Nigeria, Kenya and South Africa have no AI statute. Each already has a data protection law, and each of those laws carries four things that reach AI use: a right concerning automated decisions, a duty to assess the impact of risky processing, a duty to report breaches, and a rule on sending personal data abroad. If your AI tools or agents process personal data about people in any of the three countries, those rules bind you today.
One item is moving. Kenya's Artificial Intelligence Bill, 2026 is in the Senate: the committee report on it was tabled on 7 October 2026, and the Senate bills tracker dated 9 October 2026 lists it as "Bill at Second Reading Stage". It is still a bill.
Last verified: 13 October 2026, against the Nigerian Act and GAID 2025 on the regulator's site, Kenya's Act and regulations on Kenya Law (31 December 2022 revised editions), the Kenyan Senate's bill digest and tracker, POPIA in its 2013 gazette text, and South African regulations, gazette notices and regulator pages. Two points rest on a secondary source only and are attributed where they appear.
What applies in each country today?
| Item | Nigeria | Kenya | South Africa |
|---|---|---|---|
| Law and citation | Nigeria Data Protection Act, 2023 (Act No. 37 of 2023); General Application and Implementation Directive (GAID) 2025, issued 20 March 2025 | Data Protection Act, No. 24 of 2019; Data Protection (General) Regulations, Legal Notice 263 of 2021 | Protection of Personal Information Act, No. 4 of 2013 (POPIA); 2018 Regulations, amended 17 April 2025 |
| Regulator | Nigeria Data Protection Commission (NDPC) | Office of the Data Protection Commissioner (ODPC) | Information Regulator |
| Automated-decision right | Section 37: no solely automated decision, including profiling, with legal or similar significant effects. Exceptions: contract, written law, consent. Human intervention and a contest must be available | Section 35: the same core right. Exceptions: contract, law, consent. Written notice, then reconsideration or a new decision on request | Section 71: narrower. Solely automated decisions from processing "intended to provide a profile". Exceptions: contract with safeguards, or a law or code of conduct. No consent exception |
| Impact-assessment trigger | Section 28: likely high risk. GAID Article 28(3): mandatory and filed with the NDPC in 15 cases. Article 43(4): required when deploying AI | Section 31: likely high risk; report submitted 60 days before processing. Regulation 49 lists high-risk operations | No section in the Act. Regulation 4(1)(b): the information officer must ensure one is done. No risk threshold |
| Breach notification | Section 40: regulator within 72 hours of becoming aware; affected people immediately where risk is high | Section 43: regulator within 72 hours; processor to controller within 48 hours where reasonably practicable | Section 22: as soon as reasonably possible. Regulator says reports should go through its eServices Portal |
| Transfer rule | Sections 41 to 43: recipient bound by an adequate law, binding corporate rules, clauses, code or certification, or a section 43 ground such as consent | Sections 48 and 49, Regulation 40: safeguards, adequacy decision, necessity or consent. Sensitive data: consent plus safeguards | Section 72: recipient bound by an adequate law, binding corporate rules or agreement, or consent, contract or benefit grounds |
| Registration or audit duty | Section 44: entities "of major importance" register. The two higher tiers file an annual audit return | Section 18: register with the Data Commissioner; small entities exempt. No annual audit filing verified | Section 55(2): register the information officer. No annual audit filing verified |
| AI-specific instrument and status | GAID Articles 43 and 44 on emerging technologies including AI: binding directive. No AI statute located | Artificial Intelligence Bill, 2026: at second reading stage, not law. ODPC Guidance Note on Artificial Intelligence, July 2026: draft or final status not confirmed | Draft National AI Policy withdrawn by gazette notice, 12 June 2026. No AI bill that we could find |
| Maximum penalty | Section 48: for major-importance entities, the greater of N10,000,000 and 2% of annual gross revenue | Section 63: up to KSh 5 million or, for an undertaking, 1% of annual turnover, whichever is lower | Section 109: administrative fine of up to R10 million |
What does Nigeria require of a company using AI?
Start with the Nigeria Data Protection Act, 2023. Section 37 gives a person "the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal or similar significant effects". Where an exception applies, the person can still obtain human intervention and contest the decision.
The detail sits in the GAID 2025, a 117-page directive from the regulator. Its signature block gives an issue date of 20 March 2025, and the text has no commencement article. According to Digital Policy Alert, a policy tracker, it entered into force on 19 September 2025; we could not find that date in the directive or on the regulator's site.
Articles 43 and 44 deal with emerging technologies, "such as Artificial Intelligence, Internet of Things and Blockchain". A controller or processor that deploys them on personal data must set technical parameters that respect the section 37 right, document them, and file them with the Commission as part of its audit return. It must also carry out a data privacy impact assessment (DPIA) that looks at disparate outcomes.
When is the impact assessment mandatory?
Article 28(3) says "A DPIA is mandatory and shall be filed with the Commission" in 15 listed circumstances. Four matter most for AI: evaluation or scoring (profiling), automated decision-making with legal or similar significant effects, innovative processes or new technology that may pose a significant privacy risk, and cross-border data transfer. The list also names health care, e-commerce and education.
Who registers, and who files by 31 March?
Section 44 requires controllers and processors "of major importance" to register. The regulator's guidance notice on registration sets the bar low: processing the personal data of more than 200 people in six months, or operating in a listed sector. There are three tiers. Ultra-High Level (UHL), which includes banks, insurers and fintechs, pays N250,000. Extra-High Level (EHL) pays N100,000 and Ordinary High Level (OHL) pays N10,000.
The annual Compliance Audit Return, or CAR, is not owed by everyone. Under Articles 7(c) and 10 of the GAID, UHL and EHL entities file it "not later than the 31st of March of each year", and that date applies to those established before 12 June 2023. An entity established later files within fifteen months of its establishment and annually after that. OHL entities renew their registration each year and file no return. Late filing draws a penalty of 50% of the filing fee, and the fees run from N100,000 to N1,000,000.
We left reported NDPC fines out, because we found them only in press reports.
What does Kenya require, and how far along is the AI Bill?
Section 35 of the Data Protection Act gives every person the right not to be subject to a decision "based solely on automated processing, including profiling, which produces legal effects concerning or significantly affects the data subject". The right has limits. It does not apply where the decision is needed for a contract, is permitted by law, or rests on consent. In those cases the controller must tell the person in writing that the decision was solely automated, and the person may ask for it to be reconsidered or retaken by other means. Regulation 22 of the General Regulations adds duties to explain the logic, remove bias and allow human intervention.
Timing is the part teams miss. Section 31 requires a data protection impact assessment before high-risk processing, and section 31(5) says the reports "shall be submitted sixty days prior to the processing of data". Regulation 49 counts automated decision-making with legal or similar significant effect, biometric data, and innovative use of new technology as high risk. A court has already acted on this section. On 5 May 2025, in a judicial review judgment, the High Court quashed Worldcoin's decision to collect, process or transfer biometric data gathered in Kenya without an adequate impact assessment, and ordered that data erased within 7 days under the Data Commissioner's supervision. That was a court order, not a regulator's penalty.
The fine cap is lower than many summaries say. Section 63 allows up to five million shillings or, for an undertaking, up to one percent of annual turnover, "whichever is lower". So KSh 5 million is the ceiling.
What is the status of the regulator's AI guidance?
A 36-page Guidance Note on Artificial Intelligence dated July 2026 sits on the ODPC's server. It is not on the office's list of issued guidelines, and it does not call itself a draft. Digital Policy Alert describes it as a draft that was open for consultation in August 2026. We could not confirm whether it is draft or final as of October 2026.
Where is the AI Bill?
The Senate's bill digest records first reading on 2 April 2026. The tracker shows the committee report tabled on 7 October 2026 and the bill at second reading stage, with no later stage entered. We have not read the full bill and do not describe its provisions.
What does South Africa require now that the draft AI policy is gone?
Section 71 of POPIA is the automated-decision rule, and its scope is specific. It covers a decision with legal consequences or a substantial effect that is based solely on automated processing "intended to provide a profile of such person", for example of their performance at work, credit standing, health or conduct. So it is a rule about profiling-based decisions. Two exceptions exist: a contract, with measures that let the person make representations and give them "sufficient information about the underlying logic", or a law or code of conduct. Consent is not one of them.
POPIA has no section on impact assessments. The duty comes from Regulation 4(1)(b) of the 2018 Regulations, which requires the information officer, the named person who answers for compliance, to ensure that "a personal information impact assessment is done". It is not tied to a risk threshold.
Breach reporting has no hour count. Section 22 requires notice "as soon as reasonably possible" after a security compromise is discovered. The Information Regulator's FAQ says that from 1 April 2025 all such notifications "should be reported" on its eServices Portal, and adds: "All security compromises must be reported irrespective of the deemed level of risk." The wording on the channel is "should", and we found no instrument that makes the portal compulsory.
On AI policy, the country is back at the start. A Draft National AI Policy was gazetted on 10 April 2026. The minister announced its withdrawal on 26 April 2026, and Notice 3978, gazetted on 12 June 2026, withdrew it in its entirety. We have left the regulator's fines out, since the two we verified were still in litigation when last reported.
Does the African Union add anything binding?
Not for these three. The AU Executive Council endorsed the Continental AI Strategy in July 2024; it is a strategy. The AU's data protection treaty, the Malabo Convention, entered into force on 8 June 2023, but on the AU's status list dated 2 February 2026 none of the three has ratified it.
What should you do now in all three countries?
- Inventory the AI tools and agents that process personal data. Include the ones nobody approved: 82% of organizations discovered previously unknown AI agents in the past year, according to an April 2026 survey by the Cloud Security Alliance and Token Security.
- Identify the decisions that are automated. For each, record whether a human is involved, which exception you rely on, and how a person can ask for review.
- Run the impact assessment, and file it where required. Nigeria: check the 15 triggers. Kenya: count back 60 days from the planned start. South Africa: make sure the information officer has one on record.
- Set the breach clocks. 72 hours to the regulator in Nigeria and Kenya; as soon as reasonably possible in South Africa, at any risk level.
- Check the transfer basis for foreign AI tools. Where a tool sends personal data abroad, write down the ground you rely on.
Our AI acceptable use policy template is useful here because all three regimes expect a documented basis for which tools may process which personal data, and the policy is where that basis gets written down.
Which parts of this can software carry?
Choosing an exception and judging risk are legal work. No product does them.
Software can carry the inventory and the record. AccuroAI discovers 1,400+ AI tools, which covers the first step. It applies 40+ data classifiers to prompts and responses and redacts or blocks personal data in line, so a tool with no transfer basis can be stopped from receiving it. Each event is logged against a user and a tool, with evidence mapped to 8 frameworks; our guide to the AI agent audit log explains what that record should hold. None of this makes a company compliant with any of the three laws.
Frequently asked questions
Does any of the three countries have an AI law?
No, as of October 2026. The AI compliance hub tracks other jurisdictions.
Is POPIA section 71 the same as GDPR Article 22?
No. Section 71 is limited to decisions based on profiling and has no consent exception. Our GDPR and enterprise AI guide covers the EU rule, and the UK note shows a third model.
Do we have to send the impact assessment to the regulator?
In Nigeria, yes, in the 15 listed cases. Kenya's section 31(5) says reports are submitted sixty days before processing. For South Africa we verified a duty to do the assessment, not a duty to file it.
This is not legal advice. Quotations are from the laws, directives and regulator pages linked below; ask local counsel how they apply to you.
Sources
- Nigeria: Data Protection Act, 2023; GAID 2025; registration guidance notice. Secondary: Digital Policy Alert on the GAID
- Kenya: Data Protection Act, 2019; General Regulations, 2021; Registration Regulations, 2021; ODPC AI guidance note; Senate bill digest; Senate bills tracker; [2025] KEHC 5629 (KLR). Secondary: Digital Policy Alert on the AI note
- South Africa: POPIA; 2018 Regulations; 2025 amendment; Information Regulator FAQ; draft AI policy, Notice 3880; withdrawal, Notice 3978
- African Union: Continental AI Strategy; Malabo Convention status list