Given the intense development of artificial intelligence (AI) within the past decade, many nations have now begun to create policies to govern the capabilities of AI. The European Union is the first regional body to enact formal regulations. Drawing from the EU General Data Protection Regulation (GDPR), the European Union successfully developed the EU AI Act. Similar statutes have been passed in other continents, such as Africa. The African Union (AU) ratified the Malabo Convention—a legal framework for data protection and cybersecurity—on June 8, 2023, and this regulation is similar to the EU GDPR and AI Act in jumpstarting effective AI regulation throughout Africa.
The prevalence of AI in the lives of African consumers, educational institutions, governments, and companies has raised questions regarding the humanitarian impact of AI and how the technology should be regulated. Africa is a compelling continent to explore how the expansion of AI interacts with policy creation, given the recent ratification of the Malabo Convention and the challenges of integrating AI policies with existing data protection frameworks. To delve into this issue, answering three pivotal questions is necessary. Firstly, what are Africa’s priorities in creating AI-related policy interventions? Secondly, what policies already exist? Thirdly, how can these countries implement new policies?
How AI has impacted Africa
Any new advanced technology raises the question of how it will impact society. To understand how the African Union might want to approach AI through legislation, it is necessary to fully grasp this technology's potential, alongside its benefits and drawbacks.
Within Africa, AI has the potential to modernize consumer-based industries such as agriculture. AI-based modernization can make agriculture a more efficient industry, boosting African economies. About 17.3 percent of Africa’s gross domestic product (GDP) comes from agriculture; however, as of 2022, about 60 percent of the population faces food insecurity at a moderate or severe level. This food insecurity is exacerbated by unpredictable weather conditions and poor agricultural yields. Agriculture can be modernized through AI-powered algorithms that improve crop yields, weather forecasting, and research about drought-resistant crops. For instance, the Africa Agriculture Watch created an algorithm that uses satellites to track changes in vegetation cover and climate. AI is used to provide data to farmers to help them increase crop growth during times of crisis. By modernizing agriculture, these AI applications decrease famine while increasing economic development.
AI can also be utilized to improve citizens' access to healthcare. Less than half of Africa’s citizens have immediate access to the healthcare they need; through AI startups, technology can improve the accessibility and efficacy of healthcare clinics. In Nigeria, Intron Health was developed to enhance clinician productivity through its speech transcription technology, which is designed to understand African accents. Intron Health’s algorithms have proven effective in transcribing messages in 200 African accents with 92 percent accuracy. Furthermore, Ghana utilizes minoHealth AI labs—a patient inputs their medical information and image, and the AI technology analyzes this information and provides a diagnosis. This technology has been used to diagnose fourteen chest conditions and screen for infectious diseases such as malaria, tuberculosis, and COVID-19. These examples demonstrate how AI start-ups have significantly increased healthcare accessibility and efficiency.
However, AI can also negatively impact African societies through the use of deepfakes. Deepfakes—AI algorithms designed to create false images, videos, or audio—have the potential to deeply misinform African societies. AI can be used to breach personal data without authorization and impersonate people for extortion or fraud. In South Africa, identity theft increased by about 356 percent from 2022 to 2023, and deepfakes have exacerbated this problem. South Africa is now third in the world for cyber threats. Similarly, as of November 2024, Nigeria experiences the most fraud in Africa, accounting for 5.91 percent of Africa’s fraud activity. Fueled by deepfakes, fraud cases in Africa have increased by 167 percent in 2024.
Deepfakes were also used to create a sense of distrust in South Africa during the general election on May 29, 2024. Just twenty days before the election, Duduzile Zuma-Sambudla, the daughter of former President Jacob Zuma, shared a thirty-second clip on X, in which President Trump is depicted endorsing uMkhonto WeSizwe, Zuma's left-wing party. The video is off-sync with Trump’s lips, so those familiar with South African politics and AI deepfakes quickly recognized that the video was manufactured. Yet, many users of X still believed the fake endorsement. Zuma-Sambudla, who originally shared the video, presumably posted the deepfake with the malicious intention to mislead voters. Although the visual aspects of the video are low-quality, this deepfake reveals the sophistication of content manufactured by AI, as the audio impersonates Trump’s distinct voice and incorporates pronunciation errors typical in non-native Zulu and Xhosa speakers. AI is a sophisticated technology that can be weaponized to misinform the public, especially in democratic procedures such as elections.
What policies have already been created?
The GDPR is the basis of the European Union’s AI legislation, which serves as a reference for the African Union. Understanding the GDPR as the foundation for the AI Act and understanding the baseline established by the Malabo Convention is essential to analyzing how the African Union might build on the Malabo Convention to enact future regional AI legislation.
The GDPR is an EU law enacted on May 25, 2018. Its main purpose is to protect individual rights by regulating how personal data is collected and used. The European Union applies specific regulations within this legal framework to AI. For instance, Article 4(1) of the GDPR specifies that AI is allowed to collect data for developmental purposes on the condition that this information is not identifiable to any specific person. Furthermore, Article 5(1)(a) requires that personal data should be processed “lawfully, fairly, and in a transparent manner in relation to the data subject.” These two provisions indicate how specific articles within the GDPR promote personal data protection and public transparency in the context of AI. The GDPR established a foundation for the European Union to create a more comprehensive AI framework. For example, the EU AI Act—adopted on March 13, 2024—complements the GDPR. While the GDPR is a rights law focusing on individual protections, the AI Act is a product safety law that promotes the safe development of AI technology.
On June 27, 2014, the African Union established the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) to improve cybersecurity. This framework is a milestone in protecting the continent’s data against cybercrime and requires all fifty-five AU member states to comply for continental credibility. However, for the Convention to come into force, only fifteen member states had to ratify it; this threshold was reached when Mauritania ratified the Convention on May 9, 2023. The Malabo Convention went into effect on June 8, 2023. Ratification proved to be more difficult than expected, as many countries believe that the Convention's scope is too broad and fails to consider provisions such as data breach notifications and privacy impact assessments. Furthermore, some countries believe that the Convention's goals might be better executed through other national, regional, and continental approaches.
There are flaws with every piece of legislation—the Malabo Convention, albeit imperfect, serves as an instrument for the protection and promotion of human rights. As highlighted in Article 8, the Convention aims to protect individual rights and public freedoms regarding personal data. Article 10 establishes guidelines about the processing of genetic information and health research, necessitating the approval of the national protection authority. It also regulates the collection of personal data of public interest for statistical, scientific, or historical purposes. Through these provisions, the African Union has established basic AI regulations similar to the European Union’s GDPR and AI Act.
Despite the very different geographic and social contexts of the European Union and African Union, both political unions share the same goal: protecting personal data security. The African Union can draw additional inspiration for cybersecurity legislation from the EU GDPR and AI Act. For instance, specific provisions in the AI Act would be directly applicable to the African Union, including provisions on AI’s possible use in democratic elections. The AI Act offers clear guidelines on how AI can organize, optimize, and structure political campaigns; however, the Act prohibits the usage of this technology to influence elections or voting behavior. Additionally, in Chapter II, Art. 5, the AI Act establishes useful guidelines for preventing the weaponization of AI technology to manipulate and harm citizens; these guidelines could be a helpful reference point for the African Union. Lastly, the African Union could also create provisions on how AI can be used to prevent fraud. Remote biometric systems could verify personal identities and detect financial fraud. It is evident how the EU AI Act can be a foundational resource for the African Union as it develops its own AI strategies.
The impacts of these pre-existing policies
On February 29, 2024, using the guidelines outlined in the Malabo Convention, the AU developmental agency developed a policy draft indicating intentions to create an AI council to monitor responsible usage of the technology. Furthermore, from June 11 to 13, 2024, more than 130 African ministers and experts held a virtual meeting discussing the Continental AI Strategy. The Continental AI Strategy will serve as a guidepost to African countries on how to minimize the risks and maximize the benefits of AI. This initiative is expected to be fully endorsed by the heads of AU member states by February 2025. As it moves towards endorsing the Continental AI Strategy, the African Union is also taking steps to implement the ideas outlined in the Malabo Convention.
However, on the national level, only seven countries have developed AI programs: Benin, Egypt, Ghana, Mauritius, Rwanda, Senegal, and Tunisia. Egypt’s AI program seeks to promote regional cooperation and serve as an international player, demonstrating the potential for productive regional cooperation if more AU countries develop AI initiatives. Specifically, Egypt’s goals include utilizing AI to streamline government operations, ease economic challenges, fund research, promote skills and AI education, and sustain employability. Egypt’s national AI plans to demonstrate how more advanced AI policies could benefit other AU countries.
How can AU countries implement new policies?
Based upon AU goals and EU precedents, specific recommendations to implement new policies should include AI education to raise awareness of the harms AI may cause. AI education days, workshops, and training programs could teach citizens how to distinguish deepfakes from factual information. Education is pivotal in protecting students, business owners, and public officials from AI-based disinformation and educating the public on ethical and safe AI usage.
To further combat deepfakes, AU policies can include specific provisions to prevent AI from being used to influence democratic processes such as elections. The United States offers an example of a legislative safeguard against deepfakes. California Assembly Bill (AB) 730 prohibits “distributing materials with materially deceptive audio or visual media showing a candidate for office within 60 days of an election, with the intent to injure the candidate's reputation or deceive a voter into voting for or against the candidate.” This law mitigates AI’s ability to impersonate politicians, therefore protecting the integrity of elections. Understanding how other legislatures regulate AI enables the African Union to foster global partnerships on AI-related initiatives and learn the best practices for AI governance from other countries.
