From Policy to Practice: Implementing AI Governance and Cybersecurity Frameworks in Emerging Digital States

Tiffany Saade uses the metaphor of a lighthouse to describe Lebanon's approach to AI: rather than competing with large nations on compute or foundation models, Lebanon is positioning itself as a beacon of responsible, transparent governance. The lighthouse does not stop the sea but makes navigation safer, which is how Lebanon views its role in the AI era. This framing rejects fear and bureaucracy in favour of governance as an enabler of sustainable innovation.

Saade elaborated that the lighthouse represents governance, infrastructure, legal frameworks, cybersecurity, talent, investment, institutional discipline, and public trust , and that Lebanon's Ministry of Information Technology and Artificial Intelligence is actively building this lighthouse . She stressed that every country faces the AI 'sea' and the real question is whether they face it in darkness or with responsible guidance .

Saade argues that Lebanon's delayed entry into AI is not a failure but a conscious strategy to observe what other countries have done, learn from their mistakes, and build durable foundations before acting. The word 'strategic' is emphasised as critical, distinguishing deliberate lateness from mere underdevelopment. This approach allows Lebanon to avoid copying paths that may not suit its context and to build digital sovereignty that is steady and durable.

Saade noted that strategically late countries use the delay as a discipline to observe trends and learn from others before making their first move , and that Lebanon is investing in four layers - talent, education, investment, and cybersecurity - as part of this approach . She also acknowledged that strategic lateness comes with constraints and risks .

Saade frames AI not as a chatbot or productivity tool but as a test of whether Lebanon's institutions can modernise, whether public services can become more responsive, and whether data can be properly protected. It is also seen as a means to retain young talent by giving them a meaningful future at home. This broader framing positions AI as a vehicle for national renewal rather than mere technological adoption.

Saade stated that AI for Lebanon is about testing whether institutions can modernise, whether public services can become more responsive and personalised, whether data can be organised and secured, and whether youth can imagine a future at home . She also noted that AI will enter Lebanon's public sector, schools, hospitals, and homes as they are, and will reshape and magnify existing systems .

Saade describes the NUMU programme as a nationwide AI education initiative that spans schools and universities, offering certifications from major vendors and enabling students to work on public sector projects. Alongside this, the Code for Lebanon hackathon initiative partners with universities to give young people a practical way to make an impact in their country through technology. Both initiatives are framed as tools for retaining talent by making it meaningful to stay.

Saade explained that NUMU provides AI skills with certifications from Microsoft, Google, and others, and involves students in developing projects with the public sector to solve specific pain points . She also described Code for Lebanon as a hackathon initiative run across universities, led by a colleague at the ministry, aimed at retaining talent in Lebanon .

Saade describes the Lebanese Angel Investor Network as a diaspora-driven fund of funds designed to invest in Lebanese startups, addressing the problem that many talented Lebanese founders are forced to leave the country to develop their ideas. By bringing together successful Lebanese expats as investors, the network aims to create a sustainable ecosystem that retains talent domestically. This is presented as the investment pillar of Lebanon's brain drain to brain gain strategy.

Saade noted that the ministry launched the Lebanese Angel Investor Network to bring together Lebanese expats from around the world to invest in and create a fund of funds for Lebanese startups , with the goal of retaining talent and enabling founders to build their solutions sustainably within Lebanon .

Saade describes Lebanon's plan to build a local large language model (LLM) by fine-tuning existing foundation models on Lebanese dialects, cultural data, and digitised national datasets. This is presented not as a full foundation model but as a first, demonstrable step towards digital sovereignty. The goal is to prove that a culturally contextualised AI service is possible and to gradually increase its adoption as a citizen-facing tool.

Saade explained that Lebanon intends to build on top of existing foundation models such as those from OpenAI, Anthropic, or Mistral, and train the resulting model on Lebanese dialects and local databases, including data that has not yet been digitised . She framed this as a pilot to prove that a native Arabic LLM tailored to Lebanese culture and dialects is feasible, with the aim of integrating it as a conversational service for citizens .

Saade argues that digital sovereignty cannot be achieved by focusing on any single pillar in isolation, as investment, talent, and infrastructure are mutually dependent. Without investment there is no infrastructure; without infrastructure there is no talent pipeline; and without talent there is no capacity to build infrastructure. This interdependency means that progress must be made on all fronts simultaneously.

Saade described the loop explicitly, noting that in order to have infrastructure you need talent to build it, and in order to have talent you need investment, concluding that these pillars all complete each other . She also acknowledged that reliance on external partners is a short-term Band-Aid solution that does not address the underlying vulnerability .

Saade responds to the concern about the gap between ambitious legislation and practical implementation by highlighting Lebanon's approach of embedding technically fluent staff within the ministry's policy team. These individuals are able to translate complex AI, cybersecurity, and machine learning concepts into legal and policy language that is accessible and actionable. This is presented as a key mechanism for ensuring that laws and frameworks reflect technical realities.

Saade explained that Lebanon remediates the gap between technical complexity and policy by having team members who are technically savvy and able to translate complex elements of cybersecurity, AI, and machine learning into legal and policy terms that are accessible and viable for everyone .

Saade argues that making AI and cybersecurity governance meaningful to ordinary citizens requires two complementary approaches: national awareness campaigns that shift behaviour from reactive to proactive, and the integration of AI and digital transformation concepts into school curricula from kindergarten to year 12. Both are seen as essential for reaching all citizens, including women, girls, and those in rural areas. This is framed as the bridge between national policy and lived experience.

Saade described a national awareness campaign as a tool to help citizens of all ages and locations understand why cybersecurity matters to them personally, and to shift behaviour from reactive to proactive . She also noted that the ministry is working to include AI and digital transformation thinking into curricula from K to 12, with a specific focus on equipping young girls and boys with technical skills .

Saade highlights that the NUMU programme is not limited to urban centres but runs across all of Lebanon, including the north, south, and areas with poor connectivity or dire infrastructure. This geographic reach is presented as a deliberate policy choice to ensure that digital upskilling is inclusive and does not leave behind citizens in rural or underserved communities. The programme is framed as a practical expression of the ministry's vision for AI that covers every single citizen.

Saade stated that NUMU runs in the north, south, and everywhere in Lebanon, especially in areas where internet connectivity is difficult or infrastructure is poor , and that the ministry's vision for AI in Lebanon is one that covers every single citizen regardless of geographic location .

Saade argues that Lebanon's ministry treats AI as inseparable from human wellbeing and social impact, meaning that all collaborations with startups and researchers are evaluated through a social impact lens. This includes environmental sustainability, healthcare improvements, and the facilitation of citizen services. The ministry's human-centric ethos is presented as a de facto alignment with the SDGs, even without a formal SDG-labelled framework.

Saade explained that when the ministry works with local startups or researchers, it always looks for a social impact layer, whether environmental, in healthcare, or in facilitating citizen processes . She also noted that digitalising a ministry's processes to make citizens' lives easier is itself a response to one or more SDGs .

Saade acknowledges that Lebanon has not yet developed a formal strategy for the environmental and energy impact of AI, as the country is still focused on the more fundamental task of digitalising institutions that have operated on paper for decades. She is candid that this is a gap, while affirming that environmental sustainability is on the ministry's radar. The honest admission reflects the prioritisation constraints facing an emerging digital state.

Saade stated plainly that Lebanon is not yet at the stage of building data centres or running significant compute, and that the country is still trying to digitalise institutions that have been operating on paper for the last 100 to 200 years . She acknowledged that an environmental strategy needs to be written urgently but that the ministry is still in early stages .

Saade confirms that Lebanon is already participating in Arab League AI strategy work through the ministry, giving it a presence in regional discussions. However, she is careful to distinguish between contributing and leading, arguing that genuine regional leadership requires completing the inner national work first. This is framed as a realistic and sequenced approach to regional engagement.

Saade noted that the Arab League is working on AI strategy and that Lebanon is already contributing to that work through the ministry, giving it a seat at the table . She argued that in order to lead, Lebanon must first do the national foundational work, and that leading as a slogan without substance is not credible .

Saade reframes Lebanon's late entry into AI as an advantage, arguing that having a blank page allows the country to learn from more advanced neighbours in the Gulf and avoid repeating their mistakes. This perspective treats strategic lateness not as a deficit but as an opportunity for informed, context-specific innovation. The blank page metaphor suggests that Lebanon can craft a path tailored to its own needs and values.

Saade noted that Lebanon is in an advantageous position because it can learn from Gulf countries and others in the region that are more advanced and have been on this journey longer . She described having a blank page as a privilege because it allows a country to write anything on it .

Saade describes the ministry's role as that of an orchestrator, coordinating inter-ministerial work, private sector partnerships, and university collaborations rather than acting alone. When drafting strategies, frameworks, or legal documents, the ministry invites representatives from relevant ministries to provide input and pushback, ensuring that diverse perspectives are incorporated. This co-creation model is presented as essential to producing governance documents that are robust and practically implementable.

Saade explained that the ministry signs MOUs and aligns agendas with other ministries, private sector companies, and research institutions, and helps ministries that lack funding or technical direction by scoping projects and providing strategic guidance . She also described inter-ministerial and public consultations where draft documents such as cyber readiness frameworks and AI frameworks are reviewed by representatives from ministries including Health and Telecommunications, whose written comments are incorporated .

A participant from Tunisia highlights that brain drain is a shared challenge across the region, with large numbers of Lebanese and Tunisian students studying at elite institutions abroad such as EPFL in Lausanne. The participant asks whether Lebanon has a concrete strategy to attract these people back, framing the question as one of direct engagement rather than passive hope. This positions brain drain as a regional problem requiring active, targeted policy responses.

The participant noted that Tunisia suffers from brain drain as does Lebanon, and observed that there are hundreds of Lebanese and Tunisian students at EPFL in Lausanne, asking whether Lebanon has a strategy to convince these people to return .

A participant representing Women in Technology in Nigeria argues that national AI and cybersecurity frameworks must explicitly prioritise women and girls, especially in rural areas, to prevent the digital economy from becoming male-dominated. She calls on governments to translate complex national frameworks into localised, accessible digital literacy programmes that empower rural women and girls. The argument is that equity must be built into the architecture of AI governance from the outset, not added as an afterthought.

The participant asked how governments can translate complex national cybersecurity frameworks into localised, accessible digital literacy and defence programmes that equip rural women and girls . She argued that if equity is not balanced into the framework from the start, the male gender will dominate, and that empowering women in both urban and rural areas will help them navigate the AI economy safely .

A participant from Ogero Telecom, which operates under the Ministry of Telecommunications in Lebanon, asks how the Ministry of AI manages national collaboration across ministries, noting that no single ministry can do this work alone. The participant draws on their own experience of co-creating strategies with multiple ministries and UN partners on topics such as women's digital inclusion and accessibility for people with disabilities. The implicit argument is that effective governance requires structured, multi-stakeholder co-creation mechanisms.

The participant described working with ITU on a strategy for the inclusion of women in the digital sector and with UN ESCWA on an accessibility strategy for Lebanon, both developed through co-creation by inviting all relevant ministries to contribute . They asked whether the Ministry of AI follows a similar co-creation approach .

Idongesit Udoh, drawing on experience from the UK's digital access programme in Nigeria, argues that situating AI governance in isolation from the broader digital development ecosystem creates significant implementation challenges. Effective AI governance must be connected to foundational elements such as digital identity, data governance, infrastructure, cybersecurity, and institutional capacity. The lesson from Nigeria is that these elements are interdependent and must be addressed together.

Udoh stated that AI governance cannot be isolated from broader digital development, including skills, infrastructure, digital identity, and data, and that situating AI alone in terms of governance is challenging, especially around cybersecurity and institutional capabilities . He emphasised that implementation is not just about drafting policies but about building institutions capable of taking those policies forward into delivery .

Udoh highlights the UK's shift from compliance-based to resilience-based cybersecurity governance as a model that emerging digital states should consider adopting proportionately and contextually. The argument is that simply copying mature frameworks wholesale is insufficient; what matters is how they are adapted to local contexts and translated into actual delivery. The focus should be on building resilient institutions rather than producing elaborate policy documents that are not implemented.

Udoh noted that the UK has been particularly influential in moving from compliance-based cybersecurity frameworks towards resilience-based governance, and that the UK partners with countries to help emerging digital states adopt mature frameworks proportionately rather than simply transplanting them . He stressed the importance of a delivery agenda situated within the broader digital ecosystem, including data, identity, infrastructure, cybersecurity, and institutional capabilities .

Carolin Weisser Harris presents a prototype national AI cybersecurity readiness metric developed by the Global Cyber Security Capacity Centre at the University of Oxford, funded in part by the UK government. The tool is designed to help countries understand what capabilities and capacities are needed to be cybersecurity-ready in the context of AI. While the tool has been tested through consultations in multiple countries and regions, she acknowledges that the evidence base is still developing and more research is needed.

Weisser Harris described the prototype as publicly available and recommended it as a tool for self-assessment and discussion, noting that it was developed through consultations in Mexico, South Africa, Cyprus, Mongolia, Australia, and Singapore, as well as several expert roundtables . She acknowledged that while there is knowledge about how countries can become AI security-ready, there is not yet enough evidence about what specific steps should be taken, making it an ongoing area of research .

Waqar Ahmed Wains from Pakistan argues that the core problem for emerging digital states is not the absence of laws or strategies but the lack of institutional capacity to implement them. Enforcement agencies, regulators, and the judiciary often lack the technical staff, budgets, and training needed to interpret and apply frameworks modelled on EU or US standards. He describes this as a problem of 'plumbing' rather than architecture.

Wains stated that emerging digital states often adopt ambitious national strategies or cyber laws modelled on European or US frameworks, but that enforcement agencies, regulators, and the judiciary may lack technical staff, budgets, and training to interpret and apply them . He summarised this as: 'The gap is not the law. It is the plumbing' .

Wains raises the concern that if AI governance mechanisms — such as reporting digital harms online — require internet connectivity, then populations in low-connectivity areas will be systematically excluded from participating in or benefiting from those mechanisms. This risks deepening existing digital divides and creating a two-tier system where governance protections only reach connected citizens. The question highlights the tension between digital-first governance design and the realities of uneven connectivity.

Wains asked what happens to populations with low connectivity if AI governance requires citizens to report harms online, framing this as a digital divide concern .

Seeburn Krishna describes Indonesia's approach of sending students abroad on scholarships with contractual obligations to return and work in Indonesia for a set number of years. While this model has potential, it faces a significant limitation: returning graduates struggle to find work in an advanced tech sector that does not yet exist domestically. This illustrates that talent retention strategies must be paired with the development of a domestic tech ecosystem capable of absorbing returning talent.

Krishna noted that Indonesia sends hundreds or thousands of students abroad with scholarships and contracts requiring them to return and work in Indonesia, but that returning graduates face difficulty finding work because the advanced tech sector is not yet built domestically . He observed that in the absence of large AI companies in Indonesia, most AI implementation is in automation rather than research .

Krishna argues that smaller countries without domestic AI infrastructure are forced to rely on external AI providers, which creates both economic and security vulnerabilities. Economically, payments for AI services flow out of the country to foreign companies. From a security perspective, increasing reliance on external providers creates dependency risks that threaten digital sovereignty. He suggests that regional AI companies sharing common values could be a solution for countries that cannot sustain their own.

Krishna noted that because Indonesia lacks the infrastructure for domestic AI, it is reliant on external AI companies as providers, which is a problem for digital sovereignty . He also observed that as jobs are automated, money flows to AI companies abroad, creating both an economic and a security risk as reliance on external providers grows . He suggested that at a regional level, countries could develop their own AI companies that at least share the same values as their neighbours .

Krishna proposes that for countries too small to develop their own AI companies independently, a regional approach — building AI entities at the regional level that reflect shared values — could be a viable path to digital sovereignty. This would reduce dependence on large foreign AI providers while allowing smaller nations to pool resources and capabilities. The argument is framed as a pragmatic alternative to the binary choice between full domestic AI development and total reliance on external providers.

Krishna suggested that for digital sovereignty, it is necessary for a region to have its own AI companies if small countries cannot facilitate their own, so that at least at a regional or local level there are AI entities that share the same values as their neighbours .

Jean Manuel Canet, reporting for ITU on the energy and environmental impact of AI systems, asks whether Lebanon has criteria for selecting AI projects or funding that are explicitly linked to the Sustainable Development Goals. The question probes whether Lebanon's AI promotion and investment activities are guided by a framework that prioritises AI for good, rather than AI adoption for its own sake. This is framed as a governance question about how to ensure that AI development serves broader societal and environmental goals.

Canet asked whether Lebanon has any criteria of selection linked to sustainable development goals when funding or promoting AI developments, and whether there is a position on favouring AI for good .