House Approves Cybersecurity, Revised Customs Proclamations

The Ethiopian House of People's Representatives (HPR) has approved two significant pieces of legislation: the Cybersecurity of Key Infrastructures Proclamation and the Revised Customs Proclamation. The cybersecurity law, which has already entered into force, aims to bolster Ethiopia's digital defenses by defining critical infrastructure, establishing a dedicated fund, and introducing a licensing framework for cybersecurity service providers. Concurrently, the revised customs law seeks to modernize trade facilitation, combat illicit trade, and align Ethiopia's customs regime with international standards, thereby fostering a more predictable environment for investment and supporting the manufacturing sector. These proclamations represent crucial steps in Ethiopia's ongoing efforts to enhance national security in the digital realm and streamline its economic governance.

Ethiopia's legislative landscape has recently seen pivotal developments with the approval of two critical proclamations by the House of People's Representatives (HPR): the Cybersecurity of Key Infrastructures Proclamation and the Revised Customs Proclamation. These legislative acts, passed during the HPR's 24th regular session, underscore the government's commitment to addressing contemporary challenges in national security and economic development. The Cybersecurity Proclamation, in particular, has already entered into force, marking an immediate strengthening of the nation's digital defense mechanisms against escalating cyber threats.

The approval of these proclamations is not merely a procedural formality but a strategic move to safeguard Ethiopia's burgeoning digital economy and enhance its global trade competitiveness. The cybersecurity legislation is a direct response to the increasing sophistication and volume of cyberattacks targeting national digital infrastructure, while the customs revision aims to streamline trade processes, curb illicit activities, and attract foreign investment. This article delves into the background, key provisions, and anticipated implications of these new laws for legal practitioners and the broader Ethiopian economy.

Ethiopia's journey towards a robust legal framework for cybersecurity has been evolving, driven by rapid digital transformation and a corresponding surge in cyber threats. Prior to the new proclamation, the country had enacted several foundational laws, including the Personal Data Proclamation (Proclamation No. 1321/2024), the Digital Identification Proclamation (Proclamation No. 1284/2023), the Electronic Transactions Proclamation (Proclamation No. 1205/2020), and the Computer Crime Proclamation (Proclamation No. 958/2016). These instruments, alongside a National Cybersecurity Policy (2024) and the operational efforts of the Information Network Security Administration (INSA) and the Ethiopian Cyber Emergency Response Team (ETHIO-CERT), laid the groundwork for a more comprehensive approach. The new Cybersecurity of Key Infrastructures Proclamation builds upon this foundation, specifically targeting the protection of vital national assets.

Similarly, the revision of the customs law is part of a continuous effort to modernize Ethiopia's trade regime. The previous Customs Proclamation, No. 859/2014, had already introduced reforms aimed at streamlining and modernizing trade facilitation processes, including electronic procedures and reduced clearance times, in alignment with the Revised Kyoto Convention. However, challenges such as contraband, bureaucratic delays, and the need to further align with international agreements persisted. The Council of Ministers had deliberated on the draft amendment, recognizing the need to support the country's growing manufacturing sector and encourage investment, before submitting it to the HPR for final approval. The legislative process in Ethiopia typically involves bills being introduced by either Members of Parliament or the Executive branch, undergoing two readings in the HPR, which is the sole legislative body for federal matters, before being submitted to the President for signature.

The Cybersecurity of Key Infrastructures Proclamation introduces a critical framework for safeguarding Ethiopia's essential digital assets. It broadly defines critical infrastructure as any infrastructure or institution whose disruption could significantly impact national security or interests, encompassing eleven strategic sectors such as telecommunications, energy, finance, transportation, and digital public services. A notable feature is the establishment of a dedicated critical infrastructure cybersecurity fund, signaling a commitment to sustained investment in digital defense. Furthermore, the proclamation mandates a licensing framework for private cybersecurity service providers and auditors, imposing substantial penalties, including fines of up to 2 million Birr and three times that amount for repeat violations, on unlicensed operators. This regulatory oversight aims to ensure a high standard of cybersecurity services and accountability across both government and private critical infrastructure. The law also reportedly includes rigorous imprisonment terms for individuals who intentionally compromise critical infrastructure, highlighting the serious legal consequences for cyber offenses.

On the trade front, the Revised Customs Proclamation (likely Proclamation No. 1281/2022, though the exact number for the revised customs law is not explicitly stated in the provided snippets, Proclamation No. 1281/2023 is a loan agreement ratification, so it's important to be careful with the number) builds upon previous reforms to enhance trade efficiency and combat illicit activities. The amendments are designed to prevent contraband, align Ethiopia's customs system with international agreements, and ensure fairness, thereby fostering a more conducive environment for the manufacturing sector and investment. Key changes are expected to include measures to expedite clearance processes, adopt international best practices, and strengthen enforcement. Specific provisions mentioned in a draft amendment to the previous Proclamation No. 859/2014 indicate changes to Article 23 regarding the examination of goods (allowing for cargo scanning, laboratory analysis, and physical inspection) and Article 25 concerning the release of goods under a single declaration. Crucially, the revision also addresses customs valuation methods, aiming to align with the World Trade Organization's Customs Valuation Agreement and permitting the use of valuation databases for risk management. This latter point is particularly significant, as previous valuation directives have been criticized for creating distortions in trade and banking operations.

The simultaneous approval of these two proclamations reflects a coordinated governmental strategy to secure Ethiopia's digital future while simultaneously opening up and regulating its economy. The cybersecurity law provides the necessary legal teeth to protect the digital infrastructure that underpins modern trade and finance, while the customs law aims to facilitate the physical flow of goods and capital. The effectiveness of these laws will, however, depend heavily on the subsequent issuance of clear implementing regulations and the capacity of regulatory bodies like INSA and the Ethiopian Customs Commission to enforce them consistently and transparently.

The approval of the Cybersecurity of Key Infrastructures Proclamation and the Revised Customs Proclamation marks a significant legislative milestone for Ethiopia. For legal practitioners, these new laws necessitate a thorough understanding of expanded compliance obligations, particularly for entities operating within critical infrastructure sectors or engaged in international trade. Businesses must now review their cybersecurity protocols to align with the new regulatory requirements, including potential licensing for service providers and stringent incident reporting mechanisms. Similarly, importers, exporters, and logistics providers will need to adapt to the modernized customs procedures, valuation methods, and enhanced enforcement measures.

Practitioners should closely monitor the issuance of subsidiary legislation, such as regulations and directives, which will provide crucial details for the practical implementation of these proclamations. The emphasis on aligning with international standards in customs and the robust framework for cybersecurity suggest a move towards greater predictability and security in Ethiopia's legal and economic environment. Staying abreast of these developments will be essential for advising clients on risk mitigation, compliance strategies, and leveraging the opportunities presented by a more secure and streamlined operational landscape.