On June 10, 2026, Egypt's Acting Minister of Communications and IT, Raafat Hindi, told the Senate's Defense and National Security Committee that artificial intelligence "has evolved beyond a technological innovation into a strategic enabler." He anchored the testimony in the updated 2025 National AI Strategy's six pillars, the sovereign Arabic-language model Karnak, the new Egyptian Center for Responsible AI, and AI-augmented threat detection at EG-CERT — and pointed to Egypt's climb to 1st in Africa and 51st globally on the Government AI Readiness Index (Middle East Observer).
Much of this deserves genuine credit. But the same "digital sovereignty" frame that earns Egypt international plaudits is now being used to justify a fast-expanding, centralized biometric identity stack — and the testimony said far more about capability than about limits.
The readiness story is real
Egypt's progress is not a slogan. Its second National AI Strategy (2025–2030), logged in the OECD's policy database, is a credible document: six pillars spanning governance, technology, data, infrastructure, ecosystem, and talent; a National Council for Artificial Intelligence to steer it; and explicit alignment with all ten OECD AI Principles, including human rights, transparency, and accountability (OECD.AI). It sets measurable targets — 30,000 trained specialists and a 7.7% ICT contribution to GDP by 2030 — and tracks 89 indicators annually.
The external scorecard backs the ambition. In Oxford Insights' Government AI Readiness Index 2025, Egypt ranked 51st of 195 countries and first in Africa, and tied for a perfect 100 on the Policy Capacity pillar (Oxford Insights). A sovereign Arabic LLM built on local datasets, and a standing body to write responsible-AI governance, are exactly the kind of investments a pro-innovation publication should welcome. State capacity to govern AI is a public good, not a threat.
Where the framing turns
The steelman for Cairo's security framing is straightforward. AI raises real national-security stakes — model supply chains, data localization, and cyber resilience are legitimate state concerns, and EG-CERT hardening its detection is sensible defensive work. No serious observer wants Egypt dependent on foreign black-box infrastructure for critical services.
The problem is what "digital sovereignty" is quietly doing elsewhere in the same period. Egypt has been assembling a comprehensive biometric identity layer. The Central Bank's Haweya platform, launched in October 2025, ties face and fingerprint biometrics to a single digital identity that already enables remote account opening across 37 banks, SIM-card purchases, and document verification (Biometric Update). In a 2026 pilot, the Interior and Communications ministries rolled out MOIEG-PASS, described as the country's first unified biometric authentication platform, which requires users to scan their national ID and face to reach government services (Biometric Update).
These systems are individually defensible — financial inclusion reached roughly 76% by mid-2025, and remote onboarding genuinely lowers barriers. But they are being fused. Egypt's Financial Regulatory Authority, under Decree No. 140 enforcing Fintech Law No. 5 of 2022, already mandates biometric digital-ID verification — facial recognition and fingerprint — for non-banking fintech transactions (Digital Watch). Banking, telecoms, government portals, and fintech are converging on one face-linked identifier.
The missing half of the testimony
When identity, finance, and communications all resolve to a single biometric key, the central question is not capability but constraint: who can query the graph, under what legal authority, with what independent check. On that, the Senate testimony was silent.
That silence matters more in Egypt than in most jurisdictions. The country's Personal Data Protection Law No. 151 of 2020 was passed years ago, yet its implementing executive regulations and the independent Data Protection Center they would create have not been operationalized — meaning the legal backstop for a system this comprehensive remains largely on paper. "AI security" and "sovereignty" are doing rhetorical work that data-protection enforcement has not yet caught up to.
None of this argues against Egypt's AI build-out. It argues for sequencing. The proportionate path is to keep identity-for-services and security-surveillance functionally and legally separate; to issue and enforce the Law 151 executive regulations before, not after, the biometric stack becomes load-bearing; to put EG-CERT's AI-driven monitoring under published rules and independent review; and to let the Egyptian Center for Responsible AI's mandate cover the government's own identity systems, not just private deployers.
The bottom line
Egypt is doing the readiness work well, and that is worth saying plainly. But a country can top its region on policy-capacity scores while leaving the rights-side architecture — enforceable data protection, query auditing, independent oversight — conspicuously underbuilt. The June 10 testimony showcased the capability half of the ledger. The legitimacy half is what will determine whether "digital sovereignty" means a resilient national tech base or simply a more efficient way to watch citizens. Cairo has earned the first reading. It has not yet built the guardrails that would foreclose the second.