How the Maldives' Prosecutor General wrote its AI policy into the tech stack

When Justice Abbas Shareef took office as the chief prosecutor of the Maldives two years ago, his office had no artificial intelligence (AI) governance framework. 

This May, his team ran a readiness assessment across the Prosecutor General's Office (PGO) to show how urgent such a framework was needed. 

Staff willingness to adopt AI scored 81 out of 100 (the highest mark in the assessment). Yet, confidence that responsible AI guidance existed scored just 52.  

"That 29-point gap was the clearest warning: staff readiness to use AI was ahead of the institution’s governance readiness," he tells GovInsider. 

"Live cases cannot be the place where we learn basic governance lessons," he notes.  

In August, the Office launched the PGO 2.0, the AI strategy and delivery programme of the office. 

Notably, the strategy includes a governance framework and a Tool Register, engineering these rules into contracts and the system architecture, instead of just the policy alone. 

One rulebook, not one rewrite per tool 

According to Shareef, the PGO 2.0 strategy was intentionally designed as a two-layer system to ensure that governance doesn't slow innovation. 

The first layer is the framework and accompanying policy that set the rules, including the nine principles that apply to every use, where case information may go, and how much human oversight applies for different AI tools. 

The second layer is the tool register, which is designed to handle the tool-specific assessment, approval and conditions, without the office rewriting its framework every time a new tool comes up. 

"We accepted a slower start to deployment in order to put the safeguards in place first," admits Shareef on time taken to build this two-layer approach. 

"Most of the preparatory phase was spent on readiness work, governance instruments, and implementation design before live deployment. It also meant that staff who wanted useful tools sooner had to wait," he explains. 

While lower-risk AI uses can go through the two-layer approach, high-risk uses require Shareef's written approval. 

If the first layer, policy, determines an AI tool category to be high risk, it will first go through the AI Governance Committee's review, alongside data, security, and prosecution sign-offs. 

Where specialist review is needed, he says that an independent technical advisory panel will be convened. 

"Final written approval for high-risk and restricted uses remains with me. That allows collective scrutiny while keeping final accountability clear," he notes. 

While recognising that this adds to the high workload, Shareef stresses the need to maintain a high level of scrutiny as part of the constitutional responsibility he undertakes in his role. 

"If something goes wrong, there should be no uncertainty about who approved the use and on what basis," he says. 

What sovereignty means for a small state 

"We are not trying to build a frontier model in the Maldives.  

"Our priority is to retain control of the parts the Office must own and govern," says Shareef, recognising compute, capital and specialist skills as constraints for the small state. 

Sovereignty, in practice, is building cost and renewal protections into vendor agreements, as well as ensuring that consultancy and managed support services are time-bound, he says. 

"The [vendor] agreement includes data-return, transition, and handover obligations so that changing provider does not require surrendering those assets or losing operational continuity," he explains. 

Documentation, training, certification, and handover to PGO staff are also built in as deliverables, he adds. 

As part of PGO 2.0, the first procurement for the AI model licensing and deployment was awarded on August 26, with the vendor being Maldivian. 

Some of the underlying technologies, including the frontier model capability, are sourced internationally. 

Rather than trying to build every component domestically, Shareef says the more important thing is being able to control the data, infrastructure, accounts, access, ownership, and exit of a service. 

He adds that the core operational stack runs on infrastructure controlled by the Office. 

The semantic search engine, Maldivian legal retrieval systems, embeddings, indexes, logs, and admin tools all run on-premises. "Live case data stays on PGO-controlled infrastructure," he shares. 

Service accounts holding admin roles, recovery contacts, credentials, API keys, and billing visibility can only be established in the Office's name, he notes. 

The service accounts will then able to grant or revoke access to external suppliers to access the system.

He highlights that Maldives' local language capability, which is Dhivehi, is also a core requirement of the tech stack, to ensure that the system is used responsibly in the Maldivian context. 

Built for a challenge that hasn't happened yet 

The framework states any AI-assisted work used in court must be disclosed and open to challenge. 

"The prosecutor must be able to identify the tool and version used, the relevant processing or prompts, any thresholds applied, and the human review steps," Shareef explains, adding that the original material must be preserved alongside any processed version. 

Regardless of what AI did, like to enhance, transcribe, translate, analyse, filter, rank, or summarise, defence lawyers will always be able to cross-examine on how AI touched a case, he adds. 

PGO staff are also expected to prepare "sufficient documentation" for the court to assess the reliability and for the defence to challenge the process, he notes. 

None of this has been tested in a Maldivian courtroom yet because no AI capability is operating on live PGO matters.  

Shareef adds that disclosure works both ways, with the courts setting their own expectations for AI-touched evidence, as well as the defence lawyers being able to ask the relevant questions.

His office is engaging the Bar Council on that, and will follow the directions courts issue on AI use in proceedings. 

Currently, the framework has no reach into the police, the courts, and other stakeholders. "What we can govern is how our prosecutors receive and use material that has been processed by AI elsewhere," he says. 

"Our duty to evaluate that material is not reduced because another institution used the tool," he adds. 

Talks are underway with the courts on disclosure expectations and with the police on evidence handover. 

Interoperability work with the police has been planned for the second year as the Office wanted to establish their own governance arrangements first. 

On measuring PGO 2.0's success, Shareef is applying the same test as in May. 

"I want [confidence that responsible AI guidance existed] at 75 or above [from previously 52]. If adoption increases but confidence in the governance does not, then an important part of the programme has not succeeded," he says. 

Within 100 days of the strategy's launch, he expects the governance instruments to function in several ways. 

These include the AI literacy training completed across the Office, specialist certification underway, the first new Mafini (the Office's case management system) function live under PGO 2.0, the first AI capability deployed under the framework, prosecutors equipped with devices, and secure off-site backup in place.  

From there, the instruments will go through further review when the law or the technology moves.

"I also want evidence that the governance changes decisions when necessary," he highlights, adding that even that means the framework has to be willing to say no to a tool if it falls short of the standards.