Connected Citizens, Unready Institutions: The Maldives AI Paradox

By Mohamed Jameel, Managing Director, Votex Insights.

Almost every Maldivian is online, and eFaas puts government in their pocket. Yet the state's capacity to govern AI ranks near the bottom globally. Here is why the gap exists, what is changing in 2026, and what a small island state can realistically do.

The paradox in four numbers

The Maldives is a connected society with an under-built AI state: citizens adopted digital tools faster than institutions built the capacity to govern them.

Figure	What it measures	Source
143 / 195	Government AI Readiness	Oxford Insights, 2025 index
8.0 / 100	AI policy capacity score	Oxford Insights, 2025 index
Tier 5	Cybersecurity commitment (lowest tier)	ITU Global Cybersecurity Index 2024
93%	Reef area facing high heat stress by 2080 (high-emissions scenario)	UN Maldives

UNESCO's AI readiness assessment, launched in Malé on 31 July 2025 as the first completed in South Asia, found the other side of the picture: near-universal mobile connectivity, women using the internet at parity with men, and local start-ups building Dhivehi speech technology. The problem is not public appetite. It is institutional capacity.

How the Maldives compares

The weakest Oxford pillar is policy capacity, the ability to set and fund a national AI direction. Among South Asian countries, only Afghanistan ranks lower. Island peers show the gap is not inevitable: Mauritius sits 76 places higher.

Corrected figures: The research brief listed Mauritius 68th, Barbados 98th, Sri Lanka 108th and Fiji 128th, and gave the Maldives a rank of 177 of 194 in the ITU index. The official 2025 Oxford table shows 67th, 155th, 80th and 108th. The ITU's 2024 index publishes tiers, not ranks, so we show tiers here.

Island peers

Country	Oxford rank (2025, of 195)	Policy capacity	ITU GCI 2024 tier
Mauritius	67	65.5	Tier 1 · Role-modelling
Fiji	108	15.5	Tier 4 · Evolving
Seychelles	140	8.0	Tier 4 · Evolving
Maldives	143	8.0	Tier 5 · Building
Barbados	155	15.5	Tier 4 · Evolving

Oxford Insights Government AI Readiness Index 2025, policy capacity pillar, island peers.

South Asia

Country	Oxford rank (2025, of 195)	Policy capacity	ITU GCI 2024 tier
India	27	96.0	Tier 1 · Role-modelling
Bangladesh	75	69.0	Tier 1 · Role-modelling
Sri Lanka	80	72.5	Tier 2 · Advancing
Pakistan	81	61.5	Tier 1 · Role-modelling
Bhutan	101	12.0	Tier 3 · Establishing
Nepal	106	49.5	Tier 3 · Establishing
Maldives	143	8.0	Tier 5 · Building
Afghanistan	188	0.0	Tier 5 · Building

Oxford Insights Government AI Readiness Index 2025, policy capacity pillar, South Asia.

Where AI is already at work

The strongest work is where AI meets the reef. Kanuhura's coral survey shows what is possible when a resort, a scientist and good tooling come together. The weakest links are the sectors that matter most to outer-island life: fisheries and primary healthcare.

Sector	Stage	What is happening	Main constraint	Basis
Tourism	Private and closed	Resort groups use data tools for pricing, revenue management and guest service.	The data and the learning stay inside companies; little flows into shared national capability.	Described in the research brief; not independently measured.
Marine conservation	Working pilots	Six Senses Kanuhura's Coral Census pairs underwater photogrammetry with AI. One survey covered 1,027 coral colonies in about 20 minutes, against roughly seven hours by traditional methods.	Project-by-project funding and no shared national reef-data platform.	National Geographic reporting on Kanuhura's Coral Census.
Public administration	Scaled foundation	eFaas, the national digital identity, connects people to government services. The Maldives Digital Service replaced NCIT on 15 January 2026 to lead the Maldives 2.0 roadmap.	Ministry data sits in separate systems, and core functions such as face verification depend on foreign vendors.	President's Office, 15 Jan 2026; Mohamed Shareef's ITU Kaleidoscope 2026 paper.
Healthcare	Early	Video teleconsultation links outer islands to doctors, mostly in Malé.	Specialists are concentrated in the capital; no validated AI screening tools are in routine use on outer atolls.	Described in the research brief; not independently measured.
Fisheries	Early	Basic vessel tracking; little use of predictive or on-board AI.	Satellite connectivity and rugged on-vessel hardware are expensive for small fleets.	Described in the research brief; not independently measured.
Education and Dhivehi language	Foundations	Local firms are building Dhivehi tools: Javaabu published a 16.5-hour single-speaker speech dataset, and Synetecs' Thaana AI offers Dhivehi speech-to-text (launched June 2025).	Small public text corpora and a thin pipeline of specialist faculty and researchers.	Javaabu dataset on Hugging Face; Thaana AI; UNESCO RAM launch note (31 Jul 2025).

Why the gap persists

Three structural constraints keep pulling in the same direction.

1. Compute lives offshore. International bandwidth has improved, including Ooredoo's PEACE cable landing at Kulhudhuffushi, but there is little local capacity to train or run AI models. Data travels to foreign clouds, with cost, latency and legal questions attached.
2. Dhivehi is a low-resource language. Global models are trained mostly on Latin-script text and handle Thaana script poorly. Local datasets are growing but remain small.
3. Talent is thin and mobile. Government struggles to keep engineers and data specialists who can evaluate vendors' claims, so procurement defaults to turnkey foreign products.

Each constraint is manageable on its own. Together they create dependence: a state that can pass laws about AI but cannot easily inspect the systems those laws are meant to govern.

The trilemma small states face

The Amplified Sovereignty Paradox: AI-driven public services press on individual, national and technical sovereignty at once.

Mohamed Shareef, the Maldives' former Minister of State for Environment, Climate Change and Technology (2021–2023), calls this the Amplified Sovereignty Paradox. His 2026 ITU Kaleidoscope paper, which won the conference's first-prize best paper award, argues that AI turns an old two-way tension into a three-way one. Pick one priority and see what it costs.

If leaders prioritise	The choice	The likely cost
Rights	Refuse biometric and automated systems to protect citizens' rights.	People, especially on outer islands, lose access to faster digital services.
Autonomy	Insist on in-country data and escrowed models.	Vendors decline to bid or charge prices a small budget cannot carry.
Control	Require open, fully auditable algorithms.	Few or no commercial vendors qualify.

Sovereignty on paper does not survive when the technical substrate is elsewhere.

Mohamed Shareef, The Amplified Sovereignty Paradox, ITU Kaleidoscope 2026

Two forces sharpen the trade-off. Automated systems decide faster than a small regulator can review, and Shareef notes that a typical small-island data protection authority has one to five technical staff. And because foundation models are built abroad, a small buyer often must accept a vendor's terms or go without the service.

What is on the books

Status as found on 10 November 2026.

Instrument	Status	Date
Constitution, Article 24 (privacy)	In force	2008
Electronic Transactions Act (Law 2/2022)	In force	Ratified 27 Apr 2022
Cyber Security Act (Law 17/2023)	In force	2023
National Cyber Security Agency	Established	18 Mar 2024
Cybercrime Act	Enacted	Dec 2024
National AI Masterplan 2025–2035	First draft	Ordered Oct 2024; draft done Sep 2026
Maldives Digital Service (replaces NCIT)	Established	15 Jan 2026
AI regulation bill	Announced	Apr 2026
Personal Data Protection Bill	In committee	Filed 11 May 2026

There is still no standalone AI law and no comprehensive data protection statute in force. The Personal Data Protection Bill would make the Information Commissioner the Privacy Commissioner, regulate cross-border transfers, and require breach procedures. The Majlis accepted it unanimously on 22 June 2026 and sent it to its ICT committee.

Five safeguards, three steps

Shareef's answer is not to copy the EU AI Act. It is five testable requirements, each with three conformance classes, so a small agency can start at Class A with what it has and climb as capacity grows.

Requirement	Class A · start now	Class B · citizen-facing	Class C · advanced
R1 Decision transparency	Logging only	Logging plus a citizen portal and weekly cryptographic anchor	Daily anchor plus an audit interface
R2 Data residency and escrow	Biographic data kept in-country	Biographic and biometric data; annual attestation	Full residency; quarterly, automated verification
R3 Model change notice	14-day internal notice	30-day notice with basic public disclosure	30-day notice, public registry, third-party checks
R4 Human redress	Outcome shown; no service level	Top three factors shown; median review within 72 hours	Interactive explanation; review guaranteed within 48 hours
R5 Procurement transparency	Annual, non-public disclosure	Quarterly disclosure with notifications	Public summaries plus vulnerability scanning

Requirement	Protects	The idea	Readiness	Proposed ITU-T home
R1 Decision transparency	Individual sovereignty	Automated eligibility decisions leave tamper-evident logs that citizens can see.	Near-term, as a light software layer	SG17
R2 Data residency and escrow	National sovereignty	Citizen data stays in the country, and model artefacts are held in escrow with clear release conditions.	Aspirational; depends on regional cloud capacity and cost	SG13
R3 Model change notice	Technical sovereignty	Vendors announce significant model updates in advance, with fairness test results.	Aspirational; needs specialist review capacity	SG16 and SG17
R4 Human redress	Individual sovereignty	Every automated decision can be reviewed by a person with power to overturn it.	Near-term, as a light software layer	SG20 and SG16
R5 Procurement transparency	National sovereignty	Vendors disclose a machine-readable software bill of materials, data sources, sub-processors and jurisdictions.	Needs vendor integration testing first	SG17 and SG13

Shareef is candid about limits. Strict data residency can be costly where electricity is diesel-generated, and a regulator who receives technical notices it cannot assess risks compliance theatre. His conclusion is regional: shared audit capacity that no single island could sustain alone.

What would help

1. Pass the Personal Data Protection Bill with an independent, adequately staffed commissioner.
2. Write decision logs and human review into public procurement now, as Class A requirements cost little.
3. Publish public-sector text, such as legislation and judgments, in machine-readable Dhivehi to grow open language data.
4. Point donor funding, such as the World Bank's US$10 million DMADD grant approved in June 2022 for digital ID, broadband and climate data, at shared infrastructure rather than one-off pilots.
5. Pool audit and negotiating capacity with other small island states.

What this means for leaders

Most of this is national policy, but the same pattern shows up inside organisations. A resort, a bank or a ministry can adopt AI faster than it builds the judgement to supervise it. The vendor's dashboard looks finished; the question of who can explain, check and overturn its output often goes unasked.

Leaders do not need to wait for the Majlis. Ask three questions before the next AI purchase: where does our data go, who can explain a decision this system makes, and what happens when someone disagrees with it. Name a person for each answer. That is the organisational version of Class A, and it costs attention rather than money.

The Maldives does not lack connection. What it needs now is the capacity to stay in charge of what it connects to.

About this article

This is a Votex Insights explainer adapted from an unpublished research brief titled Bridging the Algorithmic Divide, shared with us in November 2026. The brief does not name an author, and we could not find a published version. We rewrote its argument in our own words and checked headline figures against primary sources, dating each one.

Where the brief and primary sources disagreed, we used the primary source. We also left out claims we could not confirm, including a "National AI Policy 2026–2031", which appears to be an independent academic paper rather than a government document. The trilemma framework and the five requirements are Mohamed Shareef's; any simplification is ours.

Sources

1. Government AI Readiness Index 2025 (full report) — Oxford Insights, Jan 2026
2. Global Cybersecurity Index 2024 — ITU, Sep 2024
3. Maldives concludes South Asia's first AI Readiness Assessment — UNESCO, Aug 2025
4. The Amplified Sovereignty Paradox (paper) — ITU Kaleidoscope 2026 · Mohamed Shareef, 2026
5. The Amplified Sovereignty Paradox (slides) — ITU Kaleidoscope 2026, 2026
6. The real test of AI governance is in small island states — GovInsider · Mohamed Shareef, 2026
7. President announces AI masterplan — President's Office, 17 Oct 2024
8. First draft of AI Master Plan completed — MMTV, 28 Sep 2026
9. Maldives Digital Service established, NCIT abolished — President's Office, 15 Jan 2026
10. National Cyber Security Agency constituted — President's Office, 18 Mar 2024
11. Personal Data Protection Bill submitted — One Online, 11 May 2026
12. Parliament sends data protection bill to committee — One Online, 22 Jun 2026
13. President announces AI law plans — MV+, 21 Apr 2026
14. Electronic Transactions Bill ratified — President's Office, 27 Apr 2022
15. Extreme heat and coral reefs in the Maldives — United Nations Maldives
16. Can AI save the Maldives' coral reefs? — National Geographic
17. World Bank supports Digital Maldives (DMADD) — World Bank, 2 Jun 2022
18. Dhivehi Shaafiu speech dataset — Javaabu · Hugging Face
19. Thaana AI — Synetecs