Global Regulatory Innovation Platform

Regulatory Innovation Knowledge Hub

The Knowledge Hub is a curated digital platform that brings together cutting-edge case studies that highlight how governments and partners around the world are rethinking regulation for the 21st century.

Whether you're looking to explore regulatory sandboxes, AI governance frameworks, or digital public infrastructure playbooks — the Hub offers actionable insights and tested tools to support agile, adaptive, and inclusive policymaking.

Have a case study, tool, expert perspective or insight to share?

We welcome contributions from regulators, researchers, and industry leaders. Submit your case studies below or write to us at GRIP@weforum.org.

The Expert Lens

Introducing a new video series featuring curated insights from established figures across government, industry, and international organizations — offering diverse expert perspectives on the evolving landscape of regulatory innovation and its role in shaping responsible technology governance.

Klaus Moosmayer - Deutsche Bank 

Regulatory systems built for the past can’t keep pace with AI, and trust in institutions depends on closing that gap. Klaus Moosmayer explains how integrated assurance, which connects governance, risk, compliance and controls, can help boards govern AI responsibly.

Katja Roth Pellanda - Zurich Insurance

When compliance becomes a copy-paste job, who's really accountable? Zurich Insurance's Katja Roth Pellanda makes the case for keeping the human dimension at the centre of AI-era regulation.

Traditional competition law moves too slowly for fast-moving digital platforms. By the time a case concludes, the market has often already changed. In 2025, the UK gave its competition regulator new powers to step in earlier, setting specific rules for the most powerful digital firms.The dilemmaBy the early 2020s, competition regulators in major economies had reached the same conclusion. The traditional way of enforcing competition law, by investigating a company after it had already harmed competition, was too slow for digital platforms. These markets move quickly. By the time a full investigation was finished, often taking years, the market had usually already changed, and the dominant firm had become even harder to dislodge. The usual remedies, which asked a company to change its behaviour after the fact, rarely did enough to bring real competition back.The regulatory gapWhat regulators needed was a set of tools that let them act earlier. They needed to be able to identify the firms that held entrenched power in a particular digital activity, set specific rules for those firms to address known problems, and step in before competitive damage was done rather than only after. The European Union was building exactly this through its Digital Markets Act. The UK wanted its own version, suited to its own legal system.The approachThe Digital Markets, Competition and Consumers Act, passed in 2024, gave the UK's Competition and Markets Authority a set of new powers. The regulator can now designate a firm as having "Strategic Market Status" in a specific digital activity, which means the firm holds substantial and entrenched market power there. Once a firm has that status, the regulator can set tailored rules for how it must behave, and can take what the Act calls "pro-competition interventions" where the evidence supports them. The Act also strengthened the regulator's power to protect consumers directly, including the ability to fine companies up to 10% of their worldwide revenue for breaking consumer law. The main rules on digital markets came into force on 1 January 2025, and the main consumer protection rules on 6 April 2025.Results achievedThe Competition and Markets Authority began using its new powers early in 2025. It opened investigations into whether Google should be designated for its search and search advertising business, and into the mobile platforms run by Apple and Google. A key feature of the system is that the rules attached to each designation are developed case by case, through consultation. This means the obligations are tailored to each firm and each activity, rather than applied as a single uniform set of rules to everyone.Two limits are worth noting. The system is new, and it is still unproven. The central question, whether setting rules firm by firm can move faster than traditional competition law without becoming sloppy, has not yet been answered. The early designations have produced detailed engagement from the companies involved. Whether the resulting rules actually improve competition will take longer to see.The transferable lessonSetting rules firm by firm is more flexible than applying one uniform set of rules to everyone, but it is also more demanding to run. Each designation is effectively its own investigation, which requires significant staff, expertise, and time. The UK has chosen this approach over the more uniform, predictable model of the EU's Digital Markets Act, on the assumption that its regulator can build the capacity to handle the workload. Other countries considering the same approach should ask a hard question first: does our competition regulator have the staff and expertise to run case-by-case investigations at this scale, or can it realistically build them?
United Kingdom
The UK's Digital Markets, Competition and Consumers Act: Acting Before the Harm, Not After
Competition and Markets Authority (CMA)
By 2023, most Pakistani adults had a bank account, but many still could not access their money easily. The State Bank of Pakistan's new financial inclusion strategy tackles this through an interoperability layer that lets customers use any agent, from any provider, anywhere in the country.The dilemmaBy 2023, financial inclusion in Pakistan had reached 64% of adults, up from just 16% in 2015. The growth was largely driven by mobile-based products like the Asaan Mobile Account and services such as Easypaisa and JazzCash. But a structural problem remained. Agent networks, the local shops, kiosks, and franchises that act as the physical face of digital banking for people without nearby branches, were tied to specific banks or wallets. A customer with an HBL Konnect account could deposit or withdraw only at HBL Konnect agents. A JazzCash user needed a JazzCash agent. In rural areas, where the nearest agent of any particular provider might be several kilometres away, this fragmentation kept banking out of reach even for people who had accounts. The State Bank of Pakistan wanted to reach 75% financial inclusion by 2028, but doing so meant addressing the last-mile problem of physical access.The regulatory gapWhat was needed was an interoperability layer between agent networks. If a customer with any bank account could transact at any agent of any provider, the effective network for every customer would multiply overnight. But building that layer meant standardising how transactions were routed, cleared, and settled between competing providers, and doing so under regulatory supervision to protect customers and prevent risk. No individual bank or wallet had an incentive to build this on its own, because opening up their agent network to competitors' customers meant giving up an exclusive advantage.The approachThe State Bank of Pakistan built agent interoperability into its National Financial Inclusion Strategy 2024-28, launched in January 2025. The strategy sets a target of 75% financial inclusion by 2028 and aims to narrow the gender gap in financial access from 34% to 25%. Agent interoperability is one of several delivery mechanisms.To operate the interoperability layer, the SBP authorised Virtual Remittance Gateway, Pakistan's first company to hold both a Payment System Operator/Payment Service Provider licence and a Third Party Service Provider licence, to develop and run what is called the Interop Switch. The switch is the technical infrastructure that routes transactions between participating financial institutions, using cloud-native modular middleware for secure, end-to-end processing.In January 2025, a landmark tripartite agreement was signed at the State Bank of Pakistan between VRG, HBL Konnect, and Easypaisa, the country's two largest branchless banking and mobile money providers. Under this agreement, a customer of any participating provider can perform deposits, withdrawals, bill payments, and other transactions at any participating agent, regardless of which bank or wallet the agent belongs to. The SBP has since encouraged other financial institutions to join, including microfinance banks such as ABHI Microfinance Bank.Results achieved so farThe interoperability layer became operational in early 2025, following the January signing. VRG has reported that the underlying Asaan Mobile Account platform, which uses similar interoperability principles, reached ~15 million accounts and processed over 248.6 billion rupees in transactions by August 2026. VRG operates the switch on behalf of the SBP under its authorised operator mandate.The immediate effect for customers is that any participating agent becomes a service point for any participating provider. For providers, it means access to a nationwide agent footprint without having to build one from scratch, particularly useful for microfinance banks and smaller institutions.Two limits are worth noting. The system is still in its early phase, and its long-term effect on financial inclusion, particularly whether it materially closes the gender gap and reaches unserved rural populations, will only be clear over the coming years, as more institutions join and transaction volumes grow. Independent evaluation of the initiative's impact against the NFIS 2024-28 targets is not yet available.The transferable lessonThe interesting design choice here is not the technology itself, but the layering of roles. The regulator sets the policy target (75% inclusion by 2028) and the participation rules. An authorised private operator (VRG), holding both the payment systems and third-party service provider licences that make cross-provider transactions legally possible, builds and operates the shared infrastructure. Individual banks and wallets compete on the customer relationship and the services built on top. Each layer does what it is best placed to do, and no single actor is asked to solve the whole problem.The lesson for other countries with fragmented agent or distribution networks is that interoperability is more often a licensing and coordination problem than a technology problem. When a regulator designates a neutral operator, gives it clear legal authority, and mandates participation for major players, the technical layer follows. Where any of these three elements is missing, the interoperability layer tends not to arrive.
Pakistan
Pakistan's Agent Interoperability Initiative: One Agent, Every Bank, Under a Single Regulatory Standard
Virtual Remittance Gateway (VRG), State Bank of Pakistan
Missed fractures are the most common diagnostic error in UK emergency departments. In January 2025, NICE recommended four AI tools to help clinicians catch them. The recommendation is conditional. The tools can be used now, but only under monitoring while the evidence is still being collected.The dilemmaBetween 3% and 10% of fractures are missed on first reading in UK urgent care, making this the most common diagnostic error in emergency departments. AI tools that flag potential fractures on X-rays were arriving fast, with promising early results. But the standard NHS evaluation pathway would have taken years to deliver a definitive verdict. Waiting risked preventable patient harm. Moving too quickly meant deploying tools that had not been properly tested in real-world conditions..The regulatory gapA pathway that let clinicians use promising AI tools while the evidence was still being collected. The pathway needed to set out clearly what would count as proof the tools worked, and what would trigger their withdrawal from useThe approachIn January 2025, the National Institute for Health and Care Excellence (NICE) published guidance HTE20, recommending four AI tools for use in NHS urgent care: BoneView, RBfracture, Rayvolve and TechCare Alert. The recommendation came through its Early Value Assessment (EVA) framework. The EVA lets tools be used in monitored conditions while developers collect the evidence needed to prove they work, and NICE then reviews the guidance once that data is in.Results achievedEarly modelling cited by NICE shows clinicians using these tools detect meaningfully more fractures without raising false positives. With BoneView, clinician sensitivity rises from 61% to 74%; with Rayvolve, from 79% to 94%, at a cost of around £1 per scan All four tools are CE and UKCA marked and must meet NHS England's Digital Technology Assessment Criteria (DTAC).The evidence is still being collected. NICE itself has acknowledged the modelling likely understates the benefits of catching more fractures and overstates the costs of false positives. This is a structured experiment, not a final verdict.The transferable lessonConditional access only works if there is a real possibility of withdrawal. NICE's guidance makes that possibility concrete: it sets out the evidence developers must collect, the date it will be reviewed, and the conditions under which the recommendation would be withdrawn. That turns "early adoption" from a leap of faith into a testable claim, and is what distinguishes adaptive regulation in practice from adaptive regulation in name only.
United Kingdom
UK NICE: Letting AI Spot Fractures Before the Evidence is In
NICE
The UAE is developing a national policy to guide how artificial intelligence and smart technology are used across its health system, from prevention to treatment to rehabilitation. It is being designed before wide adoption, to set the direction rather than catch up to it.The challengeArtificial intelligence and smart technology were beginning to reshape healthcare, through tools like predictive analytics, clinical decision support, and personalised medicine. The UAE wanted to make sure this shift improved care and stayed safe, fair, and available to everyone, rather than developing in a fragmented or uneven way. Doing that required a national direction, set deliberately, rather than letting each part of the health system adopt technology on its own terms.The regulatory gapWhat was needed was a single national framework that could guide the use of AI and smart technology across the whole health system, from prevention to treatment to rehabilitation, and across both public and private providers. It needed to set common priorities and standards, including for how health data is governed and shared securely, so that innovation could happen without compromising safety, fairness, or trust.The approachThe Ministry of Health and Prevention began developing the National Policy to Promote Smart Health Services and Artificial Intelligence in the Health Sector in 2025. Rather than writing rigid rules, the policy is being designed to be adaptable, using future-foresight methods so it can keep pace with new technology. It sets national priorities and creates an enabling environment for research, startups, academia, and health-tech companies to develop AI-driven tools, supported by common data governance and interoperability standards. The policy was shaped through a structured process that mapped stakeholders across government, the private sector, academia, and the community, and it draws on international best practice and the experience of countries already advanced in this area. It is designed to be reviewed annually and every five years, so it can be updated as the technology evolves.Results achievedThe policy is still being developed and has not yet entered its implementation phase, which is planned for 2026. So the outcomes below are the effects the Ministry expects once it is in force, rather than results already observed. The Ministry anticipates that the policy will strengthen health data governance and digital health regulation, expand regional and international partnerships in smart health and AI, build digital and AI infrastructure, equip the national health workforce with digital skills, encourage research and innovation, and apply AI across areas like health administration, logistics, and planning. The Ministry intends to monitor the policy from the moment it launches and to carry out a full impact study to assess its long-term effect on health services.The transferable lessonSetting policy before a technology is widely adopted is harder than reacting to it, but it has an advantage. It lets a country shape the direction of change rather than chase it. Because the outcomes here are still projected rather than proven, this case is best read as an example of anticipatory policy design, the deliberate choice to build the framework while the technology is still emerging. Its real value to other regulators will become clear once the policy is implemented and its effects can be measured against what was intended. 
United Arab Emirates
National Policy to promote Smart Health Services and Artificial Intelligence in the Health Sector for the United Arab Emirates
Ministry of Health of the United Arab Emirates
Banks across Asia were eager to use generative AI, but no supervisory rules existed for it yet. Hong Kong's central bank set up a controlled space where banks could test real AI tools under direct supervision, with the compute power provided by a local innovation hub.The dilemmaBy 2024, banks in Hong Kong and across Asia were under pressure to start using generative AI. They wanted to test it for customer service, for spotting fraud, and for routine back-office work. The problem was that no one knew yet what the rules should look like. Generative AI behaves differently from earlier types of AI. It can produce confident answers that are completely wrong, it can be hard to explain after the fact, and the technology itself is changing every few months. The Hong Kong Monetary Authority had two choices. It could write rules now, before anyone really understood how banks were using the technology in practice, and risk locking in the wrong rules. Or it could let banks experiment first, and write the rules later based on what actually happened.The regulatory gapWhat was needed was a space where banks could test real generative AI tools on real banking data, under direct supervision, so the regulator could learn alongside them. Most banks did not have ready access to the kind of computing power needed to run generative AI experiments safely. So the space also had to come with the technical resources to make experimentation possible, not just permission to try.The approachIn August 2024, the Hong Kong Monetary Authority launched its Generative AI Sandbox. It worked with Cyberport, Hong Kong's main innovation hub, which provided the computing infrastructure for the participating banks. Licensed banks could test AI tools for risk management, fraud detection, and customer service inside the sandbox, with technical support from Cyberport and direct feedback from the Authority. In 2025, a second round of the sandbox added a new earlier stage, called the Collaboratory, where banks could work through what they wanted to test before formally entering the sandbox.Results achievedThe sandbox produced supervisory insights that the Hong Kong Monetary Authority has said will shape its future guidance for banks using generative AI. It also created a shared language between regulators and banks on practical questions such as how to test whether an AI model is performing as expected, how to handle the risk that an AI tool gives false but confident answers (sometimes called hallucination), and when a human should review the AI's output before action is taken.The Collaboratory addition in the second round reflected a clear lesson from the first. Many banks did not yet know how to describe what they wanted to test. They needed help framing the problem before they were ready to build a pilot. Adding an earlier stage gave them that space without forcing the regulator to design the experiment for them.Two limits are worth noting. The sandbox is explicitly experimental. Participation does not amount to regulatory approval of the AI tools being tested. And the formal supervisory guidance that the sandbox is meant to inform has not yet been published.The transferable lessonThe most useful design choice in this sandbox is the one other regulators are most likely to miss. Adding an earlier stage for problem definition turned out to matter as much as the sandbox itself. The first cohort showed that banks could not always describe clearly what they wanted to test, and that this was a problem the regulator could help solve without having to write the experiment for them. Other regulators setting up generative AI sandboxes should expect this challenge from the start, rather than waiting for participants to ask for help.
Hong Kong SAR, China
Hong Kong Monetary Authority's GenAI Sandbox: Letting Banks Experiment While the Rules Catch Up
Hong Kong Monetary Authority
For years, most crypto-assets fell outside the financial rules that govern banks and investments. The European Union's Markets in Crypto-Assets Regulation, which came fully into force across the EU in December 2024, was the first major attempt to bring crypto under one clear set of rules.The dilemmaBy the early 2020s, the European Union had a confusing situation on its hands. Some crypto-assets were covered by existing financial rules, but many were not, including most stablecoins and so-called utility tokens. Each EU country was taking its own approach. Crypto companies took advantage of this by basing themselves wherever the rules were loosest. Meanwhile, the collapse of major crypto ventures, including the Terra/Luna stablecoin and the FTX exchange, wiped out billions of dollars belonging to ordinary investors. The harm to consumers had become too large to ignore, and the EU's single market needed one set of rules rather than 27 different ones.The regulatory gapWhat the EU needed was a single set of rules that applied across all 27 member states, covering both the companies that issue crypto-assets and the companies that trade or hold them for customers. It also needed specific rules for stablecoins, which are crypto-assets designed to hold a steady value, usually by being backed by reserves. Stablecoins matter differently from speculative tokens, because if a widely used stablecoin fails, it can affect the broader financial system and even a country's control over its own currency.The approachThe Markets in Crypto-Assets Regulation, known as MiCA, was adopted by the EU in 2023 and came into force in stages through December 2024. It requires companies issuing crypto-assets to publish a detailed document, similar to a prospectus, explaining what they are selling. It requires companies that trade or hold crypto for customers to be formally authorised and supervised, much like other financial firms. And it sets strict rules for stablecoins, including requirements about the reserves backing them and how they are governed. The European Securities and Markets Authority and the European Banking Authority were given the job of writing the detailed technical standards that make the regulation work in practice. The reasoning was that one comprehensive set of rules, agreed in advance at EU level, would produce a more stable and trustworthy market than 27 different national approaches, even if it created some friction for innovation along the way.Results achievedMiCA's rules for stablecoins took effect in June 2024, and the rest of the regime followed in December 2024. Major crypto exchanges have responded in one of two ways. Some have secured authorisation in EU countries so they can keep operating. Others have restricted access for EU customers rather than comply. Stablecoins that do not meet the new rules have been removed from regulated trading platforms. The two EU regulators responsible continue to publish technical standards and guidance during a transition period.The trade-offs are visible. Some crypto activity has moved outside the EU, particularly companies that could not or would not meet the strict rules on stablecoin reserves and governance. EU regulators argue this is exactly what the rules are meant to do. The regime is designed to filter out activity that cannot meet the required standard, rather than to keep every business in the market.The transferable lessonA comprehensive set of rules agreed in advance works when the regulator accepts that some businesses will leave rather than comply, and when leaving the market is a real cost to those businesses. MiCA works partly because the EU market is so large that walking away from it is expensive. A crypto company can afford to ignore a small country's rules. It cannot easily afford to ignore 450 million consumers. Smaller countries trying to copy the MiCA model run into this problem. Their market is not big enough to make their rules stick the same way.
Europe
MiCA: The EU's First Complete Set of Rules for Crypto
European Securities and Markets Authority (ESMA)
Most governments looking at how to regulate AI assumed they would need to create a new regulator for it. The UK chose a different path. It asked its existing regulators, each covering a specific sector, to apply a shared set of AI principles within their own areas. Two years in, the verdict is still being written.The dilemmaBy 2023, governments around the world were trying to work out who should regulate AI. The most obvious answer was to set up a new authority dedicated to it, which is the path the European Union took. The UK government took a different view. AI was already being used across finance, health, employment, transport, and consumer markets, each of which had its own well-established regulator. Creating a new central AI authority would either duplicate the work those regulators were already doing, or weaken the expertise they had built up over decades.The regulatory gapWhat the UK government wanted was a shared set of principles that all existing regulators could apply to AI in their own areas. It also wanted shared tools, such as sandboxes for testing AI systems, monitoring arrangements, and frameworks for assuring AI safety, that any regulator could use without needing new legislation. The challenge was building this kind of cooperation across regulators that had never previously been asked to coordinate on a single technology.The approachIn March 2023, the UK government's Department for Science, Innovation and Technology, working with the Office for Artificial Intelligence, published the AI Regulation White Paper. It set out five principles to be applied by existing regulators: safety, transparency, fairness, accountability, and the right to contest a decision. The regulators expected to apply these principles include the Financial Conduct Authority, the Information Commissioner's Office, the Competition and Markets Authority, the Medicines and Healthcare products Regulatory Agency, and others. The framework also set up central government functions to monitor how AI was developing across the economy and to coordinate between regulators. The reasoning was that letting each regulator apply the principles within its own area, supported by central coordination, would be faster and more accurate than passing a single AI law that tried to cover everything at once.Results achievedThe White Paper drew 466 responses from industry, civil society, and academia, and the government published its formal response in February 2024. How regulators have responded has been uneven. Some, including the Financial Conduct Authority, the Information Commissioner's Office, and the Medicines and Healthcare products Regulatory Agency, have produced meaningful AI-specific tools and guidance. Others have been slower. The UK approach has also diverged from the European Union, which finalised the EU AI Act during the same period. The EU chose a more centralised path, with prescriptive rules and a single legal framework.Two limits are worth noting. Whether the UK model produces consistent outcomes across the economy depends on two things: the capacity of individual regulators to do this work alongside their existing duties, and the strength of central coordination between them. Both are under continuing pressure as budgets tighten and AI evolves. The framework is widely cited internationally as a possible alternative to the EU's approach, but it is too early to compare the results.The transferable lessonA decentralised, principles-based approach to regulating AI is often described as a lighter option than passing new legislation. It is not lighter. It is different, with its own costs. The savings on writing detailed legal rules are spent instead on the sustained work of getting many regulators to coordinate, and on managing the political fallout when two regulators reach different conclusions on the same issue. Other countries considering the UK model should plan for this coordination work from the start.
United Kingdom
The UK's AI White Paper: Letting Sector Regulators Lead on AI
Department for Science, Innovation and Technology of the United Kingdom
Some new technologies cannot legally launch in the UAE because no rules exist for them yet. The telecom regulator built a supervised space where companies can test them safely, and where the regulator learns what future rules should look like.The ChallengeNew and emerging technologies, things like Internet of Things devices, blockchain applications, and metaverse tools, were arriving faster than the rules governing them. In the UAE, some of these could not legally launch at all, because they did not fit the existing regulatory framework for information and communications technology. The Telecommunications and Digital Government Regulatory Authority, known as TDRA, faced the familiar regulator's choice: hold back useful innovation until rules could be written, or find a way to let companies test new technologies safely while the rules were still being worked out.The regulatory gapWhat was needed was a controlled space where companies could run live tests of new technologies under supervision, without first having to meet rules that did not yet exist. The regulator also needed a way to learn from those tests, so that future rules could be based on real evidence rather than guesswork.The approachIn 2023, TDRA launched its ICT Regulatory Sandbox. It is a formal, time-limited testing environment where companies can trial new technologies under the regulator's oversight. The framework is hybrid: TDRA sets clear eligibility criteria, operating requirements, and safeguards, but keeps detailed technical rules to a minimum so as not to stifle experimentation, focusing instead on outcomes like safety, interoperability, and responsible use of data. The sandbox covers areas such as the Internet of Things, cloud computing, digital twins, blockchain, and augmented and virtual reality, with the list updated as the market evolves. Participants move through a five-stage process: application and evaluation, onboarding, live testing under supervision, reporting, and an exit stage that ends in approval, extension, or termination. During testing, TDRA can grant temporary waivers from rules that would otherwise require prior licensing. These waivers expire at the end of the test unless the participant graduates to full approval.Results achievedAccording to TDRA, more than 20 innovative solutions have been tested across areas including AI, the Internet of Things, blockchain, and 5G since the sandbox launched. The regulator reports that the sandbox has shortened the time it takes for new digital services to reach the market by giving companies regulatory clarity early, has generated insights that help TDRA refine its rules for emerging technologies, and has strengthened collaboration between regulators, startups, and global technology firms.One limit is worth noting. The reported outcomes are mostly measures of activity, such as the number of solutions tested and improved investor confidence, rather than independently measured effects on consumers or markets. As with most sandboxes, the real test is whether the lessons learned actually translate into better rules over time.The transferable lessonA sandbox works best when it has a clear structure and a clear exit. TDRA's five-stage lifecycle, ending in a defined decision to approve, extend, or stop, gives companies a predictable path and gives the regulator a steady flow of evidence to improve its rules. The temporary waivers are the mechanism that makes genuine testing possible, by letting companies trial models that would otherwise be blocked, but only for the duration of the test.
United Arab Emirates
The UAE's ICT Sandbox: A Testing Ground for Technologies
Telecommunications and Digital Government Regulatory Authority (TDRA)
In most countries, instant payment systems are built and run by banks or private companies. Brazil's central bank built and ran its own. Within four years, more money moved through it than through credit and debit cards combined.The dilemmaBy the late 2010s, paying digitally in Brazil was expensive. Two card networks dominated the market and charged high fees for every transaction. Small shops often refused card payments because the fees ate into their margins, and millions of Brazilians without bank accounts could not pay digitally at all. The Banco Central do Brasil had two options. It could wait for the banks and card networks to build a cheaper system themselves, knowing they had little reason to do so because the existing system was profitable for them. Or it could build a new system itself, which had never been attempted at this scale by a central bank.The regulatory gapWhat Brazil needed was an instant payment system that worked across every bank, was free for ordinary people to use, and could not be controlled by any one company. The market was not going to produce that. The banks and card networks that ran the existing system had no reason to build a free alternative to a service that was making them money.The approachThe Banco Central do Brasil launched PIX in November 2020. Participation was mandatory for every licensed bank above a certain size. Transfers were free for individuals and for small merchants. The central bank wrote the technical standards, ran the central settlement system, and required banks to offer PIX inside their existing apps, alongside other payment options. The reasoning was that by building and running the basic system itself, the central bank could open up competition on the services built on top of it. Banks and fintechs could still compete on apps, features, and customer experience. They just could not compete on the underlying rails.Results achievedBy December 2024, more than 6 billion PIX transactions were taking place every month. On a single day in late December 2024, the system processed 252 million transactions, a record. By the end of 2024, the value of PIX transactions was around 80% higher than the combined total for credit and debit cards in Brazil. New features are being added: PIX Automático, which allows recurring payments, and Tap-to-Pay, both rolling out across 2025 and 2026.Two limits are worth noting. By building and running the system itself, the central bank has become a single point of failure for a very large share of Brazil's payments. When PIX goes down, the country notices. Competition concerns that used to focus on the card networks have shifted toward the central bank itself.The transferable lessonPublic infrastructure sometimes works better than private competition, but only when the regulator is willing to build it, run it, and take political responsibility when something goes wrong. PIX is a model that works when the central bank has the legal mandate, the technical capacity, and the appetite to be a long-term operator of national infrastructure. Other countries that want similar outcomes have to ask whether their central bank has all three. Where any one of them is missing, the PIX model is much harder to copy than the headline numbers suggest.
Brazil
Brazil's PIX: When the Central Bank Built the Payment System Itself
Central Bank of Brazil
No law, no mandate. New Zealand asked its agencies to sign a voluntary charter on how they use algorithms. Five years on, 29 have signed — and the question is whether voluntary commitments actually change practice.The dilemmaBy 2019, New Zealand's government was using algorithms across welfare, immigration and policing faster than its laws could keep up. Writing a new algorithm law risked freezing the technology. Doing nothing risked a different problem: algorithms making consequential decisions about citizens without the public being able to see how, or hold anyone accountable when things went wrong.The regulatory gapA way to make government use of algorithms transparent and accountable without writing new law. Existing legislation, including the Privacy Act and the Official Information Act, covered parts of this but left the questions citizens cared about unanswered: which decisions involve algorithms, who is responsible for them, and how can outcomes be challenged?The approachIn July 2020, Stats NZ launched the Algorithm Charter for Aotearoa through its Government Chief Data Steward. The Charter asks signatory agencies to commit to five things: transparency, partnership with Māori, data quality, peer review, and human oversight. The thinking was simple. A visible public commitment, backed by peer support and an independent review after one year, would shift agency behaviour faster than passing a law.Results achievedTwenty agencies signed at launch; by July 2023 there were 29 signatories, including Police and the Ministry of Business, Innovation and Employment (MBIE). The independent Year One Review by Taylor Fry (2021) found near-universal support among agencies and experts, with documented practice shifts toward greater transparency.The Charter has limits, its designers acknowledge. It is voluntary, public-sector only, and not centrally measured — there are no consolidated public metrics on algorithmic error rates, bias reduction or service outcomes. Stats NZ released an Algorithm Impact Assessment toolkit in December 2023 to give signatories more practical scaffolding.The transferable lessonVoluntary frameworks need three things to work. A credible agency to convene the participants. A community small enough that people actually know each other. And a built-in review point that creates accountability without formal enforcement. Without all three, voluntary frameworks tend to fall flat, which is why most attempts to copy this model elsewhere have not produced the same change in behaviour.
New Zealand
New Zealand's Algorithm Charter for Aotearoa: Governing AI Without Legislation
New Zealand Government
When COVID-19 hit, Indian doctors consulting patients by phone were operating in a legal grey zone. India's response, released in 25 days, turned an ambiguity into a national digital health regime.The dilemmaUntil March 2020, teleconsultation in India sat in a regulatory grey zone. Doctors who advised patients over the phone or via video could not be certain whether they were practising medicine within the law, and a 2018 Bombay High Court judgment had left the question of remote prescribing unsettled. As COVID-19 spread, the cost of that ambiguity became impossible to ignore: tens of millions of patients needed care, and clinicians needed cover to provide it remotely.The regulatory gapA clear legal basis for remote consultations, with enforceable rules on who could practise, how consent and prescriptions should be handled, and how patient data must be protected. Without them, scaling teleconsultation meant either widespread informal practice or no practice at all.The approachOn 25 March 2020, the Ministry of Health and Family Welfare — with the national policy think tank NITI Aayog and the Board of Governors of the Medical Council of India — issued the Telemedicine Practice Guidelines. The framework restricted teleconsultation to registered medical practitioners, set out tiered rules for what could be prescribed remotely, mandated identity verification and explicit patient consent, and was deliberately mode-agnostic: video, phone, text and asynchronous consultations were all permitted, with safeguards.Results achievedThe guidelines created the legal floor on which platforms such as Practo, Apollo 24/7 and Tata Health rapidly scaled. They were later integrated into the Ayushman Bharat Digital Mission, India's national digital health architecture, and updated in 2022 within the National Medical Commission framework.The guidelines are deliberately domestic and cross-border teleconsultations remain outside scope. There is also no built-in review cycle, so keeping the framework current will depend on the Commission revisiting it actively.The transferable lessonFast regulation can still be precise, as long as the regulator fixes the right things. India's guidelines fixed who is liable and what counts as consent, then let the technology adapt around those points. The framework has aged well because it regulated the doctor-patient relationship rather than specific platforms or tools.
India
India's Telemedicine Practice Guidelines: Legalizing Care at a Distance
Ministry of Health and Family Welfare of India
When a fintech wanted to test a new product in several countries at once, it had to deal with each country's regulator separately. In 2019, the UK's Financial Conduct Authority brought regulators together to make that easier. The network now has more than 70 members.The dilemmaBy 2018, regulatory sandboxes were everywhere. The UK had launched the first one in 2016, and dozens of countries had built their own versions. But each sandbox stopped at the national border. A fintech firm that wanted to test the same product in three countries had to apply to three regulators, meet three sets of conditions, and explain itself three times. There was no guarantee that any of those regulators would treat the firm the same way. Digital products move across borders easily. Regulatory cooperation does not. The gap between the two was growing.The regulatory gapWhat was needed was a way for regulators to work together on cross-border tests without giving up their own authority. Regulators needed somewhere to share what they were learning from their national sandboxes, agree on common questions worth testing across countries, and give firms a single pathway into multi-country pilots. It had to be voluntary, because formal agreements between financial regulators take years and often fall apart.The approachIn January 2019, the UK's Financial Conduct Authority launched the Global Financial Innovation Network, known as GFIN. The launch followed a public consultation in 2018 that drew around 50 responses from industry, civil society, and consumer groups. GFIN offered firms a three-step pathway. First, a firm entered its own national sandbox. Second, it joined a GFIN cross-border test group, where each participating regulator reviewed the firm under its own laws. Third, regulators shared what they learned after the test was over. The reasoning was that voluntary cooperation, structured around common questions, would deliver more than trying to harmonise rules across countries. Past attempts to harmonise financial regulation had repeatedly stalled.Results achievedGFIN has grown to more than 70 financial regulators and observer institutions across multiple regions. The network has run cross-border test groups in waves, each focused on a specific theme such as anti-money-laundering, sustainable finance, and cross-border payments. Over time, the network has become as much a place for regulators to learn from each other as a service for fintech firms.Two limits are worth noting. The cross-border tests have produced more learning for regulators than commercial growth for firms. A fintech that succeeds in a GFIN test still needs full national licences in every country where it wants to operate. GFIN reduces the friction of cross-border testing, but does not remove it.The transferable lessonInternational regulatory cooperation tends to fail when it tries to make countries agree on the same rules. It works better when it gets countries to ask the same questions. GFIN does not produce a single rulebook for all its members. It produces a shared way of testing and a shared habit of comparing notes afterwards. That is what makes the cooperation useful even when each country's laws remain different.
United Kingdom
The Global Financial Innovation Network: Helping Fintechs Test Products in More Than One Country
Financial Conduct Authority
Until 2019, treating a patient remotely was simply not allowed in the UAE. A new federal regulation changed that, setting out clear rules for virtual consultations, digital prescriptions, and remote monitoring, just before the pandemic made them essential.The challengeBefore 2019, UAE law did not permit doctors to treat patients remotely. A patient had to see their doctor in person. As telecommunications and digital tools made remote care possible, this left a gap. There was no legal basis for a doctor to consult, diagnose, or prescribe at a distance, and no rules to govern how it should be done safely. The Ministry of Health and Prevention needed to enable remote care without weakening the protections patients expect from in-person treatment: safety, confidentiality, clear accountability, and quality.The regulatory gapWhat was needed was a clear legal framework that allowed remote health services while setting out who could provide them, how patient data would be protected, and who would be responsible if something went wrong. Without that, remote care would either continue to be prohibited, or happen informally with no safeguards at all.The approachThe UAE built the framework on top of an existing law, the Federal Decree-Law No. 4 of 2016 on Medical Liability. In July 2019, Cabinet Resolution No. 40 of 2019 set out the executive regulations for that law, and an annex to the resolution dealt specifically with remote health services. This annex lifted the previous prohibition and set the terms for telehealth: remote consultations, remote diagnosis, digital prescriptions, and remote monitoring all became permitted, subject to professional, technical, and operational requirements. The rules apply to all providers of remote medical services in the country, public and private. The approach is a hybrid: it sets detailed, mandatory requirements for telehealth practice while leaving room to add supplementary guidance, such as rules for AI-based triage or home monitoring devices, as the technology develops.Results achievedThe 2016 law and the 2019 regulation together created the UAE's first unified legal framework for telemedicine. The timing proved fortunate. When the COVID-19 pandemic arrived, the legal basis for remote care was already in place, which allowed patients to keep receiving consultations, follow-up, and treatment through lockdowns. This was especially valuable for vulnerable groups and people with chronic conditions, reducing unnecessary hospital visits and the risk of infection.One lasting effect has been in mental health. After remote consultations proved their value during the pandemic, the UAE made tele-mental-health a formal part of its national mental health service, now regularly monitored for usage. Offering psychological support remotely has also helped reduce the stigma some people feel about seeking help, since care can be sought more privately, which encourages earlier treatment.The framework now also supports the UAE's wider work on AI in healthcare, serving as a foundation for the national smart health policy being developed and for the ongoing review of health legislation to enable AI and digital health tools.The transferable lessonThe most useful thing a regulator can do for a new technology is sometimes to settle its legal status before a crisis forces the question. The UAE happened to put its telehealth framework in place months before the pandemic, but the deeper lesson holds regardless of timing: building remote care on top of an existing medical liability law, rather than writing an entirely new regime, let the country move quickly while keeping the accountability and safety rules that already governed in-person care.
United Arab Emirates
The UAE's Telehealth Law: Lifting a Ban and Building Rules for Remote Care
Ministry of Health of the United Arab Emirates
India built a single payment system that any bank or licensed app can use. A non-profit owned by the banks runs it. The central bank regulates it. Ten years on, it processes more than 100 billion transactions a year, and other countries are starting to use it.The dilemmaIn 2015, India had a strange combination of conditions. Hundreds of millions of people had bank accounts, but very few were paying digitally. The few who did had to use closed apps that only worked within one bank or one wallet. A customer with an HDFC Bank account could not easily send money to someone with a State Bank of India account through their phone. The Reserve Bank of India and the Ministry of Finance wanted to fix this without taking control of payments themselves, and without letting one private company become the dominant platform.The regulatory gapWhat India needed was a single payment standard with three features. It had to be open, so any bank or app could connect to it. It had to be cheap, so small shops and ordinary people could afford to use it. And it had to be supervised, so the central bank could oversee how money moved through it. No private company was going to build all three on its own. The card networks that already existed had no reason to be open. They made money from being closed.The approachIn 2016, the National Payments Corporation of India, known as NPCI, launched the Unified Payments Interface, or UPI. NPCI is a non-profit jointly owned by India's banks and regulated by the Reserve Bank of India. UPI is built around a single technical standard. Any bank or licensed payment app can connect to it. Users do not send money to account numbers. They send it to a virtual address, like an email handle, which links to whichever bank account the user chooses. Most transactions are free for both the customer and the merchant. The reasoning was that an open standard, with every bank required to participate, would create more competition than any single private platform ever could.Results achievedUPI processed more than 100 billion transactions in 2023, with strong growth continuing since. The system has been connected internationally, with payment links to Singapore, the UAE, and several other countries. It now supports more than just person-to-person transfers. Customers can also access credit products through UPI. Apps like PhonePe, Google Pay, and Paytm compete fiercely on user experience, while all using the same underlying system.Two limits are worth noting. UPI is structurally hard to make money from. The free-transaction policy that drove its rapid growth means there is little revenue to cover the costs of running and improving the system. That makes the apps and services built on UPI dependent on either advertising, cross-selling other products, or continued government support for the underlying system. The long-term sustainability of UPI depends on the Indian government continuing to invest in the basic infrastructure.The transferable lessonA public payment system that is open and supervised can produce more competition than either a state-run system or a fully private one. But the design choices matter. UPI works because it separated identity from account number. A user's virtual address is theirs, not their bank's, which means they can switch banks or apps without losing their payment identity. That is what makes the system genuinely open rather than open only on paper. Other countries copying the headline of "open payment standards" without that design choice tend to end up with systems that are technically interoperable but practically closed.
India
India's UPI: A National Payment System Open to Any App That Wants to Build on It
National Payments Corporation of India (NPCI)
Getting a new medicine approved across Africa used to mean going through 54 separate national approval processes, one country at a time. The African Medicines Regulatory Harmonization Initiative changed that by getting regulators to review medicines together, and laid the groundwork for a continental medicines agency.The dilemmaFor most of the period after independence, a pharmaceutical company that wanted to sell a new medicine across Africa had to apply for approval in each country separately. That meant 54 different applications, 54 different reviews, and 54 different timelines. Some countries had well-staffed medicines regulators with the scientific capacity to assess complex applications. Others had only a handful of staff and could not keep up. The result was that companies spent years filing the same paperwork in country after country. Patients waited longer than they should have for medicines that had already been approved elsewhere on the continent. And smaller regulators were overwhelmed by workloads they could not handle. The continent was effectively paying twice, once in time and once in scarce expert capacity, for the same scientific assessment.The regulatory gapWhat Africa needed was a way for its medicines regulators to share the work. That meant joint reviews of new medicine applications, agreements to recognise each other's approvals, and a continental body that could coordinate across countries without overriding national governments. No single country had the authority to set this up. It had to be built across the continent.The approachIn 2012, the African Union Development Agency, known as AUDA-NEPAD, launched the African Medicines Regulatory Harmonization Initiative, or AMRH. It worked in partnership with the World Health Organization and the African Union's Regional Economic Communities. The initiative set up Regional Centres of Regulatory Excellence, where regulators from neighbouring countries could review new medicines together. It also worked toward a continental institution, the African Medicines Agency, whose founding treaty came into force in 2019. The reasoning was that voluntary cooperation on shared scientific work could build the trust regulators needed before they would formally recognise each other's decisions.Results achievedAMRH made regional approvals faster, particularly for priority medicines and during the COVID-19 pandemic, when joint reviews helped speed up access to vaccines and treatments. It is widely credited with creating the foundation for the African Medicines Agency, which is now being set up with Rwanda as its host country and progress on staffing and governance underway.Two limits are worth noting. Building continental regulatory institutions takes time. The African Medicines Agency is still being made fully operational more than a decade after AMRH was launched. Not every African Union member state has ratified the treaty, which limits how widely the agency's decisions will be recognised. AMRH shows that regulatory harmonisation across many countries is possible. It does not show that it is quick.The transferable lessonRegulatory harmonisation across many countries is often described as a legal problem. In practice, it is a capacity-building problem. AMRH worked because it started with shared scientific work that was immediately useful to the regulators taking part. Regulators in smaller countries gained access to the expertise of larger ones. Regulators in larger countries gained a network they could rely on. The institutional structure of a continental agency came after that trust had been built. Initiatives elsewhere that try to start with a formal institution, hoping that trust will follow, tend to stall.
Africa
African Medicines Regulatory Harmonization: Working Together to Approve Medicines Faster
African Union Development Agency-NEPAD, World Health Organization (WHO)
In 2008, most Pakistanis had no bank account but did have a mobile phone. The State Bank's bank-led model used that asymmetry to build one of the world's largest branchless banking ecosystems.The dilemmaIn the mid-2000s, Pakistan had millions of mobile phone users and very few bank account holders. Bank branches were never going to close that gap. The question for the State Bank of Pakistan was who should lead the move to mobile money. Telecom operators could move quickly, as Kenya had shown with M-Pesa, but allowing them to lead would put mobile money outside banking supervision. Keeping licensed banks as the regulated party would protect supervision but risk slower reach.The regulatory gapPakistan needed a middle path. Standard banking rules were too restrictive: they assumed customers walked into a branch with passports and proof of address, which most rural Pakistanis could not produce. But letting telecom companies run mobile money without any rules would mean no protection against money laundering, fraud, or sudden collapse. The country needed a framework that could scale at the speed of telecom networks while keeping the safeguards that come with banking supervision.The approachIn 2008, the State Bank of Pakistan issued the Branchless Banking Regulations, later revised in 2011, 2016 and 2019. The model was deliberately bank-led. Licensed commercial, Islamic and microfinance banks remained the legally responsible parties, but were allowed to deliver mobile money through agent networks and partnerships with telecom operators. The reasoning was that pairing banking accountability with telecom reach would deliver both financial inclusion and stability.Results achievedThe framework underpinned services like Easypaisa and JazzCash, which became Pakistan's largest digital payment providers. State Bank data show more than 50 million branchless banking accounts and billions of transactions a year by 2023. The share of adults with any bank account rose from 13% in 2011 to 21% in 2017, driven largely by mobile channels.In 2021, the State Bank and the Pakistan Telecommunication Authority launched a second-stage innovation: the Asaan Mobile Account. This created a single onboarding platform that worked across all mobile networks, so customers could open an account regardless of which operator they used. The aim was to stop early winners from locking newer entrants out of the market.Two limits are worth noting. Account ownership has not automatically translated into active use of those accounts. And a gender gap in who uses digital financial services remains a known challenge the framework is still working through.The transferable lessonMobile money was going to happen in Pakistan one way or another. The real question was who should be legally accountable for it. By placing that responsibility with banks and giving telecom operators the role of reaching customers, Pakistan built a market that scaled quickly without weakening supervision. The model is most useful for countries with mature banking regulators and strong telecom networks, which describes much of the global South.
Pakistan
Pakistan's Branchless Banking Regulations: Building a Mobile-Money Market by Design
State Bank of Pakistan
In 2004, Denmark required every family doctor to use electronic patient records. Twenty years later, the country has one of the world's most connected health systems, and the most useful lesson is how long it took.The dilemmaBy the early 2000s, Denmark had digital health records in most parts of its system, but each part kept its own. Hospitals, family doctors, pharmacies and labs all ran separate databases, in separate formats, that could not exchange information. A patient who saw their GP in the morning and went to hospital in the afternoon often had to repeat their medical history twice, and crucial information was lost in the gaps. Denmark had to choose between making each system better on its own, or investing in the connections between themThe regulatory gapWhat was needed was a national system that could set common standards, keep them updated over decades, and require every provider to use them. Without an authority to enforce common standards, hospitals and clinics would keep building separately. Without a requirement to participate, even good standards would be ignored.The approachDenmark put three things in place. The first was a 2004 rule that every general practitioner must use electronic patient records. The second was MedCom, a national network that connects hospitals, pharmacies and labs and lets them exchange information using common formats. The third was Sundhed.dk, a public website where citizens and clinicians can both see the same patient records. The Danish Health Data Authority sets the technical standards for the whole system, including the international HL7 FHIR standard for sharing health data. A national Shared Medication Record means a prescription written in one setting is visible across all the others.Results achievedDenmark now has near-universal use of electronic patient records and is regularly cited as a global reference for how to govern digital health. Successive national strategies, including the 2018 to 2022 strategy and its successors, have updated the technology and policies in steps, without breaking what already works. The system has made telemedicine, home-based care, and joined-up primary and hospital care possible at a scale few other countries match.Two limits are worth noting. Danish officials themselves point to regional differences in how the system is implemented, and to gaps in access for older patients and those less comfortable with digital services. Mature is not the same as finished.The transferable lessonDenmark is often used as proof that integrated digital health is possible. The more useful lesson is about time. The system that looks impressive today is the result of decisions made twenty years ago and sustained through every change of government since. Other countries have tried to copy parts of the Danish system, often building similar portals and adopting similar standards. But without a long-term legal requirement to use them, and without political commitment that survives changes of government, those tools tend to sit unused. 
Denmark
Denmark's Digital Health System: What Twenty Years of Patient Investment Looks Like
Danish Health Data Authority, Medcom
Most countries publish digital transformation strategies. Very few publish a running assessment of the digital-reform potential in the legislation they pass each quarter. Ukraine's GovTech Reform Index — a joint project of VoxUkraine and GGTC Kyiv, launched in 2025 — is closing that gap.The dilemmaGovernments around the world publish digital transformation strategies, national AI roadmaps, and cybersecurity plans. What is much harder to find is a running sense of the substance behind the legislation meant to support them: is each newly adopted act a meaningful step for the country's digital ecosystem, or a marginal, procedural change? Legislation is typically reported one act at a time, in the language of what it changes, rather than measured against whether the country as a whole is becoming more digital. Without a way to track this systematically and consistently, it is hard to see whether the quality and digital-reform potential of legislation are improving over time, or standing still.The regulatory gapWhat was needed was a quantitative measure that could be applied consistently to the acts a parliament and government produce, quarter after quarter, to assess how much they are advancing digital transformation. That meant three things. First, the defined set of policy areas broad enough to cover the regulatory landscape. Second, the method for scoring individual acts against agreed criteria such as innovativeness, feasibility, and duration of impact. Third, the Expert Council that applies the method impartially. No such benchmark existed in Ukraine, and few comparable ones are present globally.The approachIn 2025, Vox Ukraine, a Ukrainian analytical platform with more than a decade of experience in measuring reform, launched the GovTech Reform Index in partnership with GGTC Kyiv, the second GovTech Centre in the World Economic Forum’s 4IR (Fourth Industrial Revolution) Network, initiated by Ukraine's Ministry of Digital Transformation, implemented by East Europe Foundation (EEF) with the support of the Swiss-Ukrainian EGAP Program.The Index applies a defined formula to regulatory acts signed by the Verkhovna Rada (Ukraine’s Parliament), the Cabinet of Ministers, the Ministry of Digital Transformation, and other governmental institutions, drawing on publicly available legislative sources. Acts are selected by the joint analytical team of VoxUkraine and GGTC Kyiv and classified into one of 22 policy areas, from e-government and cybersecurity to healthcare, defence, and social protection. An independent Expert Council comprising more than 20 representatives from civil society, business, international institutions, and academia then scores each act on a scale of 0 to 3 against three criteria: its innovativeness, the implementation feasibility, and its likely long-term impact. The final score for each act is the median of all experts’ scores. Each policy area's score is the arithmetic mean of the acts within it. The overall Index is a weighted average of the policy-area scores, with weights based on the number of acts in each area. The methodology is published in full, and results are released per quarter.Results achieved so farWithin Volume 1 (Q1–Q2 2025) we assessed 109 acts: 65 in Q1 and 44 in Q2. The Index scored 1.98 in both quarters. eGovernment was the most active policy area, with 24 acts assessed, followed by cybersecurity (12) and telecommunications, business environment, and social protection (9 each). The highest-scoring areas were ecology and environment protection (2.17), telecommunications (2.13), and education and science (2.10); the lowest were construction and customs and border control (both 1.75) and social protection (1.80).Volume 2 (Q3–Q4 2025) covered a much larger caseload: 101 acts in Q3 and 145 in Q4, more than double the first half of the year — and the Index eased to 1.84 in both quarters. According to the expert scores, acts adopted in this period were, on average, more feasible to implement under current conditions but less digitally innovative than those in the first half. E-government again led by volume (22 acts in Q3, 29 in Q4); the highest-scoring areas in Q3 were transport, mobility and logistics (2.42), customs and border control (2.17), and economy and finance (2.17). Cybersecurity activity rose sharply in Q4, from 2 acts in Q3 to 12, averaging 1.94, reflecting new rules aligning Ukraine with the EU’s NIS2 cyber-incident-response requirements.Volume 3 (Q1 2026) covered 59 acts — fewer than the previous two quarters — but the Index rose to 2.01, the highest score recorded since monitoring began, and the first quarter in which no assessed act scored 1.0 or below. The Cabinet of Ministers issued 61% of the acts assessed. The top-scoring policy areas were defence and ecology and environmental protection (both 2.33), followed by education and science and healthcare (2.17 each).One limit is worth noting. The Index has now been running for five quarters, providing just over a year of data. Its longer-term influence on how legislation is drafted or how the government prioritises reform will become clearer after several years of data collection. As with most measurement tools, its value depends less on the score in any single quarter than on the trend it makes visible over time.Intended outcomesBecause the Index is early in its life, the outcomes below are what its authors expect it to deliver as more data accumulates, rather than results already observed.The authors intend the Index to give Ukrainian policymakers a clearer, more systematic view of the digital-reform potential embedded in the legislation they pass. They expect it to make it easier for civil society and international partners to identify where legislative progress is strong and where it is falling behind. They also see it as a reference for other countries considering similar tools, so that measurement of GovTech reform can become a comparable practice across jurisdictions rather than a purely national exercise.The transferable lessonThe most compelling aspect about this case for other jurisdictions is the discipline of measurement itself. Digital transformation strategies are common. Public, regularly updated, methodologically transparent tools for tracking whether legislation is actually delivering them are rare. The GovTech Reform Index shows that two NGOs — VoxUkraine, an analytical organisation, and GGTC Kyiv, a Centre focused on GovTech innovations — can jointly build and sustain such a tool. Two design choices are broadly applicable. Separating the measurement from the government being measured is one: representatives of state authorities are excluded from the Expert Council that scores each act, thereby protecting the Index's independence and credibility. In addition, publishing the underlying data instead of limiting the release to the headline score alone allows external analysts to scrutinise the assessments and creates an incentive for the Index to remain grounded in the evidence.
Ukraine
Ukraine's GovTech Reform Index: Measuring How the Rule of Law Is Keeping Up
GGTC Kyiv
The case studies featured on this Knowledge Hub are compiled from publicly available information and contributions from the GRIP community for informational purposes only. Their inclusion does not constitute an endorsement, and the views expressed therein do not necessarily reflect the position of the World Economic Forum.

Global Regulatory Innovation Platform

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service