AI Automation in Mauritius: The Institutional Buyer’s Workflow Test

AI automation in Mauritius is a buying decision about a specific workflow, not a decision to install a chatbot everywhere. For a bank or public institution, start with one queue of work, mark each step as a fixed rule, a judgement that AI may assist, or a decision that a person must make, and define how an error is found and reversed. A supplier can demonstrate a persuasive answer in minutes; the institution still has to own the data boundary, exceptions, approvals and operating record after the demonstration ends.

Where we sit. B Hub Consulting advises institutions on digital transformation and builds software through its AI & Application Development practice. We have an interest in this market. Our recommendation is to buy the smallest controlled workflow that passes the tests below, whether B Hub builds it or another supplier does. A standard product may be the better purchase when it already handles your policy, integration and support model.

AI automation in Mauritius should start with a reversible workflow

A first project is a poor place to automate a final decision about a person. It is a good place to reduce the time spent locating information, classifying incoming work or drafting a response that an accountable officer checks. The distinction is whether the mistake is visible before it reaches the applicant, customer or regulator. A document triage queue can be sampled and corrected; a silent adverse decision cannot be treated in the same way.

The point of the table is to stop the phrase “end-to-end automation” from hiding five different risks. A deterministic completeness check is not the same as a model interpreting a letter, and neither is the same as deciding a person’s eligibility. Write the distinctions into the requirements and the acceptance tests. If the proposed workflow cannot be divided this way, the institution has not yet defined what it is buying.

Separate the rule, the model and the officer in the design

For each step, record the input, source system, permitted data, transformation, output, reviewer, retention rule and fallback. A model output should say which source passage or case field supports it. A fixed rule should point to the version of the policy it implements. A human approval should be recorded with the decision, not represented by a button that anyone can press on a shared account. That record is what makes an incorrect result investigable later.

The NIST AI Risk Management Framework Core, read 13 October 2026, organises voluntary risk work into govern, map, measure and manage. It explicitly says those functions are not a prescribed checklist or a fixed sequence. For a procurement team, the useful translation is concrete: name an owner, map the workflow and affected people, measure failure on real cases, then define who stops or changes the system when the measures deteriorate. NIST is a design reference here, not Mauritian law.

Keep the first release narrow enough to inspect. A bank may begin with sorting correspondence for staff review; a ministry may begin with locating the right published guidance for an officer. The system should retain the original material and the source of every suggestion so reviewers can disagree with it. The wider AI governance approval guide describes the evidence an institution needs before a pilot is widened.

Section 38 draws a boundary around decisions about people

The Data Protection Act 2017, section 38, read 13 October 2026, gives a data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects that person. Section 38(2) states exceptions for a decision necessary for a contract, authorised by a law with safeguards, or based on explicit consent. Those conditions require legal assessment in the particular case. The rule is not a blanket prohibition on every automated step, and putting a nominal reviewer after an automatic decision does not by itself explain who exercised judgement.

The Data Protection Office explanation, read 13 October 2026, uses loan and recruitment decisions as examples of automated individual decision making and describes the information that must be given to the person. Put this question in the design review: could the output itself decide access, employment, credit or another significant outcome before a person genuinely reviews it? If yes, the legal and operating design should be settled before a supplier is invited to automate it. This is a commissioning guide, not legal advice.

The location of data is a separate question from the decision boundary. A service can keep an interface in Mauritius while sending prompts, documents, logs or backups elsewhere. Map each transfer and processor in the architecture, then read our data residency guide for Mauritian institutions before signing a hosting claim. A vendor saying “local” without naming every processing and recovery location has not answered the question.

Contract for evidence rather than a demonstration

A proposal should identify a named business owner, technical owner and escalation route. Ask the supplier to run your own representative cases through the whole path, including a bad scan, a missing field, a contradictory source and a revoked user permission. Record the expected result before the test. A polished prompt against a curated example is not evidence that a production queue will work.

• Data boundary. The agreement names input systems, processors, storage, logs, training use, deletion and recovery locations. Where a location or retention period is not published, require it in the contract rather than assume it.
• Evaluation record. Keep a held-out set of institution-owned examples with an approved answer or disposition. Report extraction errors, false escalations and missed exceptions separately.
• Operating record. Preserve source references, model or rule version, reviewer identity, decision and correction. Do not let a vendor substitute a dashboard total for a case-level audit trail.
• Fallback. Staff can process the queue when the model, network or supplier is unavailable, and the institution knows how to export its data and configuration.
• Change control. Specify who approves a new policy document, model change, prompt, integration or threshold and what regression test must pass first.

A marketplace listing can help discover suppliers, but it is not a quality mark. The Government of Mauritius AI Unit site, read 13 October 2026, says its Regional AI Marketplace is a facilitation tool and that listing does not constitute official endorsement, certification or a guarantee of quality. The institution still conducts its own due diligence. Ask every bidder to show the same acceptance evidence on the same cases.

Build, configure or outsource according to who owns the control

A packaged automation tool is sensible when the workflow is stable, its integrations already exist and its access model fits the institution. Configuration is often enough for routing, templates and ordinary approvals. Custom development becomes more defensible when decisions depend on live institutional data, when entitlements differ by case or organisation, or when the evidence trail must join several systems. Outsourcing the whole process is a different purchase: it changes who performs the work, not merely the software used to assist it.

B Hub’s practice areas describe advice and development, while its published software portfolio shows that the engineering capability is operational rather than a slideware promise. That does not make us the right supplier for every workflow. If an institution needs a commodity form builder, an off-the-shelf product should be tested first. If it needs a statutory opinion on the legal basis for processing, appoint the appropriate legal adviser.

Run acceptance tests before any wider deployment

The acceptance test should be written while the workflow is still a diagram. It should include cases the supplier has not seen, decisions on which reasonable reviewers disagree, and an outage. A successful test is not “the answer sounded right”. It is a recorded comparison against the approved case disposition, with each error assigned to a source, rule, model, integration or reviewer process.

1. 01Freeze the scope. Name the one queue, its owner, its inputs and the output the system is allowed to produce.
2. 02Mark the decision boundary. Identify which outputs are advice, which are administrative routing and which could significantly affect a person.
3. 03Test representative exceptions. Include incomplete, conflicting, multilingual and out-of-date material, plus a user who loses access mid-case.
4. 04Prove the fallback. Disconnect the model or integration and have staff complete the queue from the original records.
5. 05Inspect the audit trail. Reconstruct one output from source to review, correction and final decision.
6. 06Set a stop rule. Name who can pause the workflow, what failure triggers that pause, and how pending cases are recovered.

The test also exposes an economic question that vendor pages rarely answer: how much reviewer work remains? If every output needs a full re-read, the institution may have automated the easy step and left the costly one untouched. Measure time to an accepted disposition, the exception queue and rework, using your own baseline. Do not claim savings from a demonstration or from another institution’s case study.

B Hub fits a cross-system mandate and should be judged on the same test

Our AI & Application Development practice can advise on the workflow and build the system where institutional data and governance make that combination useful. The firm’s own practice description says it designs and builds AI systems, web platforms and mobile apps and runs them once live. The buyer should still demand the data map, exception design, evaluation set, operating record and handover from us in writing. Our interest is disclosed, and a competing proposal that meets the same test better should win.

Where it is the wrong choice: if the job is a standard product configuration with no institutional integration, buy from its implementation partner. For statutory audit, tax filing or company administration, use the licensed or specialist provider who does that work. For a legal opinion on section 38, use counsel. B Hub’s role is advisory and software delivery, not a substitute for those functions.

For approval before a pilot grows, read the evidence an AI pilot needs in Mauritius. For the build and handover decision, read how to choose an AI development company in Mauritius. For the hosting and transfer question, read where an institution may host its data. Our practice areas describe the work we take on, and you can put a defined workflow to us in confidence.