Zero Reported AI Failures Should Worry Your Board

By Jabulani Simplisio Chibaya

HARARE – MOST boards read that as good news. No incidents. No complaints. No headlines.

A new global study says that reading is a mistake.

Last month the Global Center on AI Governance published the Global State of Responsible AI Report. It builds on the Global Index on Responsible AI 2026: 135 countries, more than 68,000 data points. One finding matters more to me than any ranking.

The countries with the strongest transparency frameworks and the highest overall scores often have the most documented government AI misuse.

Are they worse behaved? Not necessarily. Their press, courts, auditors and civil society are strong enough to expose it. Where those institutions are weak, misuse can stay out of sight.

Quiet is not the same as safe. Hayek warned about the pretence of knowledge. A board that treats an empty incident log as proof of control is practising it.

The gap between recognition and accountability

The headline numbers are simple.

• 126 of 135 countries have at least one government responsible AI policy or initiative.
• The global average score is about 35 out of 100.
• Evidence of implementation exists in only 55% of cases where an active framework exists.

The machinery behind the policies is thin. Training and workshops appear in 70 countries. Independent oversight bodies appear in 28. Monitoring and evaluation appears in 22. Redress is the weakest area of government activity globally, and only 14% of regulations require or incentivise companies to build their own grievance mechanisms.

The authors describe one pattern across all five dimensions. Governments adopt most readily the parts of responsible AI that expand their capacity to see, steer and promote the technology. They defer the parts that would bind them, redistribute benefits or expose them to challenge.

Look at your own organisation. We fund the pilot, the training day and the launch. We defer the audit, the kill switch and the appeal route. The report puts it plainly: risk management and accountability are not the same thing. The first can stay entirely inside the institution. The second requires that people outside it can act.

Governments are a mirror for boards

The report’s hardest numbers concern how states govern themselves. It documents 53 cases of government AI use with unacceptable risk across 35 countries, about half involving mass biometric surveillance. Every documented discriminatory public service system sat in a country ranked in the top 50, among them France, the Netherlands, the United Kingdom and the United States. Several countries with strong right-to-information laws, including South Africa and Kenya, have no framework requiring disclosure of government algorithms.

Strong frameworks did not stop misuse. Strong scrutiny is a large part of why we can see it.

Swap “country” for “company” and you have what I call the AI Execution Gap: the distance between an AI strategy and a named owner when the system fails in production.

I have seen the quiet version. An AI agent I oversaw auto-approved routine reorders under a dollar threshold. The threshold was set at launch and never revisited. When supplier prices rose, it kept approving. We caught it in a spend review, not through monitoring. No policy was broken. No alarm went off. That is what a missing oversight layer looks like from the inside.

Five questions for your next board meeting:

1. Who can stop it? Name the person who can pause a live AI system, and the trigger that makes them do it.
2. Where is the AI register? Every system in production, its owner and the decisions it touches, on one page.
3. What did the vendor sign? Bias and safety testing, data and model transparency, audit rights, exit terms. Of countries with at least a draft AI procurement framework, 51% do not require vendors to test for bias, fairness and safety.
4. Who checks after go-live? Monitoring with thresholds a human reviews on a schedule. Launch-day settings drift.
5. How does someone push back? A route for a customer or employee to challenge an AI decision.

Where Zimbabwe stands

The report never mentions Zimbabwe. The underlying Index ranks it. Ecofin’s summary of the GIRAI 2026 ranking places Zimbabwe 113th of 135 countries and 23rd among the 39 African countries assessed. Africa averaged 21.79 against a global 35.

Read that carefully. The report warns against treating Global South results as proof of weaker commitment. It points to thinner capacity, limited leverage with vendors and investors, and a preference for non-binding instruments. Seventy-eight percent of Global South frameworks published since 2024 are non-binding.

The National AI Strategy 2026–2030, launched in March 2026, is a real step. It has six pillars, from talent and national AI infrastructure to adoption and a governance, ethics and regulatory framework. It proposes a National Digital Regulatory Committee under POTRAZ and an AI Strategy Implementation Office within the ICT Ministry. Legal commentators note that these bodies are named in a Cabinet-approved strategy without an enabling Act of Parliament. A strategy sets direction. It does not create duties a court can enforce.

By the report’s own test, that is adoption, not yet enforceability. The report also finds African policy activity concentrated in AI literacy, reskilling and public sector skills. Our pillars lean toward capacity too, with governance as one of six. That is my reading, not the report’s, and I hold it loosely.

What Zimbabwe does have is substantive. The Cyber and Data Protection Act makes POTRAZ the Data Protection Authority, with audit and sanction powers. Regulations from 2024 required data controllers to be licensed and to appoint data protection officers by March 2025. Most AI risk starts as data risk. That makes this our strongest foundation for AI accountability today.

The cyber security angle

The report treats cybersecurity as an enabling condition for responsible AI. It also separates security, which protects data and infrastructure from attack, from safety, which prevents harm to people. Boards fund the first and assume the second.

AI changes the cyber picture in three ways.

AI as a target. Every agent with credentials and every model wired to customer data is a new door. An agent with write access and no logging is an insider who never sleeps.

AI as a weapon. Phishing in flawless English or Shona. Cloned voices asking finance to release a payment. The report points to a “skepticism tax”: when we cannot tell real from synthetic, trust erodes, including trust in your institution. Fifty-three percent of the global population has already used generative AI tools. Attackers are among them.

AI as a shield. Faster triage, anomaly detection, fraud scoring. But a shield nobody monitors is just another unaudited system.

Our exposure is not theoretical. NewsDay reported in October 2024 that Check Point Software had ranked Zimbabwe third among the most cyber-attacked countries. ZB Financial Holdings was hit by ransomware in July 2024, with data leaked online. The RBZ’s 2025 monetary policy statement noted that most financial institutions had cyber resilience strategies, with the rest still developing them. That is the adoption half. The enforcement half is patching, monitoring, tested response and honest disclosure.

Then there are vendors. Most of us buy AI rather than build it. The report notes that governments buy most of the AI they use, and that procurement is often their only lever. Boards are in the same position. Your vendor’s security posture is yours. Ask for testing evidence, audit rights and exit terms before signing, not after the incident.

What leaders should be glad about

• Awareness has arrived. 126 of 135 countries now act on responsible AI. Nobody can claim they did not know.
• Zimbabwe has foundations. A national strategy, a data protection statute, a regulator with enforcement powers and licensed data protection officers.
• The best performers are the ones that can see their problems. Any organisation can adopt that standard this quarter.
• The basics are cheap. A register, a named owner, a scheduled review of thresholds.

What should worry them

• Implementation lags. Evidence of it exists in 55% of cases.
• Soft law dominates. Legal commentators say our proposed AI regulator sits in a strategy, not yet in statute, and uncertainty is a risk of its own.
• Redress is thin. Only 14% of regulations push companies to build a grievance route, so do not assume your vendors have one.
• Adoption outruns control. The report finds capacity to adopt is being built faster than capacity to constrain. Agents and vendors make that worse.

Opportunities ahead

Governance readiness as a market edge. For vendors selling to banks, insurers and government, documented models, audit rights and a grievance route will separate serious firms from the rest. Ghana’s strategy commits to start-up-friendly tenders and co-created intellectual property. Only five countries fully specify local development conditions in AI procurement. Ghana is one of them.

Assurance as a growth field. With independent oversight in 28 countries and monitoring in 22, someone has to audit, validate and monitor. Internal audit, risk, IT controls and data protection professionals have a growing market.

Language. Zimbabwe has 16 official languages. The report warns that public investment in local-language AI can mainly benefit large foreign firms unless ownership and benefit-sharing are built in. We can write those terms before the data leaves.

Trust as a niche. Nigeria and Morocco score well above their overall rank on trust and safety, thanks to strong enabling conditions and risk-focused policy. A payments-heavy economy like ours can aim for the same bright spot.

Fund the second half

Kierkegaard wrote that life can only be understood backwards, but it must be lived forwards. A board pack reads AI backwards. The system runs forwards. Monitoring is how you close the gap.

Policies and training are the visible half of AI governance. Oversight, monitoring and remedy are the half that works when something breaks.

Fund the second half before you scale the first.

Sources

Zim banks have robust cybersecurity systems: RBZ, allAfri

Global State of Responsible AI Report, September 2026, Global Center on AI Governance

Responsible AI Governance: 39 African Countries Ranked, Ecofin Agency

Strategy Without Statute: Reading Zimbabwe’s National AI Strategy, African Law Matters

Govt unveils national AI strategy, Business Times

Navigating the Data Protection Act Requirements, MISA Zimbabwe

Zim banks vulnerable to cyber threats: Experts, NewsDay

ZB Financial Holdings hacked for ransom, Techzim

Jabulani Simplisio Chibaya is a Data and AI Consultant specializing in data science, artificial intelligence, blockchain, and cryptocurrency innovation. A seasoned conference speaker, he also writes on the intersection of technology, regulation, and economic development. Contact: Cell: +263 778 921 881 | Email: simplisiochibaya22@gmail.com | LinkedIn: https://www.linkedin.com/in/jabulani-simplisio-chibaya