Sri Lanka Mandates AI Governance as Critical Pillar for National Digital Strategy

The recent declaration of AI governance as a "critical imperative" for Sri Lanka marks a fundamental shift in the nation's digital trajectory. As the country seeks to recover and stabilize its economy through high-tech exports and digital services, the absence of a robust regulatory framework has become a glaring vulnerability. Policymakers and industry leaders now recognize that the rapid, unregulated deployment of artificial intelligence—particularly in financial services, healthcare, and public administration—could lead to systemic risks that outweigh the efficiency gains. This move toward governance is not merely about restriction; it is a strategic effort to build a "trust ecosystem" that can attract sophisticated foreign direct investment (FDI) from global tech hubs that demand high standards of data ethics and legal predictability.

In the broader regional context, Sri Lanka is attempting to navigate a middle path between the European Union’s prescriptive, risk-based AI Act and the more flexible, market-driven approaches seen in Singapore and other ASEAN nations. For Sri Lankan legal practitioners, this transition necessitates a rapid evolution in expertise. The legal sector must move beyond traditional contract law to encompass algorithmic accountability, data provenance, and the ethical implications of Large Language Models (LLMs) that handle local languages like Sinhala and Tamil. There is a growing consensus that the governance framework must address the "black box" nature of AI, ensuring that automated decisions—especially those affecting credit scoring or judicial outcomes—are transparent and contestable under existing administrative law.

“

Looking forward, the success of this governance imperative will depend on the collaborative efforts of the Ministry of Technology, the Central Bank of Sri Lanka, and the private sector.

The intersection of AI governance and the existing Personal Data Protection Act (PDPA) No. 9 of 2022 is a primary area of focus. While the PDPA provides a baseline for data privacy, it was not specifically designed to handle the unique challenges of generative AI and autonomous systems. New regulations will likely require "AI Impact Assessments" for high-risk applications, forcing companies to document their training data sources and bias-mitigation strategies. This creates a massive opportunity for the RegTech sector. Firms specializing in automated compliance, real-time monitoring, and ethical auditing are expected to see a surge in demand as Sri Lankan enterprises seek to de-risk their AI portfolios. The implementation of "compliance-by-design" will become a standard requirement for any software vendor looking to secure government contracts or operate in the regulated financial space.