of the breach and the impact on the national communication network. For AI service providers operating under a CAM license, failure to adhere to technical or service-level obligations can result in significant financial liabilities. The Cyber Security Act (Law No. 17/2023) significantly enhanced the enforcement landscape by outlining specific offenses related to the unauthorized access or interference with information systems. This applies directly to the malicious use of AI or attacks on AI models. Penalties under this Act can include substantial fines and imprisonment, particularly if the offense targets 'Critical Information Infrastructure.' The Act also provides for a formal appeals process, allowing entities to challenge the decisions of the National Cyber Security Agency through the judicial system. As the Maldives continues to develop its AI-specific guidelines, it is anticipated that enforcement will focus on 'compliance by design,' requiring developers to meet specific safety and security benchmarks before deployment. This proactive enforcement strategy aims to prevent harms before they occur, rather than relying solely on punitive measures after a breach. The government is also exploring the use of AI-driven monitoring tools to detect and respond to regulatory violations in real-time, further strengthening the enforcement capabilities of national regulators.

Data protection

The Maldives does not currently have a single, comprehensive data protection law equivalent to the EU's GDPR. Instead, data protection is addressed through a combination of constitutional rights and sectoral regulations. Section 24 of the Constitution of the Republic of Maldives guarantees the right to privacy and the protection of personal information, stating that everyone has the right to respect for their private and family life, home, and communications. This constitutional provision serves as the ultimate legal safeguard against the misuse of personal data by AI systems. However, the lack of a detailed statutory framework has led to the development of a draft 'Privacy and Personal Data Protection Bill,' which is intended to provide specific rules for data processing, consent, and the rights of data subjects. In the absence of a dedicated Act, sectoral rules fill the gap. For example, the banking and finance sector, regulated by the Maldives Monetary Authority (MMA), has strict confidentiality requirements that apply to AI-driven financial services. Similarly, the Cyber Security Act of 2023 includes provisions for the protection of data within critical systems, emphasizing data integrity and availability. For AI developers, this means that while there is no centralized data protection authority yet, they must ensure compliance with the constitutional right to privacy and any specific data handling rules issued by sectoral regulators like CAM or the MMA. The government has indicated that a comprehensive Data Protection Act is a priority to support the safe rollout of the National AI Strategy, as it will provide the legal certainty required for large-scale AI deployments and international data transfers. This future legislation is expected to align closely with international standards, ensuring that the Maldives remains a trusted destination for data-driven businesses.

Sector-specific rules

Sector-specific AI regulation in the Maldives is most prominent in the financial and telecommunications industries. The Maldives Monetary Authority (MMA) oversees the fintech sector and has been proactive in creating frameworks for digital payments and electronic money, which increasingly utilize AI for fraud detection, credit scoring, and automated customer support. The MMA’s regulations require financial institutions to maintain high standards of data security and transparency, which indirectly regulates the use of AI algorithms in financial decision-making. These rules ensure that AI applications in finance do not compromise the stability of the national financial system or the rights of consumers. In the telecommunications sector, the CAM Act and the Telecommunications Act provide the framework for AI used in network optimization and automated customer service. CAM requires that all equipment used in the Maldives, including AI-integrated hardware, undergo a type-approval process to ensure it meets national technical standards. Furthermore, the government is exploring AI applications in the environmental and tourism sectors—the backbones of the Maldivian economy. While specific regulations for AI in tourism are still in development, the focus is on using AI for sustainable resource management, enhancing the visitor experience through personalized services, and protecting the marine environment. These initiatives are governed by the Ministry of Tourism’s general regulatory powers and environmental protection laws. The government is also looking into AI for the healthcare sector, particularly for remote diagnostics and patient management in the outer islands, which will be subject to health-specific data and safety regulations. This sectoral approach allows the Maldives to tailor its regulatory response to the specific risks and opportunities of each industry, ensuring that AI is used responsibly across the economy.

International alignment

The Maldives is actively seeking to align its digital and AI policies with international best practices, particularly those relevant to Small Island Developing States (SIDS). The government participates in various international forums, including the United Nations (UN) and the International Telecommunication Union (ITU), to ensure its regulatory framework is compatible with global standards. There is a strong emphasis on the 'SAMOA Pathway' and other SIDS-specific initiatives that advocate for the use of technology to build climate resilience and promote sustainable development. While the Maldives has not formally adopted the EU AI Act, its draft policies and the recently enacted Cyber Security Act reflect a growing awareness of international trends toward risk-based regulation and the ethical use of AI. Furthermore, the Maldives is a member of the South Asian Association for Regional Cooperation (SAARC), which provides a platform for regional cooperation on technology and cybersecurity. The government’s 'Digital Maldives' project is supported by international partners, including the World Bank, which encourages the adoption of international standards for data governance, digital identity, and cybersecurity. This international alignment is crucial for the Maldives as it seeks to attract foreign investment in its tech sector and ensure that its digital services are interoperable with global markets. By aligning with OECD principles on AI and participating in global cybersecurity networks, the Maldives aims to ensure that its AI ecosystem is viewed as secure, transparent, and ethically sound. This global perspective helps the Maldives navigate the complex challenges of AI governance while leveraging the expertise and resources of the international community.

What's next

The future of AI regulation in the Maldives is centered on the implementation of the National AI Strategy, which was a landmark announcement in 2024. This strategy is expected to outline the government's roadmap for AI adoption across various sectors, including healthcare, education, and public administration. A key component of this future development is the expected introduction of a comprehensive Privacy and Personal Data Protection Act. This legislation will be critical for providing the legal certainty required for large-scale AI deployments and will likely establish a dedicated Data Protection Authority to oversee compliance and protect the rights of citizens in the age of AI. Additionally, the government is expected to issue more detailed subsidiary regulations under the Cyber Security Act of 2023. These regulations will likely define specific technical requirements for AI systems used in critical infrastructure and establish a framework for mandatory security audits. There is also ongoing discussion regarding the creation of a 'Regulatory Sandbox' for fintech and AI startups, which would allow companies to test innovative AI solutions in a controlled environment under the supervision of the MMA and CAM. This sandbox approach is designed to foster innovation while allowing regulators to understand the risks associated with new technologies before they are fully deployed. As the Maldives moves toward its goal of becoming a fully digital economy by 2030, the regulatory landscape will continue to evolve from a sectoral approach toward a more integrated and comprehensive framework for AI governance. This evolution will be guided by the principles of transparency, accountability, and human-centric design, ensuring that AI serves the best interests of the Maldivian people and the environment.