CLA News / Homegrown Application Of Artificial Intelligence Governance And The Emerging Gaps In Africa: Why Coordination, Enforcement And Institutional Capacity Matter Before New Artificial Intelligence Legislation By Chrispin Bosire
Introduction
The idea that Artificial Intelligence (AI), its use and regulation all require transplanting laws from other jurisdictions which are considered as “leaders in AI revolution,” needs to be balanced against the risk that these already existing AI laws may end up as rigid and not situation-aware, such as the European Union’s AI Act. This article advances the central theme that AI governance in Africa presents opportunities for the development of a legal regime which appreciates the realities of Africa, and that the existing gaps can be addressed without necessarily over-borrowing experiences from other jurisdictions.
Recently, I attended the 4th Annual Mediation Summit 2026,[1] where it was evident that the Summit sought to explore the place of AI in judicial governance and dispute resolution. Among the recommendations, was the need for strengthening institutional capacity, in line with local contexts of each region in Kenya.[2]
Regionally therefore, it is probable that in mainstream governance, laws sensitive to Africa, developed by experts in Africa, to apply to Africa’s AI in governance, encompass the correct approach to be adopted because, who knows? Perhaps Africa-led AI laws will prove effective to the African context in terms of coordination, enforcement, and institution building.
The challenge with copy-pasted AI laws from the west is that they hold the full potential to suffocate local innovation before it even gets off the ground.[3] AI debates in Africa have thus developed over time to lead to a central theme that AI already affects financial services, healthcare, education, employment, public administration, policing, advertising and access to information, among other governance issues.
There have been attempts at developing homegrown AI laws to apply to governance aspects in Africa, the leading being in the disciplines of data protection, cybersecurity, cybercrime, consumer protection, competition, administrative decision-making and constitutional rights. A review of these sector-specific laws reveals that the coordination and adoption has not been informed by the lived realities of the people in an African environment.[4]
The initial gap
ICTLC reckons that there is a dearth of comprehensive Africa-specific, binding AI legislation even though AI governance is evidently an agenda.[5] There have been movement in AI policy development in terms of country-specific initiatives, even though these are not enough.[6] This then demonstrates the gaps which require attention going forward, if Africa is to achieve harmonized legal regimes on AI governance.
The African Union (AU) by adopting the Malabo Convention on Cyber Security and Personal Data Protection,[7] sought to cure the total gap, being absence of continental laws to regulate the use of AI in Africa. To augment this, in 2024, the AU adopted the Continental Artificial Intelligence Strategy.[8] These efforts were aimed at sustaining the gains already made in establishing a framework to guide the application of AI in governance in Africa.[9]
Despite the foregoing efforts, Africa continues to experience unique challenges relating to the implementation of these foundational frameworks, and it is to be expected, knowing that the development of these laws happened in the shadow of the EU’s framework on AI.[10] It is equally evident that there is a mismatch between the existing legal frameworks and the regulatory regime, including the effectiveness of authorities in place to foster the coordination and implementation of these laws.
For instance, in the publicized matter in Kenya, being the Worldcoin case, the High Court, as well as the Senate underscored the challenges in application of AI frameworks which do not take into account the role of systems, vigilance, accountability, and robust enforcement in the governance of emerging technologies that intersect with personal data and individual rights.[11]
In sum, the High Court reached the bold decision requiring the deletion of the unlawfully collected sensitive personal data (iris) under the supervision of the Data Protection Commissioner and prohibited further collection without compliance with the law.[12] The intervention by the High Court of Kenya by issuing the stated prohibition orders and the positive action requiring the full data deletion as it was collected illegally all highlight the existing gaps as a result of transplanting AI regulatory frameworks.[13]
There is therefore a need to focus on ensuring that the frameworks adopted in various African States need to undergo localization processes, according to specific circumstances of each country, as a build up towards an African AI governance structure. The Malabo Convention is a good place to start, even though we have to acknowledge that there is much to be done in order to achieve optimal results in terms of implementation.
Furthermore, the AU Continental AI Strategy has a positive focus on how to ensure a coordinated approach intra-states. In terms of building institutional frameworks,[14] it cannot be gainsaid that the effectiveness of any legal frameworks lies on the ability for implementation in a practical sense.
Traces of EU legal frameworks,[15] in Africa’s AI regulatory regimes is something that cannot be denied. However, this article holds that transplantation is not a panacea to African challenges in the regulation of governance frameworks. Even though the EU AI Act provides an avenue to exploit, in terms of coordination and implementation, challenges still abound in Africa.
Plurality in institutions responsible for both policy and legal frameworks require to go the extra mile, in rethinking implementation, and in that regard, develop a framework unique to Africa, and the challenges so far experienced, as a result of transplantation of AI legal and regulatory regimes in Africa.
Furthermore, a study done by the Organisation for Economic Co-operation and Development recommended the approach that “treating AI as a cross-cutting technology, with existing regulators continuing their mandates while progressively building the technical capacity required to oversee AI-enabled systems,”[16] is appropriate, rather than focusing on new legislation, without the ability to coordinate and implement the same.
This perhaps explains the statistics in terms of ratification[17] of the Malabo Convention, which stood at only sixteen of the AU’s fifty-five Member States as at July 2024, while several countries in Africa have only signed but not ratified.[18] The challenges faced have also been documented, which include but are not limited to insufficient technical capacity.[19]
States in Africa have also grappled with limited technical expertise to tap into in the enactment of municipal policies and laws to regulate and govern AI, which has spelled challenges in identifying the right approaches to regulation. This in turn has complicated the governance scene, hence the need for nuanced laws.
Gideon Abako attempts to envision a situation where Africa created its own AI Act, and highlights that this should be done without ‘a copy-paste of Brussels.’ The author identifies the main priority, being a real law with a focus on ‘African priorities, infrastructure and risks.’[20] The final reflections indicate that practical laws on AI governance In Africa have to be enforceable, and convert principles into law in order to safeguard rights, and create legal certainty without mimicking foreign models that never faced these constraints.[21]
Conclusion
Should Africa then gain bragging rights as a direct result of developing on its own indigenous AI governance frameworks devoid of western influence? This is perhaps a loaded question, and one that appreciates that as we speak, Africa is not starting on a clean slate, owing to existing legal and regulatory mechanisms in place for AI governance. However, is it possible that the so-called AI Act within the context of Africa can be tailored to meet the needs of the continent in terms of socio-economic, cultural and political dynamics?
This article in that regard identifies the central challenge in AI governance in Africa, being that there is an apparent gap “between writing rules and making them work in practice, which turns out to be wider than expected.”[22] Africa cannot therefore mirror laws from other jurisdictions as ‘best practice’ without initial audits of country-specific situations, in the development or adoption of an AI framework that would respond to the needs of the peoples of Africa.
In order to achieve the foregoing, there is a need to look into creating awareness regarding the new oil, being the personal data, which informs development of AI systems. People need to understand ‘the value of their personal data in the digital economy, the vulnerability of such data and the security risks involved in sharing such data with third parties.’[23] The laws to be adopted therefore need to take into account digital skills and education, and the innovation realities of the continent.[24]
The article concludes that there is need for a shift from “regulatory production” meaning the obsession with creating laws which are not responsive to the governance realities in Africa, to a place where it is the impact of these laws on the people that is of priority.[25] There is a dire need to focus on the ability of laws adopted to respond to the likely harms posed by algorithmic systems hence the call for effective protection through strong coordination, enforcement and building capacity in Africa.
Chrispin Bosire
Chrispin Bosire is a practicing Advocate of the High Court of Kenya, a Certified Professional Mediator and an Internet Governance Fellow. He holds an LLM In Human Rights And Democratisation In Africa (Distinction, Pretoria)
[1] 4th Annual Mediation Summit, Strathmore University, April 15 – 17, 2026 available at <https://judiciary.go.ke/delegates-resolve-to-strengthen-mediation-of-family-children-and-succession-disputes/> last accessed on 28 August, 2026.
[2] ibid.
[3] The Brussels Echo in Nairobi: Kenya’s AI Bill 2026 and the European Union’s Artificial Intelligence Act, (SSRN, May 2026) available at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6717158> last accessed on 28 August, 2026.
[4] AI regulation in Africa: why copying the European model won’t work, available at <https://theconversation.com/ai-regulation-in-africa-why-copying-the-european-model-wont-work-283524> last accessed on 28 August, 2026.
[5] Wendy Kuyoh, Laura Senatore, Lorenzo Covello, ‘The Rise of AI Legislation in Africa: Kenya in Focus’ available at < https://www.ictlc.com/the-rise-of-ai-legislation-in-africa-kenya-in-focus/?lang=en> last accessed on 2 September, 2026.
[6] ibid.
[7] African Union Convention on Cyber Security and Personal Data Protection, available at https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection last accessed on 28 August, 2026.
[8] Continental Artificial Intelligence Strategy, available at <https://au.int/en/documents/20240809/continental-artificial-intelligence-strategy> last accessed on 28 August, 2026.
[9] African Union, Continental Artificial Intelligence Strategy, endorsed by the AU Executive Council, 45th Ordinary Session, Accra, 18-19 July 2024, available at <https://au.int/en/documents/20240809/continental-artificial-intelligence-strategy> last accessed on 28 August, 2026.
[10] Jane Munga, Sylvester Quansah, ‘Understanding Africa’s AI Governance Landscape: Insights From Policy Practice and Dialogue’ 11 September, 2025 available at < https://carnegieendowment.org/russia-eurasia/posts/2025/09/understanding-africas-ai-governance-landscape-insights-from-policy-practice-and-dialogue> last accessed on 28 August, 2026.
[11] See Mercy Chore, the World Coin case in Kenya, available at <https://www.cyjurii.org/case-laws/case-laws-commentaries/the-worldcoin-case-in-kenya> last accessed on 28 August, 2026.
[12] Republic v Tools for Humanity Corporation (US) & 9 others, Petition E062 of 2023, Judgment delivered 5 May 2025; see also Kenya High Court’s Worldcoin Determination: Upholding Consent, Accountability and Data Sovereignty in Biometric Data Processing available at <https://cipit.strathmore.edu/kenya-high-courts-worldcoin-determination-upholding-consent-accountability-and-data-sovereignty-in-biometric-data-processing/> last accessed on 28 September, 2026.
[13] Worldcoin ignored initial order to stop iris scans in Kenya, records show”, TechCrunch, 15 August 2023.
[14] African Union, Continental Artificial Intelligence Strategy.
[15] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
[16] See AI governance in Africa: Insights from a policy dialogue with 12 countries, available at <https://www.oecd.org/en/publications/oecd-artificial-intelligence-case-studies_c517fcf5-en/ai-governance-in-africa_1ff55135-en.html> last accessed on 28 August, 2026.
[17] African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), adopted 27 June 2014, entered into force 8 June 2023; African Union Press Advisory, “African Union celebrates the 10th Anniversary of the adoption of the Malabo Protocol”, 25 June 2024, available at <https://au.int/en/node/43880> last accessed on 28 August, 2026.
[18] African Union, “List of Countries which have Signed, Ratified/Acceded to the African Union Convention on Cyber Security and Personal Data Protection”, status as at 8 July 2024, <https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf > last accessed on 28 August, 2026.
[19] African Union, Progress Report of the Ministerial Committee on the Challenges of Ratification, Accession and Implementation of OAU/AU Treaties, EX.CL/1631(XLVII) (9 June 2025), available at <https://archives.au.int/handle/123456789/11195> last accessed on 28 August, 2026.
[20] Gideon Abako, ‘What Would an African AI Act Look Like?’ available at < https://journal.neuravox.org/p/what-would-an-african-ai-act-look> last accessed on 2 September, 2026.
[21] ibid.
[22] See Diplo Team, ‘The gap between AI rules and AI reality,’ 14 April 2026 available at <https://www.diplomacy.edu/blog/the-gap-between-ai-rules-and-ai-reality/> last accessed on 28 August, 2026.
[23] See ECDPM, ‘Looking into the crystal ball: Artificial intelligence policy and regulation in Africa,’ 18 September 2023 available at < https://ecdpm.org/work/looking-crystal-ball-artificial-intelligence-policy-regulation-africa> last accessed on 2 September, 2026.
[24] ibid.
[25] See Carlos Garcia-Llorente, Ignacio Olmeda, ‘Governing Without Enforcing: Foundational Legal Infrastructure and the Capacity–Justiciability Gap in AI Rights Protection’ available at <https://onlinelibrary.wiley.com/doi/full/10.1111/rego.70191> last accessed on 28 August, 2026.
