🇹🇳Tunisia

Overview

Tunisia’s approach to artificial intelligence (AI) is characterized by an ambitious dual-track strategy: fostering a high-growth innovation ecosystem while simultaneously modernizing its legal framework to align with international standards. As part of the broader 'Digital Tunisia 2030' vision, the government has transitioned from being a passive consumer of technology to an active regional hub for AI research and development. This philosophy is rooted in the nation's high density of engineering talent and a strategic desire to achieve 'technological sovereignty.' By developing locally-owned AI models and infrastructure, Tunisia aims to preserve its unique cultural and linguistic nuances while reducing dependence on foreign technology giants. The regulatory landscape is currently in a state of significant transformation. While earlier efforts, such as the National AI Strategy and Roadmap (2021-2025), focused on awareness and foundational infrastructure, the current phase (2026-2030) introduces more structured governance and ethical oversight. The Tunisian government views AI not merely as a technical tool but as a catalyst for economic resilience and public service modernization. This is evidenced by the integration of AI into the National Development Plan, which prioritizes sectors like healthcare, agriculture, and 'GovTech.' The overarching goal is to create a 'Trusted AI' environment that attracts foreign investment and facilitates seamless integration with the European and African digital markets.

Regulatory approach

Tunisia employs a hybrid regulatory approach that combines horizontal legislation with sector-specific strategic policies. The horizontal layer is anchored by data protection and cybersecurity laws that apply across all industries. For instance, the Organic Act No. 2004-63 and its successor, the 2025 Organic Bill on the Protection of Personal Data, provide the baseline for how AI systems must handle information. Similarly, Decree-Law No. 2022-54 establishes a prescriptive criminal regime for digital offenses, including those involving automated systems. This horizontal framework ensures that AI development does not occur in a legal vacuum, regardless of the application area. In contrast, the sectoral approach is driven by the National Artificial Intelligence Strategy (2026-2030), which sets specific priorities for high-impact fields. This strategy moves away from rigid, one-size-fits-all mandates toward a more flexible, risk-based model. A key feature of this approach is the introduction of 'Regulatory Sandboxes' managed by the National Authority for the Protection of Personal Data (INPDP). These sandboxes allow startups and researchers to test innovative AI products under regulatory supervision, enabling the government to evaluate emerging risks in real-time before applying broader regulations. This balance between binding law (hard law) and strategic guidance (soft law) is intended to promote innovation without compromising fundamental rights. Governance of AI in Tunisia is distributed across several high-level institutions to ensure cross-sectoral coordination. The Ministry of Communication Technologies serves as the primary architect of digital policy, overseeing the implementation of the 'Digital Tunisia' vision. Under the 2026-2030 strategy, the National AI Council (Conseil National de l'Intelligence Artificielle) has been established as the supreme advisory body. Chaired by the Head of Government, this council coordinates between the Ministries of Education, Industry, and Finance to ensure that AI initiatives are aligned with national economic goals and cybersecurity standards. The National Authority for the Protection of Personal Data (INPDP) is the central regulator for AI systems that process personal information. With the 2025 Bill, the INPDP’s mandate has expanded from a consultative role to a robust enforcement authority with the power to conduct audits, issue cease-and-desist orders, and impose administrative fines. Additionally, the National Agency for Scientific Research Promotion (ANPR) and the 'Startup Tunisia' initiative manage the operational aspects of AI innovation, including the allocation of grants from the National AI Fund and the management of AI Excellence Centers in university hubs like Tunis and Sfax.

Enforcement & penalties

Enforcement mechanisms in Tunisia are bifurcated between administrative sanctions for data violations and severe criminal penalties for cyber-related offenses. Under the 2025 Data Protection Bill, the INPDP is empowered to impose administrative fines on organizations that fail to comply with 'Privacy by Design' or 'Algorithmic Accountability' requirements. These fines are designed to be dissuasive, mirroring the proportional penalty structures found in international frameworks. Organizations also face corporate liability, which can include the suspension of activities or the withdrawal of the 'Startup Label' and its associated fiscal benefits. Criminal enforcement is primarily governed by Decree-Law No. 2022-54. This law provides for significant custodial sentences and heavy fines for offenses such as unlawful interception of data, system interference, and the dissemination of 'false news' via automated systems. While intended to combat cybercrime, the decree has faced scrutiny for its broad definitions. The judicial system, including public prosecutors and specialized investigating judges, handles these criminal cases. Appeals against administrative decisions made by the INPDP or the Ministry are processed through the administrative courts, ensuring a layer of judicial review for entrepreneurs and citizens alike.

Data protection

Tunisia’s data protection framework is currently undergoing a historic shift to achieve 'adequacy' status with the European Union. The existing Organic Act No. 2004-63 established the foundational right to privacy, but it lacked specific provisions for modern AI challenges. The 2025 Organic Bill on the Protection of Personal Data addresses these gaps by introducing the 'Right to Portability,' the 'Right to Erasure' (Right to be Forgotten), and strict regulations on 'High-Risk Processing.' This includes mandatory Data Protection Impact Assessments (DPIAs) for any AI system involving large-scale biometric identification or systematic monitoring of public areas. A critical component of this framework is the emphasis on 'Data Sovereignty.' The 2026-2030 strategy and the 2025 Bill collectively promote the storage of sensitive national data within Tunisian jurisdiction. This is supported by the development of a 'National AI Cloud,' which provides a secure infrastructure for government data and local AI training. Service providers are subject to mandatory data retention periods (minimum of two years under Decree 54) to assist in judicial investigations, though the 2025 Bill seeks to balance these security requirements with enhanced transparency and consent mechanisms for individual citizens.

Sector-specific rules

While Tunisia does not yet have a single 'AI Act' for every sector, the National AI Strategy (2026-2030) outlines specific regulatory priorities for high-impact industries. In the Healthcare sector, AI deployment is focused on diagnostics and personalized medicine, with strict rules regarding the processing of sensitive genetic and health data. The strategy mandates that AI-driven medical tools must undergo rigorous validation to ensure they do not introduce bias or compromise patient safety, particularly in rural areas where access to quality care is limited. In Agriculture and Environmental Management, the focus is on precision farming and water scarcity solutions. Regulations in this sector emphasize 'Open Data' policies, where the state provides satellite and climate data to startups to train predictive models for irrigation and pest control. For the Financial and Employment sectors, the government is moving toward requiring 'Algorithmic Impact Assessments' to prevent discriminatory outcomes in credit scoring and recruitment. These sector-specific guidelines are often developed through public-private partnerships, ensuring they are technically feasible while protecting social equity.

International alignment

Tunisia is deeply committed to aligning its AI governance with international norms to facilitate global cooperation. The nation was one of the first in the region to reference the UNESCO Recommendation on the Ethics of Artificial Intelligence and the OECD AI Principles as foundational pillars of its national strategy. This alignment is not merely ethical but also economic; by harmonizing its laws with the European Union AI Act, Tunisia ensures that its local AI products and services can seamlessly access the European market, which is its largest trading partner. Furthermore, Tunisia actively participates in regional initiatives such as the African Union AI Strategy and the Arab League Digital Transformation Framework. The government has established 'Scientific Diplomacy' agreements with nations like France, Germany, and Canada for joint R&D projects and talent exchange. By positioning itself as a 'Trusted AI Partner,' Tunisia seeks to attract foreign direct investment (FDI) and participate in global discussions regarding the rights of the Global South in the digital era. This international outlook is central to the nation's goal of becoming a gateway between the European and African technology ecosystems.

What's next

The next five years will be a period of intense legislative and operational activity in Tunisia. The most significant upcoming milestone is the full entry into force of the 2025 Organic Bill on the Protection of Personal Data, scheduled for July 2026. This will trigger a nationwide compliance effort as organizations appoint Data Protection Officers (DPOs) and update their processing records. Simultaneously, the National AI Council will oversee the operationalization of the National AI Fund, which is expected to inject significant capital into local AI research and infrastructure projects between 2026 and 2030. Looking toward 2028, the government has scheduled a mid-term review of the National AI Strategy to adjust for technological leaps such as Generative AI and Quantum Computing. There are also ongoing discussions regarding a 'Startup Act 2.0,' which may include specific 'AI-first' incentives such as R&D tax credits for companies developing sovereign LLMs (Large Language Models). As the 'Regulatory Sandboxes' yield data on emerging risks, the public can expect more granular decrees governing specific high-risk applications like facial recognition in public spaces and AI in judicial decision-making, ensuring that Tunisia's legal framework remains as dynamic as the technology it governs.