AI Regulation in Rwanda: The National AI Policy, Data Protection and Data Centre Rules

AI regulation in Rwanda is moving quickly from policy to institutions, and businesses that build, buy or host artificial intelligence now face a mix of binding data protection rules, sector licensing and fast-developing government policy. There is no standalone AI statute yet, but that does not mean AI is unregulated. This guide explains the rules that already apply, what the National AI Policy commits the government to, how data centres are licensed and where the law is heading. For transaction and project support, see our AI and data centre legal services in Rwanda.

How AI Regulation in Rwanda Works Today

Rwanda regulates AI through three layers rather than one dedicated law:

• Policy: the National Artificial Intelligence Policy, developed by the Ministry of ICT and Innovation (MINICT) and the Rwanda Utilities Regulatory Authority (RURA), sets the government's direction and implementation plan.
• Binding law: Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy governs any AI system that processes personal data. It is supervised by the National Cyber Security Authority (NCSA).
• Sector regulation: RURA licenses data centre and cloud infrastructure under the ICT framework, and sector regulators remain responsible for AI used in their industries.

The institutional picture is also changing. In March 2025 the government signalled plans to bring AI within the ICT legal framework, and in June 2026 Cabinet approved the establishment of a National Artificial Intelligence Agency. At the time of writing, the agency's legal instrument, powers and timetable have not been published, and we have not identified an enacted AI-specific law. Businesses should therefore comply with the rules in force today while preparing for more detailed requirements.

What the Rwanda National AI Policy Requires

The National AI Policy published by MINICT aims to make Rwanda a global centre for AI research and innovation. It sets out six priority areas and 14 key policy recommendations. The six areas are:

• 21st century skills and high AI literacy;
• reliable infrastructure and compute capacity;
• a robust data strategy;
• trustworthy AI adoption in the public sector;
• widely beneficial AI adoption in the private sector; and
• practical AI ethics guidelines.

A policy is not a statute, but the full policy document and implementation plan show where regulation is heading. Points of direct interest to businesses include:

• Ethics guidelines: RURA's Guidelines on the Ethical Development and Implementation of Artificial Intelligence are to be promoted across the AI community, with a forum to discuss sector-specific AI ethics guidelines.
• Regulatory sandboxes: the plan tasks RURA with initiating AI sandbox projects to test innovative solutions in a controlled environment.
• Cloud provider oversight: it plans the registration of local and foreign cloud service providers with the NCSA, as required by the data protection law, followed by compliance audits.
• Institutions: it proposed a Responsible AI Office within MINICT to lead implementation.

In practice, organisations should treat the ethics guidelines as the regulator's expectations now, even though they are framed as guidance. Documenting how an AI product meets them is a sensible step before engaging with public sector clients or regulators.

Data Protection Rules That Apply to AI Systems

For most AI projects, the data protection law is the most important binding source of obligations. It applies to controllers and processors established in Rwanda and also to those outside Rwanda that process personal data of data subjects located in Rwanda. Key provisions for AI include:

• Registration: a person who intends to be a data controller or data processor must register with the supervisory authority, which issues a certificate within 30 working days of receiving a complete application (Articles 29 to 31).
• Automated decisions: data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant consequences, subject to limited exceptions such as explicit consent or contractual necessity (Article 21).
• Impact assessments: a data protection impact assessment is required for high-risk processing, including systematic and extensive evaluation of individuals based on automated processing and profiling (Article 38).
• Breach notification: a controller must notify the supervisory authority within 48 hours of becoming aware of a personal data breach and submit a full report within 72 hours (Articles 43 and 44).

Enforcement is real. Under the law's sanctions chapter, administrative misconduct such as operating without a registration certificate or failing to notify a breach carries a fine of RWF 2,000,000 to RWF 5,000,000 or 1% of global turnover of the preceding financial year. Unlawful use or disclosure of personal data is a criminal offence. Our data protection and cybersecurity team supports registration, impact assessments and breach response.

Data Centres in Rwanda: Licensing and Data Localisation

The National AI Policy places infrastructure at its core. Its implementation plan includes a blueprint for a continental AI-ready hyperscale data centre in Rwanda and tasks the Rwanda Development Board (RDB) with allocating strategic land for data centres. For investors, three legal questions dominate.

1. Where must data be stored?

Article 50 of the data protection law states that controllers and processors store personal data in Rwanda. Storage outside Rwanda is only permitted with a valid registration certificate from the supervisory authority authorising it. Transfers to third parties abroad are separately governed by Article 48, which allows transfers on grounds such as NCSA authorisation with appropriate safeguards, data subject consent or contractual necessity. The full text of Articles 48 to 52 is published by the NCSA's Data Protection and Privacy Office, which also provides an application form for authorisation to store data outside Rwanda. This localisation default is a commercial advantage for local data centres and a compliance point for any business relying on overseas cloud services. For the wider regional picture, read our analysis of cross-border data flows in Africa.

2. Which licence does a data centre need?

Data centre services are licensed by RURA through its licensing portal under Law N° 24/2016 governing information and communication technologies and RURA's electronic communications licensing regulation. A Tier III data centre licence published on that portal illustrates the kind of conditions operators should expect, including:

• remaining a company constituted under Rwandan law, with the business managed from Rwanda;
• interconnecting directly or indirectly with the Rwanda Internet Exchange Point;
• real-time monitoring of power, cooling, network, compute and security systems, with critical incidents notified to RURA within 15 minutes;
• an annual regulatory fee equal to 1% of annual turnover and a contribution to the Universal Access Fund; and
• environmental and e-waste management obligations.

That licence expressly covers AI data centre infrastructure, high-performance computing and AI model training and inference. Conditions for any specific project are set in its own licence, so they should be negotiated and reviewed before financial close.

3. What incentives are available?

RDB's ICT investment page lists a 15% corporate income tax rate for registered ICT firms, possible tax holidays of up to seven years for significant investments, VAT exemptions on certain IT equipment and immigration facilitation for specialist staff. Eligibility depends on conditions in the investment framework, which we explain in our guide to investment incentives in Rwanda. Projects with a government counterparty may also be structured as public-private partnerships.

Practical Steps for Businesses Using or Hosting AI

• Map your data: identify which datasets are personal or sensitive, where they are stored and which cloud or AI vendors can access them.
• Register and document: confirm NCSA registration as controller or processor, keep processing records and complete impact assessments for profiling or automated decision-making.
• Plan for localisation: where data is stored or transferred abroad, obtain the relevant NCSA authorisation before go-live, not after.
• Contract carefully: AI and hosting agreements should allocate data protection duties, security standards, incident reporting and liability. Our guide to commercial contracts in Rwanda covers the fundamentals.
• Protect outputs and training data: clarify ownership of models, datasets and outputs with intellectual property advice in Rwanda.
• Monitor the AI Agency: track the National AI Agency's establishing instrument and any rules it issues, as these may add new obligations.

Frequently Asked Questions

Does Rwanda have an AI law?

Not yet. AI is governed by the National AI Policy, RURA's AI ethics guidelines, the data protection law and sector licensing. The government has signalled plans to address AI in the ICT legal framework, and Cabinet approved a National AI Agency in June 2026.

Who regulates AI in Rwanda?

Responsibility is shared. MINICT leads policy, RURA issued the AI ethics guidelines and regulates ICT infrastructure, and the NCSA supervises personal data processing. The new National AI Agency is expected to play a central coordinating role once its mandate is formalised.

Must personal data be stored in Rwanda?

As a default, yes. Article 50 of Law Nº 058/2021 requires personal data to be stored in Rwanda unless the controller or processor holds a registration certificate from the supervisory authority authorising storage abroad.

Do I need a licence to operate a data centre in Rwanda?

Yes, data centre services offered to customers are licensed by RURA under the ICT law. The licence sets technical, reporting and fee obligations, so it should be reviewed early in project planning.

Can AI make automated decisions about customers in Rwanda?

Only within limits. Individuals have the right not to be subject to solely automated decisions with legal or significant effects, unless an exception applies, such as explicit consent, contractual necessity or authorisation by law with suitable safeguards.

Conclusion

AI regulation in Rwanda already has teeth through data protection and licensing rules, and the new National AI Agency signals that more detailed governance is coming. Businesses that map their data, settle localisation and licensing early and contract carefully will be best placed to benefit from Rwanda's ambition to become a leading AI hub.

Speak to WAYAN about our AI and data centre legal services, or book a consultation with our team to review your AI project or data centre investment in Rwanda.