AI regulation in Botswana: laws & policy (2026)

The Botswana Communications Regulatory Authority (BOCRA) signed a strategic MoU with cybersecurity firm Cyble to strengthen national cyber-defence using AI-native threat intelligence platforms that monitor the open, deep, and dark web. The deal directly shapes the operational environment for AI systems processing sensitive data and underpins the National Cyber Security Authority being created under the 2025 Cybersecurity Bill.

Botswana's National Assembly passed both bills under a certificate of urgency. The Digital Services Bill establishes a Digital Services Authority to regulate and promote online platforms and transforms the Digital Transformation Office; the Cybersecurity Bill creates a National Cyber Security Authority and a legal framework for protecting critical information infrastructure, together forming the statutory infrastructure for regulating AI-enabled digital services and AI-related cyber threats.

Botswana's Assistant Minister of Communications and Innovation announced the National Artificial Intelligence Policy was at an advanced stage, following UNESCO readiness consultations and collaboration with Estonia on strategy design. The policy is intended to govern responsible and ethical AI adoption aligned with national development aspirations, including home-grown solutions for agriculture, climate modelling, and indigenous language processing.

UNESCO formally rolled out its AI Readiness Assessment Methodology (RAM) across Botswana, Zimbabwe, South Africa, Malawi, Namibia, and Mozambique, evaluating legal/policy frameworks, skills pipelines, data governance, and ethical safeguards. Botswana and Malawi were the first to complete the assessments; the findings directly feed into Botswana's pending National AI Policy.

Assented to on 19 August 2024 and commenced by Ministerial Gazette order on 13 January 2025, the new Act repeals the 2018 law and introduces GDPR-style provisions directly relevant to AI: explicit rights to object to automated decision-making, mandatory Data Protection Impact Assessments, a 72-hour breach-notification duty, and rules for cross-border data transfers, creating the principal legal framework governing AI systems that process personal data in Botswana.

Botswana established the SmartBots Lab as a Centre of Excellence co-created with the UN Economic Commission for Africa, housed within the Botswana Digital Innovation Hub. The Lab serves as Botswana's primary public incubation platform for frontier technologies including AI, directly advancing the national 4IR digital transformation agenda and providing an institutional home for AI innovation policy.

UNESCO convened a sub-regional AI forum for Southern Africa, bringing together governments, academia, and civil society to identify AI governance priorities. This forum initiated the regional AI readiness process that led directly to Botswana's formal AI readiness assessments and the subsequent National AI Policy development process.

After three years of postponements since its 2018 enactment, the original Data Protection Act finally took legal effect via a ministerial commencement order published in the Government Gazette, creating Botswana's first operational data-privacy regime. Although subsequently replaced by the 2024 Act, this was the moment Botswana first had an enforceable data-protection framework applicable to AI-system operators.

The Government of Botswana launched SmartBots, its national 4IR digital transformation strategy targeting a knowledge-based high-income economy by 2036. SmartBots established AI-inclusive digitalisation as a cross-government priority, encompassing connected schools, data-driven public services, and an innovation ecosystem for start-ups, and became the overarching policy framework within which all subsequent AI governance efforts are anchored.

Parliament enacted Botswana's first dedicated data-protection statute, establishing foundational rights over personal data and providing for an Information and Data Protection Commission. The Commission was never established and the Act did not commence until 2021, but the legislation laid the conceptual and legal groundwork for data governance that underpins AI regulation, including the more robust 2024 Act that replaced it.

Parliament enacted the Cybercrime and Computer-Related Crimes Act, criminalising unauthorised computer access, data interference, cyber-fraud, cyber-stalking, and related offences. As Botswana's principal statute governing computer-based wrongdoing, it provides the existing legal basis against which AI-enabled cybercrime and AI system misuse are assessed, and it pre-dates and complements the data-protection framework.