AI Governance in Mauritius: The Evidence a Pilot Needs Before Approval

AI governance in Mauritius means deciding who may use an AI system, for which decisions, with what evidence and under whose authority. Before approving a pilot, an institution should be able to show the permitted use, the data boundary, the tests, the human review and the method for stopping it. A national strategy provides direction. It does not make those operating decisions for the board.

B Hub Consulting has an interest in this question: our Digital Transformation & AI practice sits alongside a working engineering practice. This is our proposed method for turning a governance mandate into reviewable evidence. It is an institutional design guide, not a legal opinion or a claim that completing a template confers regulatory approval.

Start with the decision the system is allowed to influence

A proposal to deploy an assistant is too broad to govern. A proposal to draft an internal answer from an approved collection of policies is more useful. It identifies an input, an output and a person who can check the output before it changes anything. Write that sentence before comparing technical options. Then describe the decisions the system must never make.

Consider a hypothetical Mauritian institution answering service enquiries. Finding the relevant published procedure, drafting an answer and deciding an applicant’s eligibility are different uses. Approval for the first should not silently become approval for the last. Keep the pilot boundary visible in the interface, in staff instructions and in the record presented to the sponsor. A boundary that exists only in a proposal will be difficult to enforce during a busy working day.

Name a business owner who can accept the residual risk, an operator who can suspend the service and a reviewer who understands the underlying work. These can be existing roles. They cannot be an unnamed committee. Record who covers absence and who can decide when the business owner and technical operator disagree. Otherwise an urgent exception will become an improvised policy.

Read the national principles without confusing them with project approval

The Mauritius AI Unit, read on 20 September 2026, presents the national strategy and FAIR principles: fairness, accountability, inclusiveness and integrity, and responsibility. The government portal also provides the national strategy and public-sector guidance. That material establishes the policy context; the sponsor still needs to establish which obligations and approvals apply to its own institution and use.

Translate each principle into a question a reviewer can answer. Which users are poorly served by the proposed workflow? Who must explain an erroneous result? Can someone use the service without relying on the AI channel? Who decides whether an unresolved defect prevents release? Record the evidence alongside the answer. A statement that a project is responsible is an intention, not a test result.

For an organising structure, the NIST AI Risk Management Framework core, read on 20 September 2026, uses Govern, Map, Measure and Manage. NIST describes continuous, contextual risk management rather than an ordered checklist, and says a revised framework is in progress. The approval pack below is our suggested implementation aid, not a NIST certification scheme or a substitute for Mauritian requirements.

Make the approval pack a set of evidence, not a presentation

Each assertion in the proposal should point to something the approver can inspect. If the team says access is restricted, show the permission test. If it says an operator can stop the service, demonstrate the stop and the fallback. Keep the evidence in a location the institution controls, with the system version and reviewer attached. A slide saying that testing passed is not enough to reproduce the decision.

The data flow deserves a separate attachment. Include the information submitted by staff, retrieved documents, generated outputs, operational logs and any copies used for evaluation. Ask which party can inspect each copy and how long it remains available. Our guide to data residency in Mauritius addresses the distinct hosting and transfer questions. A governance sign-off should reference that assessment rather than pretend that selecting a hosting region answers every data question.

Record uncertainty explicitly. Supplier behaviour that has not been demonstrated belongs in the unresolved column. So does an unavailable contractual term. Ask whether the pilot can proceed with a narrower scope while that issue is resolved. If it cannot, the decision is to defer. An empty field should never be read as an implied acceptance of risk.

Test the whole decision path before widening access

The NIST Measure playbook, read on 20 September 2026, provides context for evaluation and monitoring. For a pilot approval, we recommend a practical rehearsal that includes the person using the result. A technically plausible answer can still be unusable if the reviewer cannot locate its source or understand when it should be rejected.

1. 01Choose a real workflow. Use an approved, representative case with permission to use its information. State the acceptable outcome before viewing the generated answer, so the result cannot redefine success after the event.
2. 02Introduce a difficult case. Try an incomplete request, conflicting source documents or a question outside the permitted scope. Observe whether the system admits uncertainty and whether the reviewer can route the case correctly.
3. 03Test the access boundary. Use an authorised test account that should not see a selected document. Check both the retrieved material and the answer. Merely hiding a document in the interface does not demonstrate that retrieval respects the same permission.
4. 04Reject an output. Ask the reviewer to correct the result, record why and continue through the established process. The exercise should reveal whether review is meaningful or just an approval button in front of an opaque answer.
5. 05Run the fallback. Suspend the AI function through the approved operating procedure and complete the task another way. Record the people, information and capacity needed to keep the service usable.

Set acceptance criteria according to the consequence of an error. There is no universal accuracy percentage in this worksheet. A drafting aid and an eligibility decision do not have equivalent failure costs. Separate factual errors, unsupported answers, inappropriate disclosure and failures to escalate. An attractive aggregate score can hide the particular defect that makes a proposed use unacceptable.

For services that use more than one language, include the languages and phrasing the approved workflow actually encounters. Do not assume a successful English demonstration proves the same performance in French or Mauritian Creole. Have competent reviewers assess the relevant cases and record gaps before expanding the permitted audience. The scope of the evidence should match the scope of the approval.

Govern changes and incidents after the pilot starts

Approval attaches to a defined configuration and use. A new source collection, a different supplier, broader permissions or a new action the system can execute may change the risk. Maintain a change record that explains what changed, which previous tests remain relevant and which must be repeated. The person approving the release should see unresolved defects as well as improvements.

The NIST Govern playbook, read on 20 September 2026, addresses roles, policies and oversight across the lifecycle. Our operational recommendation is to give each control an owner and a visible review trigger. A supplier change can trigger technical reassessment; a complaint about a consequential output can trigger suspension of the affected use. Define those triggers while the team has time to reason about them.

An incident record should distinguish what the system produced, what a person saw and what action actually followed. Preserve enough approved evidence to investigate without collecting unnecessary personal information. Establish who decides whether affected work must be checked again and who handles any required communication. The incident is not closed merely because the immediate defect has been patched; the institution still needs to address the consequences of the earlier output.

For oversight, report a decision rather than an activity count: continue within the approved scope, reduce the scope, suspend the use or seek fresh approval. Attach the evidence behind that recommendation. A board should be able to understand the unresolved risk without reading application logs, while the operator should be able to trace the recommendation back to the cases that produced it.

Buy the missing capability and keep ownership inside the institution

An advisory scope should say whether it produces a decision framework, implements controls or operates the resulting service. Ask for the acceptance evidence and handover in the proposal. Specify who owns the configuration, evaluation cases, operating instructions and access arrangements. A document that requires its author to interpret every field has not transferred much capability.

B Hub’s combination of advisory and engineering is relevant when the institution needs those layers connected. The institution should still retain the accountable sponsor and make its own approval decision. Fees and a completion date for a particular mandate are not published in this guide: they require a defined scope, available evidence and clarity about who will operate the system.

Where it is the wrong choice: statutory audit, tax filing and company administration are different mandates. A legal opinion belongs with qualified legal counsel. If the deciding criterion is the cheapest hourly rate, this principal-led advisory and engineering scope is unlikely to be the appropriate comparison. State the actual deliverable first, then choose the type of adviser.

For the workflow that follows approval, read the institutional buyer’s test for AI automation in Mauritius. For the wider procurement decision, read our guide to choosing an AI consultant in Mauritius. If your institution needs to turn a proposed pilot into an accountable operating design, describe the mandate.