Skip to main content

    AI by country · East Africa

    AI in Rwanda: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Rwanda know before starting with AI?

    Rwanda has no dedicated AI law as of 29 October 2026. Law No. 058/2021 relating to the protection of personal data and privacy is the law that applies to AI today, and it is stricter than many on where data is stored. A company should register with the National Cyber Security Authority, check whether data will be stored or sent outside Rwanda, and decide which automated decisions need a human in the loop.

    At a glance

    Rwanda at a glance

    Key facts about Rwanda
    Data protection lawLaw No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, in force since 15 October 2021
    RegulatorNational Cyber Security Authority (NCSA), through its Data Protection and Privacy Office
    AI policyNational Artificial Intelligence Policy (approved by Cabinet in April 2023). No dedicated AI law as of 29 October 2026
    Time zoneCAT, UTC+2 (India is 3.5 hours ahead)
    CurrencyRWF (Rwandan franc)
    Business languageEnglish, Kinyarwanda and French

    Why now

    Why Rwanda is worth watching

    Each point links to the document it comes from.

    • Cabinet approved the National AI Policy on 20 April 2023. It sets out six priority policy areas and 14 key recommendations.[5]

    • The policy names five flagship sectors for AI adoption: healthcare, banking and digital payments, e-commerce and trade, transportation, and agriculture.[3]

    • The policy recommends a Responsible AI Office inside the Ministry of ICT and Innovation to coordinate its implementation plan.[3]

    • Cabinet approved the creation of a National Artificial Intelligence Agency at its meeting on 8 June 2026. Its structure and legal basis had not been published when we checked.[6]

    • The two-year period that existing businesses had to comply with the data protection law ended in October 2023, so the law now applies in full.[1]

    • The Data Protection and Privacy Office publishes standard contractual clauses for sending personal data outside Rwanda, plus registration and DPO designation guides.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Law No. 058/2021 relating to the protection of personal data and privacy: rights and duties

    In force2021People have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or significant effects, unless it rests on explicit consent, a contract or an authorising law (Article 21). A data protection impact assessment is needed for systematic automated evaluation of people, large-scale sensitive data or systematic public monitoring (Article 38). A breach must be notified to the regulator within 48 hours, with a written report within 72 hours (Articles 43 and 44).[1]

    Law No. 058/2021: registration, storage, transfers and penalties

    In force2021Anyone who intends to be a data controller or processor must register with the supervisory authority (Article 29). Personal data must be stored in Rwanda, unless the registration certificate authorises storage abroad (Article 50). Transfers abroad need authorisation, consent or another listed ground, plus a written contract (Articles 48 and 49). Administrative fines run from RWF 2 million to RWF 5 million or 1% of global turnover, and companies convicted of offences face 5% of annual turnover (Articles 53 and 62).[1]

    National Artificial Intelligence Policy

    In force2023This is a government policy, not a law, so it does not create direct duties for companies. It points companies to RURA's Guidelines on the Ethical Development and Implementation of AI and plans to strengthen regulators' capacity on AI. It also plans to register local and foreign cloud providers with NCSA under the data protection law.[3]

    Where AI fits first

    Where AI fits first

    Banking and digital payments

    Fraud detection, credit checks with human review, and customer service in Kinyarwanda, English and French.

    A flagship sector in the AI policy. Automated credit decisions fall under Article 21 of the data protection law, so build in a way for people to get a human review.[3]

    Health care

    Triage support and summarising patient records, with clinicians making decisions.

    A flagship sector in the AI policy. Health data is sensitive data under the law, so processing at scale needs an impact assessment.[1]

    Agriculture

    Crop disease detection from photos and advice for farmers in Kinyarwanda.

    A flagship sector in the AI policy. We found no AI rule specific to agriculture.[3]

    E-commerce and trade

    Product search, demand forecasting and order support chat.

    A flagship sector in the AI policy. Customer data used for profiling is covered by Articles 21 and 38 of the data protection law.[3]

    Your first steps

    Your first steps

    1. Register with NCSA as a data controller or processor before you process personal data, and keep the certificate current.
    2. Find out where your AI tools store data. If any of it sits outside Rwanda, make sure your registration certificate authorises that.
    3. For any transfer abroad, sign a written contract with the recipient. NCSA's standard contractual clauses are a starting point.
    4. List every decision your AI makes about a person and add human review where it has legal or significant effects.
    5. Run a data protection impact assessment before profiling people, using sensitive data at scale or monitoring public spaces.
    6. Set up a breach process that can notify NCSA within 48 hours and file a report within 72 hours.
    7. Read RURA's ethical AI guidelines and watch for news on the National AI Agency.

    AI services for Rwanda

    AI consulting and development for teams in Rwanda

    We work remotely with companies in Rwanda, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Rwanda is on UTC+2 and India on UTC+5:30, a 3.5 hour gap. Taking a 9:00 to 17:00 day in Rwanda and 9:30 to 18:30 in India, the overlap is about 6 hours, from 09:00 to 15:00 Rwandan time.

    Questions

    Common questions about AI in Rwanda

    Does Rwanda have an AI law?

    Not as of 29 October 2026. Rwanda has a National AI Policy from 2023, and Cabinet approved a National AI Agency in June 2026. The data protection law is the main law that applies to AI today.

    Can I use a cloud AI service hosted outside Rwanda?

    Possibly, but check first. Article 50 says personal data is stored in Rwanda unless your NCSA registration certificate authorises storage abroad. Transfers also need a lawful ground under Article 48 and a written contract under Article 49.

    How fast must I report a data breach?

    The controller must notify the supervisory authority within 48 hours of becoming aware of the breach, and submit a report within 72 hours. A processor must tell the controller within 48 hours.

    What are the fines?

    Administrative misconduct, such as operating without registration or failing to report a breach, carries a fine of RWF 2 million to RWF 5 million or 1% of global turnover. A company convicted of an offence such as unlawful sale of personal data faces a fine of 5% of annual turnover.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Official Gazette of the Republic of Rwanda (copy hosted by Gazettes.Africa), 2021-10-15. Law No. 058/2021 of 13/10/2021 relating to the protection of personal d…(archive.gazettes.africa)
      Full title and what we used it for

      Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, Official Gazette Special of 15/10/2021. Primary. Read in the English text. Used for Articles 21, 29, 38, 43, 44, 48 to 50, 53, 62, 67 (two-year transition) and 70 (in force on publication). Later amendments, if any, were not checked.

    2. [2] Data Protection and Privacy Office (NCSA), 2026-10-29. Data Protection and Privacy Office home page(dpo.gov.rw)
      Full title and what we used it for

      Data Protection and Privacy Office home page. Primary. Used for the registration services, the DPO designation guide and the standard contractual clauses for transfers outside Rwanda. No AI-specific guidance was listed when we checked.

    3. [3] Ministry of ICT and Innovation (MINICT), 2023-04-20. The National Artificial Intelligence Policy for the Republic of Rwanda(extranet.who.int)
      Full title and what we used it for

      The National Artificial Intelligence Policy for the Republic of Rwanda. Primary document, read via the copy hosted on the WHO country planning site. Used for the six priority areas, flagship sectors, the Responsible AI Office, RURA's ethical guidelines and the plan to register cloud providers with NCSA.

    4. [4] Ministry of ICT and Innovation (MINICT), 2026-10-29. Artificial Intelligence policy page(minict.gov.rw)
      Full title and what we used it for

      Artificial Intelligence policy page. Primary. Used to confirm the six policy areas, 14 recommendations and the bodies that developed the policy.

    5. [5] Access Partnership, 2023-04-20. Access Alert: Rwandan government approves National AI Policy(accesspartnership.com)
      Full title and what we used it for

      Access Alert: Rwandan government approves National AI Policy. Secondary policy consultancy note. Used only for the Cabinet approval date of 20 April 2023, which the policy document itself does not state. The 14 recommendations come from s4.

    6. [6] The New Times, 2026-06-08. Govt to set up National Artificial Intelligence Agency(newtimes.co.rw)
      Full title and what we used it for

      Govt to set up National Artificial Intelligence Agency. Press report. Used for Cabinet approval of a National AI Agency at the meeting of 8 June 2026. We could not find that meeting's communiqué on the Prime Minister's Office site.

    7. [7] Digital Policy Alert, 2026-06-08. Cabinet approved the establishment of the National Artificial Intellige…(digitalpolicyalert.org)
      Full title and what we used it for

      Cabinet approved the establishment of the National Artificial Intelligence Agency. Secondary tracker. Used to confirm the 8 June 2026 date and that the agency is meant to promote AI development and adoption.

    8. [8] KT Press, 2026-06-08. Rwanda's AI ambition takes shape as Cabinet approves new agency(ktpress.rw)
      Full title and what we used it for

      Rwanda's AI ambition takes shape as Cabinet approves new agency. Press report. Used for the point that the agency's structure, operations and timeline had not been made public.

    9. [9] Office of the Prime Minister, Republic of Rwanda, 2026-10-29. Cabinet Decisions(primature.gov.rw)
      Full title and what we used it for

      Cabinet Decisions. Primary. We read the Cabinet communiqués of 30 June, 24 July, 18 September and 26 October 2026 and found no AI law or AI agency law among the items.

    This is general information, not legal advice. Laws change, and details of the new National AI Agency are known only from press reports. Check with a qualified Rwandan lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Rwanda?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score