AI regulation across Africa is developing along a recognisable path. Data protection laws already apply to most AI systems that process personal information. Sector regulators in finance, health and telecommunications are issuing guidance on automated decision-making. At continental level, the African Union's Continental AI Strategy encourages member states to adopt governance approaches that are proportionate to risk. National AI strategies and policies are appearing in a growing number of countries.
The common thread is a risk-based approach: the higher the potential for harm, the stronger the expected controls. Organisations do not need to wait for AI-specific statutes to prepare. Much of the groundwork is the same regardless of the final wording of any particular law, and a good part of it is already required under existing data protection legislation.
This checklist is intended as a practical starting point. It is not legal advice, and requirements differ by country and sector, so involve your legal and compliance teams early.
1. Know what AI you have
You cannot govern what you cannot see.
- Build an inventory of AI systems in use or development, including third-party tools and generative AI services used by staff.
- For each system, record its purpose, owner, vendor, data sources, users affected and where it is hosted.
- Identify shadow AI: informal use of public chatbots or browser plug-ins with company or citizen data.
- Assign a named business owner, not only a technical owner, for every system.
2. Classify by risk
Risk-based regulation depends on knowing which systems matter most.
- Define a simple risk tiering (for example low, medium, high) based on the impact on individuals, the degree of automation and the sensitivity of data.
- Treat systems that influence access to credit, employment, education, healthcare, social benefits or public services as higher risk by default.
- Document the rationale for each classification so it can be explained to a regulator or auditor.
- Revisit classifications when a system's scope, users or data change.
3. Get data protection right first
Data protection laws such as South Africa's POPIA, Nigeria's NDPA and Kenya's Data Protection Act already shape how AI systems may use personal information.
- Confirm a lawful basis for each use of personal data in training, fine-tuning, retrieval and inference.
- Apply purpose limitation and data minimisation: use only what the use case needs.
- Map cross-border transfers, including to cloud regions and AI model providers, and confirm that the conditions for transfer are met.
- Carry out a data protection impact assessment for higher-risk processing.
- Review how you handle data subject rights, including access, correction and objection to automated decisions where applicable.
- Check vendor contracts for data retention, sub-processing and whether your data may be used to train their models.
4. Build in transparency
People affected by AI systems increasingly expect, and are often entitled, to know.
- Tell users when they are interacting with an AI system rather than a person.
- Prepare plain-language explanations of how higher-risk systems reach their outputs and what factors they consider.
- Publish or maintain internal documentation describing intended use, known limitations and performance across user groups.
- Make explanations available in the languages your users speak.
5. Keep humans meaningfully involved
Human oversight is a recurring theme in risk-based frameworks.
- For higher-risk decisions, define where a human reviews or approves outcomes and what authority they have to override the system.
- Ensure reviewers have the training, time and information to exercise real judgement rather than rubber-stamping.
- Provide a clear route for people to challenge a decision and obtain human review.
6. Test, monitor and record
Regulators will look for evidence, not assertions.
- Evaluate accuracy and bias before deployment, across relevant groups such as language, region, gender and age where lawful and appropriate.
- Monitor performance and drift in production, with thresholds that trigger review.
- Keep logs sufficient to reconstruct how significant outputs were produced.
- Record incidents, near misses and the actions taken in response.
7. Secure the system
AI-specific threats are part of the regulatory picture because they can lead to data breaches and harmful outcomes.
- Include prompt injection, data leakage, model manipulation and misuse in your threat models.
- Red-team higher-risk systems before launch and after major changes.
- Apply least-privilege access to the data and tools that AI systems can reach.
- Integrate AI systems into your existing incident response and breach notification procedures.
8. Assign accountability
- Nominate an executive accountable for AI risk and give them a regular reporting line to the board or leadership team.
- Clarify how AI governance relates to existing roles such as the information officer, data protection officer, risk and compliance.
- Set a review cycle for policies so they keep pace with regulatory developments in each country where you operate.
Making it proportionate
The aim is not to apply the heaviest controls everywhere. Low-risk internal tools may need little more than an inventory entry and an acceptable-use policy. Higher-risk systems justify the full set of measures above. The value of preparing now is that when national rules are finalised, most of the evidence a regulator will ask for already exists, and adapting to specific requirements becomes a matter of adjustment rather than reconstruction.
A sensible first step is to complete sections 1 and 2 for your current portfolio. Knowing what you have, and which systems carry the most risk, tells you where to focus everything else.
