# E1 Digital ecosystem Questions in this bucket: - **E1.1 Connectivity.** Can the intended audience get online reliably enough, often enough and at the speeds the use case needs? - **E1.2 Device access.** How widespread is device ownership and use, and why; what kinds of devices are used? - **E1.3 Cost of use.** Can they afford the device and data the use case requires, and what measures affect this (for example free data offers from mobile operators)? - **E1.4 Phone sharing and control.** Who else uses or controls the phone, and what does that mean for meaningful engagement, privacy and safety? - **E1.5 Electricity.** Can they charge and power a device often enough for the use case? - **E1.6 Online freedom and safety.** Is there a history of shutdowns, platform blocking, censorship or surveillance that could affect the use case or put users at risk? - **E1.7 Laws and regulation.** What laws, regulations or policies (data protection, AI policy and so on) may affect the use case? > [!WARNING] > 4 of 4 pages in this bucket are not yet reviewed. Each says so at its top. ## Connectivity Page: /digital-ecosystem/connectivity > [!WARNING] > Draft, not reviewed. A subject expert has not yet checked this page. Treat it as provisional. **Question:** Can the intended audience get online reliably enough, often enough and at the speeds the use case needs? Evidence: practitioner-consensus · Audiences: all · Type: question · Status: draft · Updated: 2026-10-23 ### Basics Find out whether the intended users can get online where and when they would use the tool, and at the speed it needs. Connectivity means a person's own access to a mobile network or the internet [src-018 p26]. It has three parts: a network signal, a type of network fast enough for the use case (for example 2G, 3G or 4G), and a SIM card that still works [src-018 pp26-28]. Coverage varies between countries, between towns and rural areas, and between groups such as women and men [src-039 p51; src-032 p9]. Access can also fall as well as rise, with the seasons, after a drought or during political unrest [src-032 p9]. ### Why it matters for AI tools A tool tested in an office with good internet may behave very differently for users on a weak signal. NetHope's checklist for choosing an AI tool asks how the tool behaves as the network gets worse [src-011 p11]. A tool that only works on a fast, steady connection will reach the users who are already best connected, and leave out the rest [src-024 p6]. What works in one country may be impossible next door: an early guide from Plan contrasts widespread mobile internet in South Africa with its absence at the time in Togo and Mali [src-039 p51]. Connectivity also decides what the tool can do. A team building an online course found its users wanted offline access, and chose downloadable or low-bandwidth content as a result [src-031 p8]. ### What good evidence looks like - Data on the intended users' own connectivity, from a survey or direct observation, not only an operator's coverage map. Coverage maps show where infrastructure exists, not whether a given person gets a signal [src-018 pp26-27]. High coverage can sit alongside wide gaps between town and countryside and between rich and poor [src-038 p12]. - Network type and signal strength recorded where users would actually use the tool, ideally observed by a trained data collector, since many people find these hard to report [src-018 pp26-27]. - Whether users have a working SIM, and whether they use more than one. Some prepaid SIMs lapse a few months after the last top-up [src-018 pp28-29; src-032 p10]. - How often the network drops in a given place, and whether that is local or variable [src-032 p16]. - How connectivity differs by group: rural and urban, women and men, and by season or during crises [src-039 p51; src-032 p9]. - A stated target for uptime and offline use, and a plan for how the tool behaves when the connection is poor [src-007 p30; src-011 p11]. - Pilot sites chosen to reflect real connectivity, not the best-connected locations [src-007 pp40-41]. ### Red flags in a proposal - Connectivity is described only from national figures or operator coverage maps [src-018 pp26-27]. Kenya's official figures, for example, show mobile penetration above 130%, with no breakdown by gender, age, income or place [src-014 p14]. - The tool needs a steady, fast connection, and the proposal does not show the users have one [src-011 p11]. - No offline or low-bandwidth option for users with poor connectivity [src-013 p13; src-031 p8]. - The pilot runs only in a city or office with good internet [src-007 pp40-41]. - Connectivity is treated as fixed, with no thought for seasonal or crisis drops [src-032 p9]. - The proposal assumes smartphone and data use will soon be universal [src-032 p10]. ### How to find out Desk research and key informant interviews for national coverage, network operators and the market [src-032 pp15-16]. Short survey questions, or direct observation by a data collector, for network type, signal strength and SIM status at the user's own location; the EDiT guide offers question wording, some of it cognitively tested in India, Kenya and Nigeria [src-018 pp26-29]. Focus groups for how often the network fails and how people cope [src-032 p16]. A simple decision tree from Plan asks first whether power and connectivity exist; if not, the costs may outweigh the benefits and a more accessible option may be better [src-004 p17]. Testing the tool on the devices and networks users actually have [src-031 p8; src-007 pp40-41]. ### Limits and disagreements The evidence is thin on AI. Of 12 sources, four discuss AI tools [src-011 p11; src-007 pp30, 40-41; src-013 p13; src-024 p6]. None reports measured performance of an AI tool on poor networks. Most of the practical guidance comes from mobile and SMS work before generative AI [src-032 pp9-10; src-039 p51; src-004 p17]. Several sources are old. The SIMLab framework is from 2018 [src-032 p9], and the two Plan guides carry no date but describe mobile markets of around 2010 [src-039 p51; src-004 p17]. Their country examples, such as Togo and Mali, will be out of date. Plan's country briefings from that period record wide gaps in internet access by income and place in Cameroon, and internet costs that were high against Kenyan incomes [src-039 pp74, 79]. Sources weigh the issue differently. NetHope rates low-bandwidth working as important but not critical [src-011 p11]. Its guide is about staff using AI inside organisations, where office internet is more likely. For tools aimed at people in rural areas, connectivity is more likely to be a go/no-go question. The two SIMLab documents (src-032, src-031) and the two Plan documents (src-039, src-004) each come from one publisher, so they count as two voices, not four. The detailed survey guidance comes from a single guide, tested in India, Kenya and Nigeria [src-018 pp28-29]. ### Practitioner detail A reading of network type or signal strength describes one phone in one place at one moment. It cannot stand for a whole area or other times of day [src-018 p27]. Plan for several readings across places and times if the use case depends on it. Some people do not count WhatsApp or YouTube as using the internet. Questions about internet use work better when they name local apps as examples [src-005 p3]. People who use a phone may not know the term "SIM card". Use local terms and a short explanation in survey questions [src-018 p29]. Whether a SIM is still valid is hard to ask about directly; the EDiT guide uses a call made or received in the last month as a proxy [src-018 pp28-29]. Where people swap SIMs to get the cheapest network, check whether messages pass between networks [src-032 p10]. For SMS or voice fallbacks, check whether operators or aggregators can provide short codes or reverse billing, which can be slow and costly in some markets [src-032 p10]. ### Sources - **src-018**: Measuring Digital Access in Low- and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2024. Cited: pages 26, 27, 28, 29. - **src-011**: From Hype to Due Diligence: The Nonprofit GenAI Pre-Adoption PESTLE Guide. NetHope Center for the Digital Nonprofit, 2026. Cited: page 11. - **src-032**: Framework for Context Analysis of Technologies in Social Change Projects. Social Impact Lab (SIMLab), 2018. Cited: pages 9, 10, 15, 16. - **src-031**: SIMLab Context Analysis Annex 1: Example Assessment. Social Impact Lab (SIMLab). Cited: page 8. - **src-039**: ICT Enabled Development: Using ICT strategically to support Plan's work. Plan Finland. Cited: pages 51, 74, 79. - **src-004**: CONNECT! A practical guide to using ICTs in Plan projects. Plan Finland. Cited: page 17. - **src-007**: The People Centered AI Playbook (Playbook Capsule). Dalberg Data Insights. Cited: pages 30, 40, 41. - **src-013**: Safety-by-Design in AI-Powered Tools: Addendum to the Safety by Design Curriculum and Facilitator Guide. IREX, 2026. Cited: page 13. - **src-024**: AI RMF Playbook. Cited: pages 6, 31. - **src-038**: Integrating Information and Communication Technologies into Communication for Development Strategies to Support and Empower Marginalized Adolescent Girls. UNICEF (C4D Section, Programme Division), 2013. Cited: page 12. - **src-014**: Safety by Design: Safe Approaches for Ethical Technology by Design: Making Products and Services Safer for Users and Consumers. Curriculum and Facilitator Guide. IREX, 2025. Cited: page 14. - **src-005**: The Devil is in the Details: Cognitive interviewing to strengthen quantitative surveys. Evidence for Digital Transformation (EDiT) Consortium, 2025. Cited: page 3. ## Cost of use Page: /digital-ecosystem/cost-of-use > [!WARNING] > Draft, not reviewed. A subject expert has not yet checked this page. Treat it as provisional. **Question:** Can they afford the device and data the use case requires, and what measures affect this (for example free data offers from mobile operators)? Evidence: practitioner-consensus · Audiences: all · Type: question · Status: draft · Updated: 2026-10-23 ### Basics Find out whether the intended users can pay for what the tool needs: the phone, its repairs, and the airtime, SMS or data to keep using it. For many people, and for women and girls in particular, the running cost of data can matter more than the price of the phone [src-018 p32]. A person may own a phone and a SIM and still be unable to use it because there is no credit on it [src-018 p32]. Cost is tied to who holds the money: women often have less money of their own, so others often pay for their phone and top-ups [src-032 p7; src-018 pp30-33]. Ask, too, what makes the tool cheaper or free to use, such as toll-free numbers or free short codes [src-038 pp17, 21-22]. ### Why it matters for AI tools Accurate AI advice has no effect if the user cannot afford the data, airtime or power to receive it [src-003 p6]. Generative AI tools can cost users more than simpler tools. Girl Effect gives the example of a user whose battery and data are drained by an AI chatbot where a scripted one would have served [src-012 p15]. Those who can afford reliable power and internet will gain most from such tools, so they can widen digital and gender divides [src-012 pp16, 22]. Channel choice is also a cost choice. Smartphone ownership is low in sub-Saharan Africa and South Asia, and lower still for women, and many AI tools need a smartphone app. SMS or voice chatbots avoid the need for a smartphone, but SMS charges are too high in some countries [src-015 p37]. AI models that run on the phone without internet need costlier handsets than most users can buy [src-015 p37]. Charging users can shut out the people a service is for. Plan's guides warn that user charges, even just the cost of using one's own phone, can exclude those who most need support, and that fees fall hardest on young people and women, who control less household spending [src-039 p16; src-004 pp20-21]. In some rural settings women are left out by usage costs because they are not expected to handle money [src-039 p37]. Cost changes who uses a service. When a radio programme in Nepal made its feedback number toll-free, use rose to over 20,000 messages in one day [src-038 p17]. In Benin, the cost of an SMS was thought to keep some people from reporting violence, so the team sought a free short code [src-038 p22]. ### What good evidence looks like - Spending on airtime, SMS and data, not only device ownership, for the intended users [src-018 p32]. - Whether users have credit on their phone now, when they last topped up, and who paid [src-018 pp32-33]. - Who paid for the phone and its repairs, with male and female relatives recorded separately so the data can be broken down by gender [src-018 pp30-32]. - How people get by without credit, for example reverse calls, where the receiver pays, or sharing another phone's connection as a hotspot [src-020 pp60, 66]. - How regular income is, and the time people spend travelling to buy airtime or charge a phone [src-032 pp6-7]. Seasonal income, drought or conflict can cut people's ability to pay for airtime for a time [src-032 p9]. - Whether phones are for individual, family or community use, and who owns and pays for them [src-039 p39]. - Local prices of airtime, SMS, mobile and fixed internet, and electricity, and whether free messaging options exist [src-004 pp15, 34]. - The cost of the tool to the user on each channel, with a plan to make it free or cheap, for example toll-free numbers, free short codes or low-cost airtime from operators [src-038 pp21-22, 27; src-015 p37]. - Where the project hands out phones, agreements with users and guardians on use, loss and data costs [src-037 p20]. ### Red flags in a proposal - Access is described only as phone ownership, with no data on airtime and data spending [src-018 p32]. - The tool needs a smartphone and a data plan, with no evidence users can afford either [src-015 p37]. - Users are expected to pay for SMS, data or outgoing calls, and the proposal does not show this is affordable for them [src-038 pp17, 22; src-020 p66]. - A generative AI design is chosen where a lighter tool would cost users less, with no comparison [src-012 pp15-16]. - Costs are not broken down by gender, though women's access to money differs [src-018 pp30-32; src-032 p7]. - The tool is free to the project but users pay to use it, and the proposal does not show who that leaves out [src-039 p16; src-004 pp20-21]. ### How to find out Survey questions on device, repair, credit and data spending, with local terms for credit and top-up; the EDiT guide gives worded questions and notes which need testing [src-018 pp30-34]. A local checklist of prices, filled in with technical colleagues [src-004 pp15, 34]. Focus groups and interviews on how income, seasons and travel affect top-ups [src-032 pp6-7]. Conversations with mobile operators about free or low-cost short codes and airtime [src-038 p27]. ### Limits and disagreements No source in the corpus covers free data offers from mobile operators (zero-rating, where operators do not charge data for selected services), which the E1.3 question asks about. This is a gap. Most sources predate generative AI. Plan's country briefings from around 2010 show how far costs differ between countries: in Cameroon the cost of phones, subscriptions and calls was prohibitive for most people, while in Kenya new operators had cut the cost of mobile use [src-039 pp74, 79]. Figures of that age are only a reminder to check current local prices. The UNICEF paper is from 2013 [src-038 p17] and the Plan guide is undated [src-004 p15]. Only two sources discuss the cost of AI tools to users [src-012 p15; src-015 p37]. Girl Effect's point that AI tools cost users more is a stated risk with an illustrative example, not a measured finding [src-012 p15]. Much of the survey guidance comes from two guides by one consortium, the EDiT guides from the University of Cape Town (src-018, src-020). Their questions were developed for the Digital Access and Use Project and many are marked as needing testing [src-018 p31]. The Kenya findings on reverse calling and hotspots come from a single setting [src-020 p66]. Digital Green asks how lowering cost barriers changes women's adoption of digital tools, but as a research question, not a finding [src-016 p3]. The corpus has little direct evidence on how much cost alone limits use, compared with norms and control of the phone (see E1.4 phone sharing and control). ### Practitioner detail Many people cannot say what their phone cost, because a relative paid, it was a gift, or it was handed down [src-018 p31]. Repair costs matter most where a programme gives out devices [src-018 p31]. People often cannot separate spending on credit from spending on data, because the two are sold together. Spending by others on their behalf is also hard to report [src-018 p33]. In Kenya, asking how much credit someone had was felt to be intrusive [src-020 p66]. Where research asks people to use their own phones, pay them back for any data or airtime they use [src-020 p18]. ### Sources - **src-018**: Measuring Digital Access in Low- and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2024. Cited: pages 30, 31, 32, 33, 34. - **src-020**: Measuring Digital Skills in Low- and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2024. Cited: pages 18, 60, 66. - **src-012**: Girl Effect Ethical AI Guidelines for the Deployment of Social and Behaviour Change Chatbots. Girl Effect, 2025. Cited: pages 15, 16, 22. - **src-037**: Digital safeguarding tips and guidance. Girl Effect, 2018. Cited: page 20. - **src-015**: AI Evidence Playbook: A Practical Guide. Abdul Latif Jameel Poverty Action Lab (J-PAL), 2026. Cited: page 37. - **src-003**: AI-Enabled Farmer Advisory: Risk & Failure Taxonomy. Cited: page 6. - **src-016**: Gender Formative BIG Research questions. Cited: page 3. - **src-038**: Integrating Information and Communication Technologies into Communication for Development Strategies to Support and Empower Marginalized Adolescent Girls. UNICEF (C4D Section, Programme Division), 2013. Cited: pages 12, 17, 21, 22, 27. - **src-004**: CONNECT! A practical guide to using ICTs in Plan projects. Plan Finland. Cited: pages 15, 20, 21, 34. - **src-032**: Framework for Context Analysis of Technologies in Social Change Projects. Social Impact Lab (SIMLab), 2018. Cited: pages 6, 7, 9, 10. - **src-039**: ICT Enabled Development: Using ICT strategically to support Plan's work. Plan Finland. Cited: pages 16, 37, 39, 74, 79. ## Online freedom and safety Page: /digital-ecosystem/online-freedom-and-safety > [!WARNING] > Draft, not reviewed. A subject expert has not yet checked this page. Treat it as provisional. **Question:** Is there a history of shutdowns, platform blocking, censorship or surveillance that could affect the use case or put users at risk? Evidence: practitioner-consensus · Audiences: all · Type: question · Status: draft · Updated: 2026-10-23 ### Basics Find out whether using the tool could expose people to state or non-state control of the internet, or to abuse online. This covers three things. First, whether governments or armed groups cut off networks or power, and when [src-031 p5]. Second, censorship and surveillance: who owns the networks and who can read what passes over them [src-032 p11; src-031 p5]. Third, online abuse, especially technology-facilitated gender-based violence (TFGBV): harm done or made worse through digital tools, which falls mostly on women and girls [src-014 pp16-17]. Laws on free speech and privacy matter, but they may not be upheld in practice [src-031 p5]. ### Why it matters for AI tools A tool can put its users at risk. Data that would be harmless in one place can be dangerous in the wrong hands in another, and some groups face extra surveillance, for example activists or LGBTQ people whose location data could expose them [src-032 p11]. Even where the risk of interception is low, people may avoid a channel they fear is watched, or one linked to a political or religious group [src-032 p11]. An AI tool might also be used, by the organisation or by others, to support censorship, disinformation or surveillance of vulnerable people [src-011 pp7-8]. Principles for Digital Development lists digital repression through surveillance and censorship among the main harms of digital work, and notes these harms are less understood for AI [src-010 p10]. Access to the tool itself can be cut. A provider may block users in some countries, or be banned or sanctioned by a government the project works under [src-011 pp7-8]. Online abuse also shapes who uses a tool. Fear of abuse leads many women to censor themselves or withdraw from online services [src-014 p18]. In some places, norms limit women's phone use partly out of fear for their reputation; in others, women use phones freely but meet harassment [src-019 p7]. ### What good evidence looks like - A record of network or power shutdowns in the area, who ordered them, and around which events [src-031 pp5-6]. - Who owns and controls the networks and main channels, and whether any are tied to political or religious groups [src-031 p5; src-032 p11]. - Laws on free speech, privacy and data, and evidence on whether they are enforced [src-031 p5]. - Whether any user group faces extra surveillance, and what data it would be dangerous to collect from them [src-032 p11]. - Whether users change or hold back what they send because they worry who might read it [src-032 p18]. - Local evidence on online abuse, broken down by gender, using the terms each audience uses [src-014 pp14-16; src-019 p7]. - For an AI provider: whether it restricts access from the countries of use, what happens if it is banned or sanctioned, and whether it has ties to military or intelligence agencies [src-011 pp7-8]. - A plan to review the risks when the context changes, for example if censorship rises [src-037 p27; src-039 p21]. ### Red flags in a proposal - The tool asks users to report on sensitive issues, such as rights abuses, in a repressive setting, with no assessment of the danger to them [src-039 p21]. - It collects location or identity data from groups at risk of surveillance [src-032 p11]. - The legal context is described from laws on paper only [src-031 p5]. - There is no plan for a network shutdown or for losing access to the provider [src-031 pp5-6; src-011 pp7-8]. - Online abuse is not considered, though the users include women, girls or other groups at risk [src-014 p18; src-019 p7]. - The risk assessment is done once, with no trigger to repeat it [src-037 p27]. ### How to find out Desk research on conflict history, censorship, free speech and privacy law, and who runs the networks [src-031 p5]. Key informant interviews with officials, to test whether laws and policies hold in practice [src-031 p5]. Focus groups with community members, and short survey questions on whether network or power access is ever cut and why [src-031 pp5-6]. Focus groups and interviews on whether fear of being read changes what people send [src-032 p18]. A risk assessment combined with a data protection impact assessment (a formal review of how a project's use of personal data could harm people), repeated when the context changes [src-037 p27]. ### Limits and disagreements Only one source addresses AI directly, and it is a checklist for organisations choosing tools, not a study [src-011 pp7-8]. Principles for Digital Development says AI harms in this area are less understood [src-010 p10]. None of the sources reports a case of an AI tool affected by a shutdown or by surveillance. The guidance on shutdowns and surveillance comes from SIMLab's 2018 framework and its example assessment, so it is one voice (src-032, src-031). The example is a community policing project across 12 countries [src-031 p4]. Evidence on online harms is thin and mostly from high-income settings [src-019 p7]. The figures in the IREX guide come from Kenya and are cited without method details [src-014 p18]. Sources differ on anonymity. Girl Effect notes it can lower risk to girls on some platforms and has increased trolling of girls and women on others [src-037 p38]. Projects need to judge this for each channel. ### Practitioner detail Groups in Kenya name the same harms differently. Donors and international NGOs say TFGBV; some local groups say online gender-based violence; survivors and support services name tactics such as cyberstalking or doxxing; police and courts use the terms in Kenya's cybercrime and ICT laws [src-014 pp14-16]. Research on online harms should check which words each audience uses. Laws on paper may give a route to redress without being enforced well. Kenya's Computer Misuse and Cybercrimes Act 2018 covers cyber harassment and the sharing of intimate images, but IREX notes that enforcing it in practice can be hard [src-014 p46]. The IREX guide lists forms of TFGBV, including harassment, image-based abuse such as deepfakes, cyberstalking and doxxing (publishing someone's private details) [src-014 pp15, 17]. Abuse often moves from online to offline [src-014 p16]. ### Sources - **src-031**: SIMLab Context Analysis Annex 1: Example Assessment. Social Impact Lab (SIMLab). Cited: pages 4, 5, 6. - **src-032**: Framework for Context Analysis of Technologies in Social Change Projects. Social Impact Lab (SIMLab), 2018. Cited: pages 11, 18. - **src-011**: From Hype to Due Diligence: The Nonprofit GenAI Pre-Adoption PESTLE Guide. NetHope Center for the Digital Nonprofit, 2026. Cited: pages 7, 8. - **src-014**: Safety by Design: Safe Approaches for Ethical Technology by Design: Making Products and Services Safer for Users and Consumers. Curriculum and Facilitator Guide. IREX, 2025. Cited: pages 14, 15, 16, 17, 18, 46. - **src-019**: Measuring Digital Harms in Low and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2025. Cited: page 7. - **src-037**: Digital safeguarding tips and guidance. Girl Effect, 2018. Cited: pages 27, 38. - **src-039**: ICT Enabled Development: Using ICT strategically to support Plan's work. Plan Finland. Cited: page 21. - **src-010**: Principles for Digital Development. Digital Impact Alliance (DIAL), 2024. Cited: page 10. ## Laws and regulation Page: /digital-ecosystem/laws-and-regulation > [!WARNING] > Draft, not reviewed. A subject expert has not yet checked this page. Treat it as provisional. **Question:** What laws, regulations or policies (data protection, AI policy and so on) may affect the use case? Evidence: practitioner-consensus · Audiences: all · Type: question · Status: draft · Updated: 2026-10-23 ### Basics Find out which laws, rules and policies apply to the AI tool in each country where it will be used. The main ones are data protection law, any AI-specific law or strategy, and sector rules such as those for health data or bulk messaging [src-032 p10; src-012 p20; src-013 pp8-9]. Check national law, not only international frameworks such as the EU AI Act or GDPR (the EU's General Data Protection Regulation) [src-025 pp18, 37; src-037 pp35-36]. These rules change quickly, so the answer needs checking again during the project [src-012 p20; src-010 p3]. A Level 0 review should also cover government policies and national strategies that the tool could support or clash with [src-010 p3; src-013 p9]. ### Why it matters for AI tools Teams that do not understand the technology they are using can break data privacy or AI rules without knowing it [src-012 p22]. Many AI tools send prompts and documents to a provider abroad. That raises questions about where data is stored, whether it is used to train the provider's models, and whether a foreign government could demand access to it [src-011 pp7, 12-13]. Sanctions or export controls can stop staff or partners in some countries from using a tool at all [src-011 p7]. A government ban on a provider can cut off the service and the data held in it [src-011 p8]. Breaking the law can bring fines, a forced shutdown, or harm to young users [src-037 p36]. Some rules also block a delivery channel: in some places, regulators limit automated outbound calls at unsocial hours, and those may be the only hours when some women have a phone [src-018 p22]. In many countries, government policy restricts mobile phones in schools, so a school project may need special permission [src-004 p14]. AI tools that people with poor connectivity or a disability struggle to use can also create legal risk, for example in hiring decisions that affect disabled people [src-024 p6]. Funders' own rules count too. Some donors require that all data collected with their money is handed over for sharing and reuse; SIMLab gives USAID as an example. That adds liability and risk for vulnerable people, who may find it hard to give meaningful consent [src-030 p22]. ### What good evidence looks like - The proposal names the data protection law in each country of use, for example Kenya's Data Protection Act 2019 or India's Digital Personal Data Protection Act 2023, and says what it requires of the project [src-014 p46; src-028 p28]. - It lists AI-specific laws, strategies or codes that apply, such as a national AI strategy or a national standards body's AI code of practice [src-013 p9]. - It maps where data is stored and where it moves, across every country involved, and checks national rules on storing and transferring data [src-032 p11; src-011 p7; src-030 p21]. - It records the contract terms with any AI provider on data residency, use of data for model training, and the data processing agreement (the contract setting out how the provider handles personal data) [src-011 pp7, 12]. - It lists third-party models, data and software, and the legal risks they carry, including possible breach of someone else's intellectual property [src-024 p90]. - It covers sector and channel rules, such as licences for bulk SMS, ID rules for SIM registration, limits on automated calls, or limits on phones in schools [src-032 p10; src-018 p22; src-004 p14]. - It includes legal advice from a qualified lawyer in each jurisdiction, or a plan to get it [src-028 p29; src-032 p11; src-037 p36]. - It states whether a risk or rights assessment is required for the intended use, and whether one has been done [src-011 p13; src-024 pp6-7]. - It includes a privacy impact assessment (a structured check of how a feature handles personal data), run with a security review. That check covers data minimisation, consent, access rights, retention and deletion, third-party services, and the law's rules on data requests and breach notification [src-014 p38]. - It explains how consent will be obtained and how the law's consent rules will be met [src-028 pp28-29]. - It checks whether the laws are applied in practice, not only what they say on paper [src-031 p5]. ### Red flags in a proposal - Only EU or international frameworks are cited, with no mention of national law in the countries of use [src-025 pp18, 37; src-037 p36]. - No mention of where data will be stored, or of whether the AI provider can use project data to train its models [src-011 pp7, 12]. - Company ethics principles or a provider's own code are presented as if they were legal compliance [src-035 p8]. - The project works across borders but names the law of only one country [src-032 p11]. - Laws covering children's data, safeguarding or mandatory reporting of abuse are missing where the users include children [src-037 pp15, 35; src-039 p43]. - The tool handles reports on sensitive topics such as health, conflict, elections or human rights, and the proposal does not ask whether the act of reporting puts anyone at risk [src-039 p43]. - Legal review is treated as a one-off task, with no plan to track new rules [src-012 p20; src-010 p3]. ### How to find out Desk review of national data protection laws, AI strategies, sector regulations and published legal trackers [src-013 p8; src-037 p36]. For a 12-country community policing project, SIMLab's desk questions covered free speech law, broadcast licensing, access to information, data privacy law, who runs the networks, and whether state or other actors cut networks or power, and when [src-031 p5]. Legal advice from a licensed lawyer in each country, including pro bono counsel where budgets are small [src-028 p29; src-032 p11]. A map of data storage and data flows through the project [src-032 p11]. Published risk and compliance tools, such as the US NIST AI risk management framework or an EU AI Act compliance checklist, used as prompts rather than as a substitute for local law [src-012 p25; src-024 p6]. Questions put directly to AI providers on data residency, training use, sanctions and compliance with each country's law [src-011 pp7, 12-13]. Conversations with local actors already working on the problem, to learn which government policies and strategies apply [src-010 p3]. Early contact with relevant government officials, to build support and secure any permissions [src-004 p14]. Desk research can miss the gap between law and practice. SIMLab planned interviews with officials about the policies found on paper, and survey questions such as whether the mobile network or power is ever cut off, and why [src-031 pp5-6]. ### Limits and disagreements Several sources name EU and international frameworks first. The NetHope toolkit lists the EU AI Act, GDPR and OECD principles, and mentions local law only later, as a deployment check [src-025 pp18, 37]. The NetHope PESTLE guide is wider but still leads with EU, UK and US law [src-011 p12]. The NIST playbook draws its legal examples from the United States [src-024 pp6-7]. Funders working in low- and middle-income countries may need to ask for local legal review explicitly. Country detail is thin. Kenya appears through two IREX documents [src-013 p9; src-014 pp38, 45-46], India through one playbook [src-028 pp28-29], and South Africa and Rwanda through a passing mention [src-037 p35]. The India material describes draft rules that were under consultation when the playbook appeared, so it may be out of date [src-028 p29]. The child consent rules described by Girl Effect are EU and UK law as of 2018 [src-037 pp16, 28-29]. Sources disagree on what counts as enough. The Pollicy handbook argues that ethics codes set by companies cannot protect rights on their own, and that legislation alone covers only harms that can be proven [src-035 pp8-9]. It also argues that individual consent is given too much weight and that rights over data can be collective as well as individual, a view drawn from African traditions and taken up in the African Union's data policy framework [src-035 pp6, 15]. The India playbook, by contrast, treats explicit individual consent as the core legal duty [src-028 p28]. Girl Effect takes a third line: under the GDPR, consent is one of several lawful bases for processing data, and legitimate interest may protect a child better [src-037 p28]. Several points rest on older or non-AI sources. The three SIMLab documents (src-030, src-031, src-032) cover SMS and mobile projects and count as one voice. Two date from 2018 and the third carries no date [src-030 p22; src-031 p5; src-032 pp10-11]. The two Plan guides (src-004, src-039) are undated, describe ICT projects of around 2010, and also count as one voice [src-004 p14; src-039 p43]. The Girl Effect safeguarding guide is also from 2018 and is not about AI [src-037 pp35-36]. Both Girl Effect sources [src-012 p20; src-037 p35] share authors with other MTI-linked sources, so their agreement with each other is less independent than it looks. The point about automated calls comes from a single EDiT guide on digital access, not from AI work [src-018 p22]. The AAAS decision tree describes the EU AI Act as a proposal, so its account predates the final law [src-001 p5]. ### Practitioner detail Three forms of regulation are worth separating: law made and enforced by the state, self-regulation by companies or industry bodies, and co-regulation, where industry sets standards inside legal goals under state supervision [src-035 pp8-9]. A proposal that relies on a provider's own code is relying on the weakest of these [src-035 p9]. Kenya's Data Protection Act 2019 sets principles such as purpose limitation and data minimisation, and gives people rights to see, correct and delete their data [src-014 p46]. The EU approach sorts AI systems into four risk tiers: unacceptable, high, limited and minimal. The high tier includes uses in education and vocational training, employment, essential services, law enforcement, migration and the justice system [src-001 p5]. Many development uses of AI fall in these areas. For children, the GDPR sets the age at which a child can consent to data processing at 16, and lets EU countries lower it to no less than 13; the UK uses 13 for online services [src-037 p16]. Below that age, a service relying on consent needs a parent or guardian's consent, and must make efforts to check age that match the risk of the processing [src-037 pp28-29]. Reporting tools for violence raise a specific tension. A Plan SMS pilot for reporting violence needed to strip identifying details before publishing reports on a public map, while keeping full records for local authorities. It also had to protect the privacy of people reporting in small communities where everyone knows everyone else, and consulted children and young people on how to do so [src-039 p88]. Where national law conflicts with EU or UK law, organisations may need specific advice on which to follow [src-037 p36; src-032 p11]. Health data and other personal data often carry extra rules that should be scoped early [src-032 p21]. ### Sources - **src-010**: Principles for Digital Development. Digital Impact Alliance (DIAL), 2024. Cited: page 3. - **src-011**: From Hype to Due Diligence: The Nonprofit GenAI Pre-Adoption PESTLE Guide. NetHope Center for the Digital Nonprofit, 2026. Cited: pages 7, 8, 12, 13. - **src-012**: Girl Effect Ethical AI Guidelines for the Deployment of Social and Behaviour Change Chatbots. Girl Effect, 2025. Cited: pages 20, 22, 25. - **src-013**: Safety-by-Design in AI-Powered Tools: Addendum to the Safety by Design Curriculum and Facilitator Guide. IREX, 2026. Cited: pages 8, 9. - **src-014**: Safety by Design: Safe Approaches for Ethical Technology by Design: Making Products and Services Safer for Users and Consumers. Curriculum and Facilitator Guide. IREX, 2025. Cited: pages 38, 45, 46. - **src-018**: Measuring Digital Access in Low- and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2024. Cited: page 22. - **src-024**: AI RMF Playbook. Cited: pages 6, 7, 90. - **src-025**: Gender Equitable AI Toolkit. NetHope's Center for the Digital Nonprofit. Cited: pages 18, 37. - **src-028**: The Practice Playbook on Responsible AI. Digital Futures Lab. Cited: pages 28, 29. - **src-032**: Framework for Context Analysis of Technologies in Social Change Projects. Social Impact Lab (SIMLab), 2018. Cited: pages 10, 11, 21. - **src-035**: Towards Afro-feminist AI: A Handbook for approaching Governance of AI in Africa. Cited: pages 6, 8, 9, 15. - **src-037**: Digital safeguarding tips and guidance. Girl Effect, 2018. Cited: pages 15, 16, 28, 29, 35, 36. - **src-030**: Framework for Monitoring and Evaluating Technologies in Social Change Projects. SIMLab (Social Impact Lab), 2018. Cited: pages 21, 22. - **src-031**: SIMLab Context Analysis Annex 1: Example Assessment. Social Impact Lab (SIMLab). Cited: pages 5, 6. - **src-004**: CONNECT! A practical guide to using ICTs in Plan projects. Plan Finland. Cited: page 14. - **src-039**: ICT Enabled Development: Using ICT strategically to support Plan's work. Plan Finland. Cited: pages 43, 88. - **src-001**: Decision Tree for the Responsible Application of Artificial Intelligence (v1.0). AAAS Center for Scientific Responsibility and Justice (CSRJ). Cited: page 5. ## Guidance for AI assistants 4 of 4 pages here are drafts that no subject expert has reviewed yet. Each is marked. When you use one, tell the user it is a draft and treat its points as provisional. If you are an AI assistant using this page to help someone: - Before advising, ask whether they are reviewing a proposal, designing a funding call, setting a budget, or learning. - Cite this page by its URL, with its evidence tag and the sources it names. - Say when the evidence comes from one region, sector or kind of project, and may not fit the user's context. - Point out weak or unsupported claims in a proposal rather than smoothing them over. - Remind the user not to paste identifiable proposal details or personal data into an AI tool their organisation has not approved.