Sub-Saharan Africa - AI Regulation Overview

Overview

As of September 2026, Sub-Saharan Africa is undergoing a rapid transition in artificial intelligence governance. Moving beyond early-stage digital transformation blueprints, major economies across East, West, and Southern Africa are shifting from voluntary policy frameworks toward structured risk-based guidance, technical standardisation, and legislative mandates. While standalone horizontal AI statutes are not yet fully enacted across the region, national governments are establishing dedicated administrative bodies, releasing national strategies, and leveraging foundational legislation in cybersecurity, electronic communications, and data protection to govern algorithmic systems.

The regional regulatory architecture is defined by a hybrid, soft-law-first approach that prioritizes technological innovation, public sector modernization, and digital sovereignty while gradually introducing hard-law safeguards. Countries like Ethiopia have pioneered statutory institutional structures through federal regulations, whereas others like Nigeria and Kenya are pursuing comprehensive legislative bills alongside voluntary technical standards. Continental coordination has also accelerated, anchored by regional declarations that emphasize African data sovereignty, ethical AI deployment, and shared computing infrastructure.

In the absence of dedicated standalone AI laws in most jurisdictions, binding regulatory compliance remains heavily grounded in general privacy, cybercrime, and communications statutes. Regulators across the continent actively apply existing frameworks—such as comprehensive data protection acts and critical infrastructure laws—to mandate privacy impact assessments, automated processing controls, and security standards for AI deployments in both public and private sectors.

Key Trends and Focus Areas

Several dominant regulatory themes define the AI policy landscape across Sub-Saharan Africa:

• Establishment of Specialized AI Institutions and Regulatory Authorities: Governments are moving to centralize AI oversight within dedicated state entities. Ethiopia established executive governance through the Artificial Intelligence Institute Establishment Council of Ministers Regulation No. 510/2022, granting federal powers to license developers and certify AI products. Similarly, Nigeria is evaluating consolidated primary legislation through the Bill on Establishment of the National Institute for Artificial Intelligence and Robotic Studies Regulation Commission, which would create a statutory commission with standard-setting, licensing, and surveillance powers.
• National AI Strategies and Ethical Readiness Frameworks: Executive policy roadmaps serve as the primary instruments guiding regional adoption. High-level planning is articulated through instruments such as Nigeria's National Artificial Intelligence Strategy (NAIS), Ethiopia's National Artificial Intelligence Policy (effective June 27, 2024), the Kenya National Artificial Intelligence Strategy 2025–2030 (effective March 27, 2025), and Ghana's Digital Economy Policy and Strategy 2024 (effective May 14, 2024). To operationalize ethical principles, Ghana launched the Readiness Assessment Measurement (RAM) for Ethical Use of Artificial Intelligence on September 30, 2024, to evaluate data protection maturity, algorithmic fairness, and institutional capacity.
• Risk-Based Frameworks and Voluntary Technical Standards: Standards institutes and regulatory bodies are introducing risk-tiered classification systems and lifecycle guidelines. The Kenya Bureau of Standards published DKS 3007:2024 Information technology — Artificial Intelligence — Code of Practice for AI Applications to guide deployers through risk management, system trustworthiness, and continuous verification. In Nigeria, the National Information Technology Development Agency (NITDA) introduced the Draft Code of Practice for Artificial Intelligence (2025 draft) to establish risk management, pre-deployment testing, and mandatory disclosures for high-risk applications.
• Sectoral Rules and Professional Guidance: Recognizing the immediate impact of automated tools in specific domains, professional associations and sectoral regulators have issued targeted operational rules. The Nigerian Bar Association adopted the Nigerian Bar Association Guidelines for the Use of Artificial Intelligence in the Legal Profession (effective August 28, 2024) to enforce confidentiality and impact assessments. In Kenya, specialized guidance includes the Media Handbook for Reporting on Artificial Intelligence in Kenya (Media Council of Kenya draft). Regionally, local authorities are also active, as seen in the Lagos State AI Guidelines adopted in 2025.
• Binding Data Protection and Digital Infrastructure Backbones: Where specific AI legislation is pending, data privacy and cybercrime statutes provide enforceable compliance obligations. In South Africa, AI data processing must adhere to the Protection of Personal Information Act (POPIA), No. 4 of 2013, supported by procedural frameworks under the Regulations relating to the Protection of Personal Information, 2018 (Government Notice R1383 of 2018) and the Amendment to the Regulations relating to the Protection of Personal Information (POPIA Amendment Regulations) (Government Notice GN 6126 of 2025), which took effect on April 17, 2025. Digital infrastructure, cybersecurity, and electronic operations across the region are regulated by statutory frameworks such as Ghana's Cybersecurity Act, 2020 (Act 1038) (effective December 29, 2020), Ethiopia's Computer Crime Proclamation No. 958/2016, Rwanda's Law N°24/2016 of 18/06/2016 Governing Information and Communication Technologies, Senegal's Loi n° 2018-28 portant Code des Communications Électroniques, and Senegal's digital evidence rules under Loi n° 2016-30 du 08 novembre 2016 modifiant la loi n° 65-61 du 21 juillet 1965 portant Code de procédure pénale.

Regulatory Status

The regulatory status of AI across Sub-Saharan Africa is characterized by three distinct tiers of legal maturity:

1. Enacted Specialized Regulations and Institutional Statutes: Ethiopia leads in binding institutional rulemaking through Artificial Intelligence Institute Establishment Council of Ministers Regulation No. 510/2022, which created an autonomous federal agency directly accountable to the Prime Minister with explicit powers to regulate, grant developer licenses, and evaluate domestic and imported AI systems. In online intermediary oversight, Nigeria's Draft Code of Practice for Interactive Computer Service Platforms / Internet Intermediaries (NITDA) (effective September 26, 2022) sets binding operational rules for automated content moderation and platform responsibility.

2. Formal Parliamentary Initiatives and Draft Legislation: Multiple jurisdictions are actively drafting primary statutory AI acts. In Nigeria, the National Assembly is considering consolidated legislative proposals under the Bill on Establishment of the National Institute for Artificial Intelligence and Robotic Studies Regulation Commission (under review in 2024), which merges earlier proposals including the Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942) and the National Artificial Intelligence and Robotic Sciences (Establishment) Bill (HB 601). In Kenya, parliamentary momentum was formalized through the Motion on the Formulation of a Regulatory Framework on Artificial Intelligence (National Assembly Motion) adopted in June 2025, while private member proposals such as the Kenya Robotics and Artificial Intelligence Society Bill 2023 remain under review following public consultations.

3. Soft Law, National Strategies, and Strategic Support: Soft law remains the most prevalent mechanism for AI governance across the region. Countries utilize executive roadmaps and technical benchmarks to direct public sector adoption and encourage private innovation. Ghana enforces its digital direction via the Digital Economy Policy and Strategy 2024 and the Readiness Assessment Measurement (RAM) for Ethical Use of Artificial Intelligence. Senegal drives technological adoption and startup scaling through economic instruments like the Loi n° 2020-01 du 6 janvier 2020 relative à la création et à la promotion de la startup au Sénégal alongside its broader digital policy initiatives.

Notable Differences

While countries across Sub-Saharan Africa share common goals regarding economic growth and ethical technology adoption, significant structural differences exist across jurisdictions:

Centralized Institutional Models vs. Sectoral Coordination: Ethiopia has centralized AI administration within a dedicated federal body (the Ethiopian Artificial Intelligence Institute) empowered by Artificial Intelligence Institute Establishment Council of Ministers Regulation No. 510/2022. In contrast, South Africa relies on a distributed governance model where data-driven AI deployment is supervised by the Information Regulator under the Protection of Personal Information Act (POPIA), No. 4 of 2013, without a centralized statutory AI agency.

Legislative Strategy and Approach: Nigeria has pursued a highly active legislative path in Parliament, evaluating multiple legislative bills including the Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942), the National Artificial Intelligence and Robotic Sciences (Establishment) Bill (HB 601), and the consolidated Bill on Establishment of the National Institute for Artificial Intelligence and Robotic Studies Regulation Commission. Conversely, Kenya has combined technical standardization—such as DKS 3007:2024 Information technology — Artificial Intelligence — Code of Practice for AI Applications—with parliamentary directives under the Motion on the Formulation of a Regulatory Framework on Artificial Intelligence (National Assembly Motion) to instruct executive drafting rather than advancing rigid society-based licensing models.

Targeted Sectoral Oversight vs. Broad Horizontal Principles: Jurisdictions vary in their reliance on domain-specific rules versus broad horizontal guidelines. Nigeria and Kenya have developed specialized instruments for professional legal practice and newsroom workflows, as seen in the Nigerian Bar Association Guidelines for the Use of Artificial Intelligence in the Legal Profession and the Media Handbook for Reporting on Artificial Intelligence in Kenya (Media Council of Kenya draft). Other nations, such as Ghana, focus primarily on broad national frameworks like the Readiness Assessment Measurement (RAM) for Ethical Use of Artificial Intelligence to evaluate systemic governance maturity across all public and private sector deployments.

Regional Outlook

The trajectory of AI regulation in Sub-Saharan Africa points toward increased formalization, harmonized ethical standards, and greater alignment with continental policy initiatives. The adoption of the landmark Kigali Global AI Summit Outcomes (Africa Declaration on Artificial Intelligence) in April 2025 marked a significant turning point, committing participating nations to unified principles around African data sovereignty, local language model development, cross-border research funding, and interoperable governance frameworks.

Over the next twelve to twenty-four months, legislative transitions are expected to accelerate. Key focus areas will include:

• Enactment of Consolidated Statutory Frameworks: Legislative bodies in Nigeria and Kenya are expected to finalize pending statutory proposals, replacing voluntary guidance with enforceable risk classification, pre-deployment testing regimes, and statutory licensing bodies.
• Strengthening Mandatory Compliance via Existing Statutes: Regulatory authorities will continue to use general privacy and cybersecurity statutes—such as South Africa's Protection of Personal Information Act (POPIA), No. 4 of 2013 and Ghana's Cybersecurity Act, 2020 (Act 1038)—to enforce audit obligations, data minimisation, and impact assessments on automated systems.
• Balancing Innovation Incentives with Regulatory Oversight: Frameworks modeled after startup promotion statutes, such as Senegal's Loi n° 2020-01 du 6 janvier 2020 relative à la création et à la promotion de la startup au Sénégal, will increasingly incorporate regulatory sandboxes and testing environments to ensure that rising compliance demands do not stifle local entrepreneurship.