Joint Public Consultation Submission
Overall assessment. The draft strategy is ambitious, structured and stronger than a purely declarative vision. It identifies measurable outcomes, accountable entities and a delivery architecture, and it rightly treats digital transformation as the foundation on which AI adoption depends (p. 7). Its remaining challenge is applicability: the final strategy should start from Lebanon as it exists today (a constitutional state with established institutions, legal mandates and a clear separation of powers, while also facing severe fiscal, infrastructure and public-service constraints) and show a realistic transition to the proposed Year 1 outcomes. Technology should serve public needs and institutional reform, not become a target in itself.
The final strategy should also require proportionate risk assessments across AI deployments, including human rights, social, environmental and economic risks.
The strategy also describes its initiatives and lead entities as illustrative and subject to ministry buy-in (p. 8, 13, 22). That flexibility is reasonable for a draft, but illustrative lists cannot carry binding Year 1 targets, signed performance contracts and committed public funds. The final text should state clearly which commitments are binding and which remain indicative.
| Key recommendation: The institutional model should follow the strategy, not precede it. The draft law establishing the Ministry of Technology and Artificial Intelligence (Decree 1286 of 19 September 2025), now before the parliamentary joint committees, gives one ministry policy, regulation and implementation all at once, while the strategy assigns these roles to separate bodies. If the law is passed first, its binding provisions will prevail wherever they conflict with the strategy, preventing the strategy’s institutional design from being fully implemented.
We therefore recommend that the Government ask Parliament to postpone consideration of the draft law until the Council of Ministers adopts the final strategy. The Government can then propose amendments that align the draft law with the final strategy: who sets policy, who implements, who regulates and who exercises oversight (p. 7, 21-24). |
- Strategy first, institutions second
The strategy explicitly states that it is a national strategy, not the work plan of the Ministry of Technology and Artificial Intelligence (MITAI; p. 7). Its institutional architecture separates functions: MITAI holds policy, legislation and international representation; the Lebanese Digital and AI Agency (LEDAIA), reporting directly to the Presidency of the Council of Ministers, is the executive engine; the Cybersecurity Institute is the national cyber authority; and separate bodies handle evaluation and oversight (p. 19, 21-24).
The Data Protection Authority, which the strategy places in the foundational digital-transformation layer alongside LEDAIA and the Cybersecurity Institute (p. 7), is absent from the institutional architecture presented on p. 21.
The draft law takes the opposite approach. Its Article 1 assigns a single ministry regulatory, supervisory, executive and strategic functions at once. Article 3 places the development and supervision of the national digital system under the ministry, while Article 4 gives it broad cross-sectoral powers over digital policy, coordination, implementation, regulation and oversight. The strategy separates these functions; the draft law concentrates them. The two texts cannot both be implemented as written.
The sequencing matters because a law binds, while a strategy adopted by the Council of Ministers does not amend a law. If Parliament passes the law while the strategy is still under consultation, the Government’s own architecture would be overtaken before it is adopted, and correcting it would require new legislation. Adopting the strategy first and then aligning the draft law with it avoids that outcome without delaying the strategy itself.
The same sequencing should apply to new institutions. Digital transformation needs a capable national delivery function, but the strategy should explain why a new LEDAIA is preferable to reforming or transforming an existing body such as OMSAR into a permanent delivery agency. New institutions should be created where a genuinely new function or a requirement for independence justifies them, not simply because the architecture has a new box.
- Respect the constitutional architecture and separate policy, delivery, regulation and oversight
The strategy’s management logic (one owner, measurable KPIs, public scoreboards and escalation for missed targets) is useful inside the executive delivery chain (p. 21-25). But the same 90-day performance-contract model is extended to Parliament, the Higher Judicial Council, independent regulators and audit bodies (p. 23-24). Performance management operates within constitutional and statutory mandates, not above them; it cannot redefine the separation of powers or the legal independence of institutions.
The institutional map should follow the same principle. Sector regulators should retain their legal independence; the proposed TDRA, a six-member board split between MOT and MITAI, and the reference to a ‘Law 431 reform’ (p. 21) require a separate legal and governance assessment. Digital reform should strengthen, not reverse, regulatory independence. Likewise, the proposed Central Oversight Authority (p. 29) appears to overlap with audit roles already assigned to the Court of Audit and Central Inspection (p. 24). Existing oversight bodies, including the Public Procurement Authority where relevant, should first be equipped with stronger digital, IT, data and algorithmic-audit capacity.
The same concern applies to LEDAIA’s funding model. The architecture describes it as self-funding, with responsibility for data pools (p. 21), while it would also run identity, registries and OneGov (p. 22). Combining a self-funding model with responsibility for core State data creates a governance risk unless the permitted revenue sources are clearly defined by law. The final strategy should define LEDAIA’s revenue sources by law, exclude revenue derived from access to personal or registry data, and place its accounts under the existing audit bodies.
The architecture appears to place an “AI Evaluation Office” within LEDAIA’s Funding and Data block, while separately listing a “Lebanon AI Evaluation Office” as independent of the delivery chain (p. 21). The final strategy should clarify whether these refer to the same body and, in either case, ensure that the evaluation function is institutionally independent from the entities it reviews.
- Build the foundational legal and rights framework first
The strategy itself starts from the right place. It places digital transformation on a legal, regulatory and institutional layer, including a Data Protection Authority (p. 7). It recognises that data protection today rests only on the limited provisions of the Electronic Transactions Law, and that foundational law is the first instrument, not the last (p. 12). It also proposes an AI and Data Governance Framework as a national enabler (p. 29). The final strategy should make clear what this legal layer contains, and require it to be in place before sensitive systems scale.
Its first element is a modern data-protection law, enforced by an independent Data Protection Authority. The law should establish lawful purpose, purpose limitation, data minimisation and retention limits. It should give citizens rights of access and correction, impose breach-notification duties, set cross-border safeguards, and guarantee effective remedies. The ‘once-only’ principle for government data (p. 11) should mean that citizens do not repeatedly submit the same data, not that every public body may access every record.
The second element is a set of rules for high-risk AI. These should define risk categories, prohibited uses and the legal basis for high-impact deployments, with safeguards against unlawful mass surveillance, discriminatory profiling and manipulative uses. Sensitive deployments should be subject to independent review by the evaluation and oversight functions the strategy proposes (p. 21, 29). The strategy defers defence and national-security initiatives (p. 13). That deferral is understandable, but such uses should not fall outside basic legality and rights safeguards.
Finally, the strategy should distinguish clearly between what requires legislation and what can be implemented through regulation, technical standards, procurement or contract. Operational controls such as access logs, role-based access, retention schedules, impact assessments and auditability can then turn these legal rights into everyday practice.
- Make digital sovereignty a governing principle
Digital sovereignty should be a governing principle of the national strategy and its legal and institutional framework, not merely one family of enablers. The strategy already recognises part of this: it seeks provider agreements that keep Lebanese rights over data classification, audit and recall (p. 6, 29). The final strategy should extend that logic to every critical public system, and define the rules before procurement begins, not after.
Digital identity is sovereign public infrastructure. The strategy places national digital identity, data exchange and payment rails at the heart of the Lebanon Stack (p. 20, 30). A public-private partnership may support technical delivery, but governance, authoritative registries, trust services and cryptographic keys must remain under public control. The same rule should apply to the national PPP programme for privately built and operated public AI infrastructure (p. 29): the private partner may build and operate, but it should not own or control the State’s core functions.
Cloud and data arrangements need the same clarity. Cloud-first policies, national data pools and data embassies (p. 29-30) should rest on clear rules on data classification, jurisdiction and key control. The same applies to the planned national framework with two or three frontier AI providers (p. 26), where the State’s dependence on a small number of foreign companies should be managed by contract from the start. Every major contract should require open standards, interoperability, data portability, continuity of service and enforceable exit rights, so that Lebanon is never locked into a single vendor.
Public-service channels should follow the same principle. Salemtak is explicitly ‘WhatsApp-native’ (p. 27), and the Better Life pillar assumes services can operate on WhatsApp (p. 10). WhatsApp may be a useful optional access channel, but it should not become Lebanon’s national public-service infrastructure or the only gateway to sensitive health, identity or social services. Reliance on WhatsApp for core public services would also create dependency on a foreign proprietary platform controlled by a private company. The core should be state-controlled, multi-channel and based on open standards, with accessible alternatives such as web, SMS and call centres.
- Add a formal Horizon 0 before Year 1, with clear stop/go rules
The ten Year 1 priorities include 500,000 digital identities, OneGov transactions, a 24/7 national SOC, an AI fund deploying capital, export contracts and all twelve sector missions launched (p. 20). Yet the strategy also assigns MITAI a Year 1 legislative pipeline for data protection, cybersecurity and AI governance (p. 22), while several institutions and funding vehicles required to deliver Year 1 do not yet exist. The 90-day performance-contract mechanism cannot substitute for those prerequisites.
A formal Horizon 0 should therefore precede Year 1. For every priority it should identify: the legal instrument required; whether the action is legislative, regulatory, institutional, procurement-based or operational; the accountable institution; baseline; budget and funding source; dependencies; and the required sequence. It should also define stop/go rules: sensitive digital identity, cross-registry data sharing, national data pools and high-risk AI should not scale if the required legal safeguards, supervisory authority or security controls are not yet operational. The Year 1 clock should begin only once the relevant prerequisites are formally in place.
At the service level, the same test should apply before AI is chosen. For each use case, the responsible entity should state the public problem, whether a simpler non-AI digital solution is sufficient, the additional value AI is expected to provide, lifecycle costs and risks, and an accessible human alternative. AI adoption itself should not be rewarded as an outcome; improved public service should be.
- Test the strategy against Lebanon’s actual starting conditions
The strategy correctly identifies energy and water, telecommunications and a functioning trusted financial system as foundations (p. 15-16). These are not simply parallel sector missions; they are practical constraints on the rest of the strategy.
Energy and water (p. 15): guaranteed power terms for AI Zones should be preceded by a resource feasibility test explaining how scarce public resources will be prioritised without competing with essential household and economic needs.
Telecommunications (p. 15, 23): the strategy treats connectivity as a precondition, yet the telecom mission’s Year 1 deliverable is a coverage and resilience map, and Ogero, the Telecommunications Regulatory Authority and the mobile operators appear only as co-delivery partners. Digital inclusion also requires affordability and the integration of the market into the legal network. Court of Audit Special Report No. 5/2026, dated 8 October 2026, records more than one million subscribers outside the legal fixed-internet network and estimates the net annual public-revenue loss at approximately $128.8 million. This baseline illustrates the gap between current digital conditions and the target of one million AI Operators. The connectivity mission should be linked explicitly to the governance reform of the sector, the regulator’s capacity and the pending telecommunications legislation, which are all prerequisites for the strategy.
Banking and finance (p. 16): the strategy itself states that a functioning, trusted formal financial system is a precondition for exports, FDI, the National AI Fund and financial inclusion. Digital payments, mobile money and AI advisory services cannot substitute for the broader restoration of the banking and financial system on which those targets depend.
- Benchmark the transition, not only the destination
The strategy compares four national models that begin from very different conditions: high state capacity, large sovereign capital, an advanced economy, or an already digitised government (p. 18). It also correctly notes that each country’s choice followed from what that country already had. Lebanon should apply the same test to itself. The final benchmark should therefore identify the countries and source strategies used, and show transition paths as well as end states: what reforms came first, how long they took, how they were financed, and what institutional and infrastructure capacity had to exist before ambitious adoption targets became realistic.
- Make the headline targets, financing and delivery plan auditable
The strategy sets headline targets including a $4 billion AI contribution to GDP, $2 billion in AI-enabled exports and $1 billion in committed FDI (p. 6, 9), while the appendix contains 93 initiatives (p. 26) and major financial commitments such as $150 million in public seed capital for the National AI Fund, a $50 million Year 1 Digital Renaissance Fund, subsidised frontier access and privately built AI Zones (p. 26, 30). These figures should be testable, not only aspirational.
The final strategy should publish one implementation and financing annex that combines both questions: how the targets were derived, and how they will be delivered. It should provide methodology and data sources; definitions of ‘AI contribution’ and ‘AI-enabled exports’; baselines and yearly scenarios; assumptions; treatment of additionality and double counting; estimated public costs; financing sources; legal vehicles; procurement models; governance and fiscal exposure; and independent verification of results. This would complement, rather than duplicate, the strategy’s public scoreboard and milestone-based financing model (p. 19-25).
The scoreboard itself should also report rights and sustainability indicators, for example data-protection complaints and their resolution, independent reviews of high-risk systems, and the energy and water use of AI Zones and data centres, not only adoption and investment figures.
- Make digital rights and human safeguards enforceable at the service level
The legal framework should establish the rights; implementation should make them usable. When AI materially affects access to a public service or a consequential decision, people should know that AI is involved, be able to correct the underlying information, obtain a meaningful explanation, request human reconsideration and access an independent remedy. Government should maintain a public register of deployed AI systems, their purpose, accountable owner, provider, risk classification and audit status, with narrow exceptions for legitimate security needs. These requirements are particularly relevant to the strategy’s proposed uses in education (p. 8), health and social services (p. 27), recruitment and civil-service management, legislation and justice (p. 28), and other sensitive-domain deployments subject to the Evaluation Office (p. 29).
Conclusion
Lebanon does not need less ambition. It needs an applicable, sovereign, rights-based and legally grounded path from the State that exists today to the digital State the strategy seeks to build. The strategy’s strongest contribution is its recognition that digital transformation, law, institutions and delivery capacity must come before AI adoption. The next step is to make that sequence binding: adopt the national strategy first; align the ministry draft law and define the institutional architecture; enact the foundational safeguards; establish the financing and implementation baseline; and only then start the Year 1 clock. The strategy should also be institutionalised so that it survives the minister and Government that launched it.
Strategy → functions → institutions → laws and funding → Horizon 0 → Year 1 delivery
