Africa’s Digital Compact Is Not a Law. It Still Sets the Direction of Regulation.
On 18 and 19 July 2024, the African Union Executive Council endorsed the African Digital Compact and the Continental Artificial Intelligence Strategy. Neither instrument is a binding statute, and neither creates a directly enforceable compliance deadline. Their importance lies elsewhere: together, they give African governments a shared direction for digital governance, cybersecurity, data, artificial intelligence and digital rights.
Policy can shape law before legislation arrives
Continental strategies are easy to dismiss because they do not operate like national laws. That would be a mistake here. The Compact and AI Strategy are designed to influence national policy, regional cooperation, public investment, standards and future legislation. They also give regulators and ministries a common vocabulary for subjects that many African jurisdictions are addressing at different speeds.
For organisations operating across Africa, this matters even before a new Act or regulation appears. A shared policy direction can change procurement requirements, supervisory expectations, sector rules and the questions governments ask when approving digital services. It can also reduce the distance between national approaches over time, even if it does not eliminate that variation.
The Compact is broader than artificial intelligence
The African Digital Compact is a broad framework for Africa’s digital transformation. It addresses digital infrastructure, inclusion, skills, innovation, data governance, digital public services, cybersecurity, resilience and rights. Its premise is that connectivity and economic growth cannot be separated from trust, safety and meaningful participation.
That has practical consequences. A digital service can be technically secure and still conflict with the direction of the Compact if it excludes large groups, ignores accessibility, weakens user rights or creates dependencies that governments cannot safely manage. The document therefore pushes decision-makers to assess digital systems as part of a wider social and institutional environment, not only as technology deployments.
The AI Strategy turns principles into a regulatory agenda
The Continental AI Strategy adds a more focused layer. It calls for responsible and inclusive AI development while recognising the risks created by unsafe systems, weak governance and dependence on technologies developed for other contexts. The strategy points towards national governance frameworks that may combine legislation, regulations, standards, codes of practice and institutional oversight.
Its priorities include safety and security, human rights, ethical governance, access to high-quality data, computing infrastructure, skills, research and innovation. It also highlights African languages and local contexts. That is important because models trained or evaluated elsewhere can fail in ways that are difficult to detect when they are deployed in African public services, finance, healthcare, employment or education.
The likely regulatory direction is therefore not a simple copy of another region’s AI law. The strategy encourages African institutions to build governance suited to local needs while participating in global standard-setting. Organisations should expect risk assessment, transparency, accountability, security and human oversight to remain central, even when the eventual legal mechanisms differ by country.
A common direction does not erase national variation
A continental framework is not a single African compliance regime. National constitutions, data-protection laws, cybersecurity rules, sector regulators and institutional capacity still differ substantially. The legal status and implementation timetable of any future measure must be checked jurisdiction by jurisdiction.
The more useful reading is that the Compact and AI Strategy establish a baseline direction. Governments can use them when drafting national strategies, revising privacy or cyber rules, buying AI systems, creating sandboxes and setting conditions for public-private partnerships. Regional economic communities may also translate parts of that direction into more specific initiatives.
What organisations should do now
- Map African deployments separately. Record which systems, datasets, vendors and decision processes operate in each jurisdiction rather than treating the continent as one market.
- Build rights and inclusion into design. Test accessibility, language coverage, bias, explainability and routes for human review before deployment.
- Connect AI governance to security. Include model access, data integrity, supply-chain risk, incident response and resilience in the same control framework.
- Prepare evidence, not only policies. Maintain impact assessments, testing results, data provenance, approvals, monitoring records and escalation decisions.
- Track national implementation. Watch legislation, regulatory guidance, procurement rules and strategies in the countries where services are offered.
- Engage early. Consultations and standards work can shape requirements long before a final law creates a deadline.
Africa is positioning itself as a rule-shaper
The central message is not that one new law now applies across Africa. It is that African institutions are setting a collective position on how digital transformation and AI should develop. That position links innovation with rights, security, resilience and local agency.
Businesses that wait for a penalty clause may miss the earlier change in expectations. The organisations best prepared for the next generation of African digital regulation will be those that can already show where their systems operate, what data and models they use, how risks are tested, and who is accountable when technology affects people.
Official sources
- African Union: African Digital Compact
- African Digital Compact, official PDF
- African Union: Continental Artificial Intelligence Strategy
- Continental Artificial Intelligence Strategy, official PDF
- African Union Executive Council decisions, July 2024
This article is for general information only and does not constitute legal advice. Organisations should obtain advice on the law and regulatory guidance applicable to their activities in each jurisdiction.
This article is part of BlackTree’s Africa Series, tracking significant cybersecurity, privacy and digital-governance developments across the continent.
