Strategy Rich, Law Poor: Africa’s AI Governance Gap Is About Implementation

Africa’s AI policy landscape is expanding. Governments are announcing national strategies, establishing advisory bodies and positioning artificial intelligence as a driver of productivity, public-service delivery and economic transformation. The African Union has its Continental Artificial Intelligence Strategy, while countries including Kenya, Nigeria, Rwanda, Egypt and Ghana have developed national frameworks or are advancing related initiatives.

Yet a central weakness persists: a strategy can establish what a government wants to achieve without creating the legal duties, independent oversight or funded institutions needed to make those ambitions enforceable.

That is the central tension in the July 2026 analysis by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA), Rethinking Africa’s Approach to the Politics of AI Governance and Regulation. The organisation warns that adopting policies and human-rights commitments is only the beginning. Without implementation plans, public participation, institutional independence and reliable funding, progressive principles can remain largely aspirational.

The AI Policy Tracker’s Africa overview recorded 21 jurisdictions with AI-policy instruments and 22 instruments across the region. As of its 15 October 2026 update, it recorded no binding AI-specific instruments among those jurisdictions. The tracker includes national strategies, policies and regional frameworks, distinguishing these from dedicated, binding AI rules.

This is an important finding, but it needs to be interpreted correctly. It does not mean that AI operates outside the law across Africa. Existing data-protection, cybersecurity, copyright, consumer-protection and sector-specific rules can impose binding obligations on organisations that develop or deploy AI. The gap is that these laws do not necessarily form a comprehensive framework addressing AI-specific risks, responsibilities and oversight.

The distinction between a strategy and a law is fundamental. A strategy may set targets for AI adoption, skills development, infrastructure or research. A binding law can establish duties, define prohibited conduct, give regulators specific powers and provide remedies when rights are violated. Neither guarantees effective implementation on its own, but each performs a different function.

Africa’s challenge is therefore not simply to pass more legislation. It is to connect strategic commitments to enforceable responsibilities, credible oversight and the resources needed to deliver them.

Kenya provides a revealing example of the distance between policy ambition and implementation capacity.

CIPESA notes that Kenya’s National Artificial Intelligence Strategy for 2025–2030 was costed at KSh152 billion over five years. However, its review of the 2026/27 national budget found no dedicated allocation for implementing the strategy. The KSh8.6 billion allocated to the ICT sector was directed mainly towards broadband expansion, digital skills and the digitisation of government services.

These investments may support the foundations on which AI development depends. Broadband, digital literacy and modernised public services are not separate from AI progress. But spending on the broader ICT sector is not automatically equivalent to funding the full set of activities envisaged in a national AI strategy.

The distinction matters because AI development requires more than infrastructure. Governments need technical expertise, research capacity, data governance, evaluation systems and institutional arrangements that can monitor how AI is used. If a strategy sets ambitious objectives without clearly identifying the funding streams, responsible agencies and implementation milestones, progress becomes difficult to assess and accountability becomes diffuse.

Kenya’s case raises a question that applies across the continent: when a government announces an AI strategy, can citizens identify which institution is responsible for each commitment, how the work will be financed and what evidence will demonstrate progress?

Without those answers, policy adoption can become a political milestone rather than an operational programme.

Nigeria illustrates a different dimension of the same problem. According to the Digital Policy Alert’s August 2026 analysis, Nigeria had not enacted a standalone AI law as of the report’s July 2026 research cut-off. Its governance framework instead combined a national AI strategy, existing legislation, sector-specific requirements, guidance and proposed bills.

The National AI Strategy for 2025–2029 sets objectives around economic competitiveness, social development and technological advancement. But existing laws also shape AI deployment. The Nigeria Data Protection Act 2023, for example, establishes safeguards around decisions based solely on automated processing, including opportunities for human intervention and challenges to decisions. Data-protection requirements can also trigger impact assessments and safeguards for higher-risk processing.

Sector-specific rules add another layer. The Digital Policy Alert report identifies requirements and planned measures relevant to telecommunications and financial services, alongside proposed legislation addressing AI institutions, digital health and the use of AI-generated replicas of performers.

This creates a more complicated picture than a simple divide between regulated and unregulated countries. AI governance can develop incrementally, with existing laws addressing particular harms while governments debate whether a dedicated statute is necessary.

The benefit is flexibility: policymakers can apply established protections without waiting for a comprehensive AI law. The risk is fragmentation. Different regulators may have overlapping responsibilities, while important questions—such as how to classify high-risk systems, coordinate investigations or allocate liability—may remain unsettled.

Nigeria’s experience also demonstrates why legislative proposals must be distinguished from laws already in force. A bill may indicate the direction of policy debate, but it does not create binding obligations merely because it has been introduced. Its final scope, passage and implementation may change.

CIPESA’s analysis identifies funding as only one part of the problem. Oversight bodies may lack operational independence, clear mandates or sufficient resources. Responsibilities may be distributed across ministries and regulators without a reliable mechanism for coordination. In some cases, the public has limited opportunities to shape policy before decisions are made.

These weaknesses are especially consequential in AI governance because the technology cuts across established regulatory boundaries.

A single AI application might process personal data, influence a financial decision, generate copyrighted material and distribute content through a digital platform. Different laws and agencies may govern each element, but effective oversight requires someone to understand how the parts interact.

Fragmentation can create uncertainty for businesses and leave citizens unsure where to seek redress. It can also encourage regulators to focus narrowly on their existing mandates, even when the most significant risk emerges from the combined operation of several systems.

Creating a new AI authority is not necessarily the answer in every country. A dedicated regulator could provide specialist expertise and clearer coordination, but it could also duplicate existing functions or concentrate powers without adequate safeguards. Countries should first establish which responsibilities are missing, which institutions already have relevant powers and where coordination fails.

The objective should be a system in which responsibility is clear, regulators have the resources and independence to act, and individuals can challenge consequential decisions.

CIPESA also warns against importing regulatory models without sufficiently adapting them to local economic, political and social conditions. International frameworks can offer valuable principles and technical experience, but their effectiveness depends on how they are translated into national institutions and practices.

This is not an argument against international cooperation. AI systems and their supply chains cross borders, making shared standards and coordinated approaches increasingly important. Rather, it is an argument for designing governance around the realities of African markets, public institutions, languages and technical capacity.

Rules that impose complex compliance requirements without providing clarity or proportionate obligations may disproportionately burden smaller local developers. Conversely, a framework that prioritises rapid adoption but provides weak remedies can expose citizens to harms they have little power to contest.

Meaningful public consultation can help governments identify these trade-offs before rules are adopted. Developers, researchers, civil society, workers, consumers and communities affected by automated decisions should have opportunities to contribute. Participation should extend beyond publishing a draft document: authorities need to explain how submissions influenced the final framework and why competing proposals were accepted or rejected.

Human-rights principles also need to be translated into practical requirements. Transparency is useful when people can understand how a consequential system affects them. Human oversight matters when a reviewer has the authority and information to intervene. Accountability is meaningful when a responsible institution can investigate complaints and require corrective action.

A more credible model of African AI governance would connect five elements.

• Costed implementation: strategies should identify realistic budgets, funding sources, milestones and responsible institutions.

• Clear legal duties: governments should specify which obligations apply under existing laws and where AI-specific legislation is needed to address genuine gaps.

• Independent oversight: regulators should have defined mandates, sufficient technical expertise and operational independence, with appropriate checks on their powers.

• Public participation and redress: people affected by AI systems should be able to contribute to policy development, challenge harmful outcomes and obtain meaningful remedies.

• Measurable accountability: governments should report on implementation, enforcement, complaints and outcomes, not simply the adoption of strategies or establishment of committees.

These are not competing priorities. Together, they can make regulation more predictable for responsible businesses and more effective at protecting the public.

Africa does not lack AI ambition. It has continental principles, national strategies and a growing set of legal and policy initiatives. What remains uneven is the machinery that converts those commitments into practical safeguards.

The AI Policy Tracker’s finding of no recorded binding AI-specific instruments across its 21 African jurisdictions is a useful signal of that gap, not proof that AI is wholly unregulated. Nigeria demonstrates how existing laws can already govern important aspects of AI, while Kenya highlights the question of whether strategic ambitions are matched by dedicated implementation resources.

The next phase of AI governance should be judged less by how many strategies governments publish and more by whether those strategies produce funded programmes, clear responsibilities, independent oversight and accessible remedies.

Africa’s AI governance challenge is not just to write better policy. It is to make policy work.