Linkedin-in Facebook-f Twitter

For teams putting AI into real systems

Zimbabwe has an AI strategy. Here is how to build with it.

The government has set the direction. There is a National AI Strategy to 2030, a national data platform called Project Pangolin, a regulatory sandbox called the Innovation Crucible, and a data protection regime under the Cyber and Data Protection Act that POTRAZ is preparing to inspect. What each bank, insurer, telecom company or ministry still has to work out is how to put AI into its own systems and keep it running. This page shares that know-how openly. Anyone can use it.

Read the eight patterns Get a free design review

Independent perspective based on publicly available information. It is not commissioned by and does not represent the Ministry of ICT, POTRAZ, the AI Strategy Implementation Office or the Government of Zimbabwe. No AI company, cloud company or software seller pays for this page.

Free to use

Everything on this page can be used without asking permission.

Independent

No AI company, cloud company or software seller pays for this page. Where there is a choice between suppliers, the page shows the pros and cons and leaves the choice to you.

Based on public facts

Every statement about the national programme comes from a public source listed at the bottom. Where something is an opinion, it is called an opinion.

Where things stand

What the country has decided, and what each organisation still decides

The national strategy, launched in March 2026, settles the big questions. The questions below it are the ones that come up on the first day of any AI project.

  1. 1Settled by the country. A national AI strategy with six priorities, five flagship programmes, and a timeline to 2030.
  2. 2Settled by law. Under the Cyber and Data Protection Act and SI 155 of 2024, every organisation that processes personal data must hold a data controller licence from POTRAZ. Under Regulatory Notice 2 of 2026, POTRAZ inspections of licensed organisations are due to begin in September 2026, starting with banks, insurers, hospitals, schools, universities, mining companies and ministries.
  3. 3Being built by the country. Project Pangolin, the national data platform. The Innovation Crucible, a regulatory sandbox where new products are tested under supervised rules. The Mugove Fund, which co-invests in AI startups. Nzwisiso.ai, a national AI literacy programme.
  4. 4Decided by each organisation. Where the AI runs. What data it is allowed to see. How customers reach it on the phones they actually own. What it costs in US dollars over five years. Who looks after it in three years. These are the patterns on this page.

The big picture

How AI fits inside a bank, insurer or ministry

One picture of all the moving parts, from the phone in a customer's hand down to the national platforms the organisation will connect to. The colours show what most organisations already have, what each one has to build, where there is a choice to make, and what the country is still putting in place.

Layered diagram of AI inside a Zimbabwean organisation, from customer channels down to the national platforms
Most organisations have this already Each organisation builds this A choice, with pros and cons on this page Being built by the national programme, due by 2030
The diagram in words
  1. Ways customers reach the service, which most organisations already have: USSD and SMS on basic phones, WhatsApp, phone calls in Shona, Ndebele and English, websites and apps, branches and agents, and connections to partner companies.
  2. AI services the organisation builds: a customer assistant, reading documents, decision support for loans and fraud, forecasting, and helpers for staff.
  3. An AI gateway, built by the organisation: a single front door that checks each request, chooses which AI model answers it, blocks what is not allowed, counts the cost, and keeps a record.
  4. Where the AI model comes from, which is a choice: run it on your own servers, use a regional cloud such as Cassava AiCloud, or use a global service. Beside that, the data the organisation controls: its core systems, its data platform, and a search index kept inside Zimbabwe.
  5. Rules and day to day running: the data controller licence under SI 155 of 2024, readiness for a POTRAZ inspection, someone checking for bias and errors, a named owner for each AI model, and a plan for when something breaks or a supplier leaves.
  6. National platforms to connect to, being built by the country: Project Pangolin, the Innovation Crucible sandbox, and national AI services including Nzwisiso.ai.

The eight patterns

Eight problems every Zimbabwean AI project meets, and how to handle each one

A pattern is a tried answer to a problem that keeps coming up. Each one below says what the problem is, what you need in place, what usually goes wrong, and when you should leave it alone. Use them as a checklist in your first planning meeting.

Pattern 1

Let AI read your documents without sending them abroad

The problem
AI is useful for reading forms, claims and contracts. Most AI services run on servers outside Zimbabwe. Your data controller licence under SI 155 of 2024 sets out where customer data may be processed, and a POTRAZ inspector may ask you to show it.
What you need
Store the documents and the search index in Zimbabwe. Send the AI model only the passages it needs for each question, filtered by the data classification. Keep a record of every request and every answer, with a reference number.
What goes wrong
The AI service receives whole documents by default. Copies of personal data end up outside the licensed scope without anyone having decided that.
Leave it alone when
You have so few documents that a person reads them faster than the system takes to look after.

Pattern 2

A customer assistant that speaks Shona, Ndebele and English

The problem
Global AI models handle English well and Shona and Ndebele unevenly. Customers switch language part way through a conversation, and a regulated statement must be worded exactly.
What you need
Test the assistant with real conversations in each language. Use approved fixed wording for anything with legal or contractual weight. Build a handover to a person that works around the clock.
What goes wrong
The assistant is tested in English only. It promises a customer something it should have passed to a person.
Leave it alone when
Your existing team already handles the volume well.

Pattern 3

Loan and fraud decisions you can explain afterwards

The problem
When AI contributes to a loan decision or flags a transaction as fraud, the customer, POTRAZ, the Reserve Bank and your own reviewers may ask why, months later.
What you need
A record of the data and the model version behind each decision. A documented route for a person to challenge and override it. Regular bias testing across the customer groups you serve.
What goes wrong
The supplier cannot explain the decision. The model learned from historical data and repeats past exclusion as if it were policy.
Leave it alone when
Clear written rules already make the decision well and openly.

Pattern 4

One front door for all your AI, so you can change supplier

The problem
An AI supplier can raise prices, change its terms of service, or withdraw from the market. Payment routes and international connectivity can change too.
What you need
One gateway that every AI request passes through. Your prompts and instructions held in your own repository, independent of any supplier. An evaluation set you can rerun against a new model in days. Cost metering per use case.
What goes wrong
Everything is tuned to one supplier and nobody wrote it down. The gateway becomes a bottleneck nobody owns.
Leave it alone when
You have one small internal tool with a short life.

Pattern 5

Serve people on basic phones and weak signal

The problem
The customers and field staff who need the service most are often on a basic phone, a 2G connection and an unreliable power supply.
What you need
USSD and WhatsApp as the primary channels. Short interaction steps with resumable sessions. SMS as the confirmation of record.
What goes wrong
The design assumes a web browser. The connection drops halfway through and the customer pays twice.
Leave it alone when
Your users sit in head office with good internet.

Pattern 6

Decide where the AI runs by counting the US dollars

The problem
Most AI is priced in US dollars by suppliers outside Zimbabwe. Hosting it locally moves the cost to power, hardware and the skilled people to run it.
What you need
A five year cost for each option: your own servers, a regional cloud such as Cassava AiCloud, a global cloud, or a mix. For each one, the share paid in foreign currency, the control you keep, and the cost of leaving.
What goes wrong
The first year price is the only number anyone looks at. Running it in house is chosen without the team to do it.
Leave it alone when
Never. Skipping this pattern means the decision gets made by default.

Pattern 7

Get your data ready to share with Project Pangolin

The problem
As Project Pangolin matures, ministries, parastatals and partners will be asked to expose data through governed APIs with agreed terms.
What you need
A data catalogue of what you hold. Agreed master data, such as how a person or a place is identified. Licensing and consent terms for each dataset. An API gateway that controls and counts who uses it.
What goes wrong
Data is shared before anyone knows how good it is. Nobody is sure who owns a dataset the first time someone builds on it.
Leave it alone when
You have no data governance in place yet. Start with the catalogue.

Pattern 8

Keep the AI working after the pilot ends

The problem
Pilots succeed in a test environment and then stall in production, because once the model is live nobody owns it.
What you need
A named model owner. Monitoring for accuracy drift and cost. A retraining schedule. An incident process. A budget line that survives the next planning round.
What goes wrong
The supplier owns the AI and the contract ends. Accuracy declines quietly and customer complaints arrive before the monitoring does.
Leave it alone when
The pilot showed no value. Stopping is the honest result.

Five decisions

The questions only your organisation can answer

The patterns say how. These five decisions say where you stand. The right answer is different for a bank, a mine and a ministry.

Where it runs

Which workloads justify hosting in Zimbabwe, and which are better contracted from a regional or global provider?

Control, US dollars, power and skills all pull in different directions.

Which AI

Open models on your own servers, a regional cloud, global AI services, or a mix routed by use case?

Capability against dependence, one job at a time.

Which data

What data may a model process, under which licence terms, and who signs it off?

The inspection question, answered before the inspector asks.

Build, buy or partner

Where is a vendor product the right call, and where does it create a dependency you cannot exit?

Measured over five years, in both currencies.

Who owns it

In three years, who looks after each AI: your team, a partner, or a paid service?

The decision most often left until it is urgent.

Writing it down properly

Patterns that reach the people writing the code

A pattern in a PDF changes a conversation. A pattern written as a clear specification changes what gets built. Most teams building AI in 2026 use AI coding tools, and those tools build exactly what the written specification says. So the specification is where the thinking has to live.

Milestonecraft writes these patterns as specifications using OpenSpec. OpenSpec is an open source, tool independent method for agreeing what to build before any code is written. It works in three steps. You propose a change as a short addition to the current specification. The team builds it. Then you file the change as part of the record. The agreement becomes a file the team keeps, rather than a memory of a meeting.

Propose

Write the change

A short, exact description of one change. For example: what the gateway must record, or which documents the search index may hold.

Apply

Build to it

The team and its coding tools build what the specification says. Checking the work is quick, because there is something exact to check against.

Archive

Keep the record

The change joins the full specification. When a regulator asks what you built and why, the answer is already written down.

Thoughtworks placed OpenSpec in the Assess ring of its Technology Radar in April 2026, which means worth exploring rather than adopt everywhere. They also noted that as AI tools improve, the method may need less tooling. That is fair. The written specifications stay useful whichever tool reads them.

What a pattern looks like written down

## ADDED Requirements

### Requirement: Gateway record
The AI gateway SHALL record every request
with: which service made it, what kind of
data was in it, which AI model answered,
and a reference number for the answer.

#### Scenario: An inspector asks for a record
- WHEN a POTRAZ inspector asks what
  processing happened for one customer
- THEN every AI request about that customer
  can be found by its reference number

### Requirement: Documents stay in Zimbabwe
The search index SHALL store documents only
on servers located in Zimbabwe, and SHALL
send an AI model only the passages that the
data rules allow.
Shepherd Chengeta

A direct offer

Ready to put this to work on your build?

Send the design, the use case or the supplier proposal you are weighing. A written review against the eight patterns comes back within five working days, free, under a non-disclosure agreement. If the design is sound, the review will say so.

Send a design on WhatsApp Email a design

Shepherd Chengeta is the founder of Milestonecraft, an independent architecture and assurance practice working with organisations in Zimbabwe and the wider region. He is an enterprise architect who currently leads the adoption of AI inside an insurance claims business, and whose earlier work includes national data platforms and regulated public services in the UK and Africa. He builds his own products on the same patterns he recommends, and he puts the thinking on this page to work for organisations that want AI they can defend to a board and a regulator.

If the review leads somewhere

How an engagement grows, one step at a time

Each step is optional and each one is a bigger commitment than the last. None of these imply a formal appointment or programme authority.

Step 1 · free

Design review

Send us your AI plan, design or a supplier proposal. You get a written review within five working days. A non-disclosure agreement is signed first.

You receive: How your plan measures up against the eight patterns, the risks in order of size, the questions to ask your supplier or team, and the changes to write into your specification.

Step 2

Working session

Half a day with your delivery team. We go through the review, test the assumptions, and agree which pattern to tackle first.

You receive: An agreed direction and a clear next step. Sometimes the next step is that no more help is needed, and we will say so.

Step 3

Apply one pattern

Two to three weeks applying one pattern to your build. A fixed price, agreed after a short scoping call.

You receive: The design, where it connects to your other systems, who will run it, and what it will cost, all written as OpenSpec specifications in your own files so your team builds straight from them.

Step 4

Go live checks and ongoing architecture

An independent check before each major release, or a senior architect alongside your programme, with time on site at the moments that need it.

You receive: A written position at each milestone on compliance, supplier dependence, monitoring and exit, suitable for the board and the regulator.

Independent by design. No AI company, cloud company or software seller pays for this work. If a job needs software or a delivery partner, we tell you in writing before giving any advice. If the right answer is to stop, that is the answer you get.

Take it with you

Five documents you can use on their own

Choose one and it is sent to your work email as a PDF attachment, with a download link that works for three days in case your mail system removes attachments.

The big picture poster

The architecture diagram at A3, for the wall of your project room.

Email me this document

The design review checklist

Exactly what our review looks at, so your team can run it themselves.

Email me this document

The patterns as OpenSpec specifications

The eight patterns written as specifications, each file laid out in full so it can be copied into your project and adapted.

Email me this document

The national context

The strategy, the law, the platforms and the evidence behind this page.

Email me this document

Receive a document

Get it by email

Choose a document and provide your business contact details. We will send it as an email attachment.

Please do not submit sensitive personal, financial or operational information in this form. A design for review should be sent by WhatsApp or email after a non-disclosure agreement is in place.

Where the facts come from

Public sources used on this page

  • National Artificial Intelligence Strategy 2026 to 2030. Approved by Cabinet in October 2025 and launched in March 2026. Six priorities, five flagship programmes, and a three phase timeline.
  • Cyber and Data Protection Act, and Statutory Instrument 155 of 2024. The law and the licence that every organisation holding personal data must have, administered by POTRAZ.
  • POTRAZ Regulatory Notice 2 of 2026. Inspections of licensed organisations due from September 2026, starting with banks, insurers, hospitals, schools, universities, mining companies and ministries.
  • Project Pangolin, Innovation Crucible, Mugove Fund and Nzwisiso.ai. The flagship programmes, as described in the published strategy.
  • Econet AI and Cassava AiCloud. Launched April 2026, with computing hosted in the region and partnerships with major AI and cloud companies.
  • Thoughtworks Technology Radar, April 2026. Places OpenSpec in the Assess ring, meaning worth exploring.
  • NUST Institute of Development Studies. A study of AI readiness based on interviews with 45 people in government and business.
  • Business survey, Masvingo. About three in ten businesses surveyed use any AI. The main barriers named were skills, infrastructure and money.

This page is based on a review of public information. The patterns and any interpretation are the professional view of the author. Programme details change, and corrections from people closer to the work are welcome.

Shepherd Chengeta

Prepared by

Shepherd Chengeta

Shepherd Chengeta is the founder of Milestonecraft, an independent architecture and assurance practice working with organisations in Zimbabwe and the wider region. He is an enterprise architect who currently leads the adoption of AI inside an insurance claims business, and whose earlier work includes national data platforms and regulated public services in the UK and Africa. He builds his own products on the same patterns he recommends, and he puts the thinking on this page to work for organisations that want AI they can defend to a board and a regulator.

Published July 2026. Public evidence reviewed to 30 June 2026.