In April 2026, Mauritius launched its National AI Strategy and FAIR Guidelines. Since then, a fair amount of commentary (including an earlier version of this article) has filled in the gaps between what the government actually published and what SME owners assume it must mean for them. Some of that filling-in overstates the opportunity. Some of it overstates the risk. Both are worth correcting, because a real business decision might rest on either one.
What was actually launched
The strategy, covering 2025–2029, was developed by the Ministry of Information Technology, Communication and Innovation with technical and strategic support from UNDP, and launched on 9 April 2026. Alongside it, the FAIR Guidelines (Fairness, Accountability, Inclusiveness and Integrity, and Responsibility) set out a responsible-AI framework. According to the AI Unit's own published material, FAIR is explicitly scoped as principles for the public sector.
The strategy's confirmed emphasis areas are infrastructure modernisation, skills and training, innovation and ecosystem-building, governance, and sector-by-sector AI adoption. Two elements are particularly relevant to startups and smaller businesses. The Ministry has stated that provisions are being made to facilitate the registration of startups and safeguard the local AI industry: a policy commitment, not yet a described operational process. Separately, and already introduced, is the Regional AI Marketplace: a mechanism hosted on the AI Unit's own site intended to connect local startups, businesses, and solution providers with public institutions. The broader AI Unit framework also lists Regulatory Sandboxes (controlled environments to test emerging AI technologies under regulatory oversight) as part of its innovation strategy, without detail yet on access for smaller businesses specifically.
The Mauritius AI Policy Map: what the National AI Strategy confirms, what remains unconfirmed for startups and smaller businesses, and what already applies today under a separate, existing law.
What this means in practice
The absence of a new private-sector obligation under FAIR does not mean AI use in Mauritius is legally unregulated. Those are two different questions, and it's worth being precise about which one you're answering.
The first question is whether the National AI Strategy itself creates new compliance obligations for a private business. Based on the sources reviewed here, the answer is not yet. The published FAIR Guidelines are scoped to the public sector, and no new AI-specific private-sector liability regime is established in the National AI Strategy or FAIR materials reviewed for this article.
The second question is whether AI use is regulated at all. The answer is yes, and this predates the new strategy entirely. The Data Protection Act 2017 already gives individuals a right, under Section 38, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or otherwise significantly affects them. This is narrower than it sounds: Section 38 is relevant to decisions based solely on automated processing, including profiling, where the decision produces legal effects or significantly affects the individual, not to any system that merely assists or informs a human who remains the actual decision-maker. A system that screens job applications and rejects candidates without human review sits differently than one that drafts a shortlist for a hiring manager to review and decide on; the wider Data Protection Act may still have something to say about the second case wherever personal data is processed, but Section 38 specifically concerns the first. Where Section 38 does apply, the Data Protection Office's own guidance sets out real obligations: it provides exceptions where the decision is necessary for entering into or performing a contract, authorised by law, or based on explicit consent, subject to the safeguards required by the Act; the business must tell affected individuals that automated decision-making is happening and explain the logic and consequences; and the business must have safeguards in place to protect the person's rights. This is general information about how existing law is described in the sources reviewed, not legal advice for a specific system: a business with a system that plausibly triggers Section 38 should get an actual legal opinion, not rely on a blog post.
Financially, nothing has changed. No SME-specific financing, grant, or subsidy scheme tied to the National AI Strategy has been confirmed in the sources reviewed for this article. If one exists, it hasn't appeared in the official launch materials: treat any claim to the contrary as something to verify directly with the AI Unit before acting on it.
Put together: this is a clear policy direction, a couple of concrete provisions relevant to startups and smaller businesses, and, separately, an existing, narrower legal obligation around solely-automated personal-data decisions that has nothing to do with how new or old the AI Strategy is. Building good governance habits now is a reasonable bet on where the newer policy direction is heading; getting Section 38 right, if it applies to you, is not a bet: it's a current obligation.
Five moves worth making now
- Name the business problem, not the technology. Identify which specific operational problem you want AI to solve before evaluating any tool: the strategy doesn't change this basic discipline.
- Assign an owner. One named person tracks what AI tools are in use, what data they touch, and stays aware of policy developments as they're actually published, not as they're rumoured.
- Check whether Section 38 applies before you deploy. If a system will make a decision about a person (hiring, credit, pricing, eligibility) based solely on automated processing, with no genuine human review, treat it as a Section 38 question, not just a data-quality one, and get that checked properly.
- Write a short, honest usage policy. A one-page document stating what data may never be entered into public AI tools protects the business regardless of what becomes legally required later. See a minimum viable AI governance framework for SMEs for a fuller version of this.
- Look into what's actually available. If you're a startup or a growing business, the Regional AI Marketplace is a real, already-introduced mechanism worth checking directly through the AI Unit's own site (aim.govmu.org), along with the current status of the startup-registration commitment, rather than through secondhand summaries, including this one. For a fuller sequence from diagnosis through to scaling, see the Mauritius AI Adoption Roadmap.
None of this requires waiting for further legislation. Some of it (the Data Protection Act piece) was never waiting on anything. It requires reading what was actually published, which is what this article has tried to do.
