The AI Governance Race: From the EU AI Act to Africa's Response

The world is writing the rulebook for artificial intelligence right now, in this two-year window, and Africa is largely reading over someone else's shoulder. The European Union has moved first and hardest with the EU AI Act, the United States is swinging between deregulation and executive orders, China is running its own model, and into this contest the African Union has quietly placed a serious document on the table: the Continental Artificial Intelligence Strategy. My thesis is blunt. Africa does not need to copy Brussels. It needs to move from strategy on paper to enforcement in practice, fast, or it will end up governed by rules written for other people's economies.

What the EU AI Act actually does, and why the timeline matters

The EU AI Act is the first comprehensive, horizontal AI law in the world, and it works on a risk-tiered logic. Some uses are simply banned. Some are labelled high-risk and carry heavy obligations. Most are low-risk and carry light transparency duties. What makes it consequential for us is not the philosophy but the calendar, because the Act is landing in waves.

• On 2 February 2025, the first prohibitions took effect - banning practices like social scoring and certain manipulative systems.
• On 2 August 2025, obligations for general-purpose AI models (the large models behind tools like GPT, Gemini and Claude) began to apply, and member states had to stand up their governance bodies.
• On 2 August 2026, the bulk of the Act, including high-risk system rules and the real enforcement and penalty powers, comes into force.

Penalties are not symbolic. The heaviest tier can reach into the tens of millions of euros or a percentage of global turnover. And like the GDPR before it, the Act reaches beyond Europe's borders: if your Nairobi or Lagos startup places an AI system on the EU market, or its outputs are used there, you are inside the tent. This is the Brussels Effect, and it is already shaping how global vendors build, which means it will shape what African businesses can buy off the shelf.

Africa's answer: the Continental AI Strategy

Here is the part too few people at home are talking about. In July 2024, at its 45th Ordinary Session in Accra, the African Union Executive Council endorsed the Continental Artificial Intelligence Strategy. This is not a vague aspiration. It sets an Africa-centric, development-first approach around five focus areas: harnessing AI's benefits, building capabilities, minimising risks, stimulating investment, and fostering cooperation. It runs from a 2024 preparatory phase into implementation from 2025 to 2030.

The follow-through is where it gets interesting. The AU has mandated an AI Taskforce, a Pan-African Centre on Artificial Intelligence, and an African Union Fund for Artificial Intelligence, and it is aligning with Smart Africa, the body coordinating digital policy across dozens of member states. The Africa Declaration on AI drew endorsements from 49 countries. That is a rare show of continental agreement.

The EU is regulating a market it already dominates. Africa is trying to build a market it does not yet control. Those are different problems, and they demand different rules.

The national picture is uneven, and that is a risk

Below the continental level, the map is patchy. As of mid-2025, only around 16 of Africa's 54 countries had launched national AI strategies. The leaders are moving:

• Kenya launched its National AI Strategy 2025-2030 on 27 March 2025, positioning itself as a regional hub for research and model development.
• Egypt put out its National AI Strategy 2025-2030 with six pillars and hard targets, including training tens of thousands of professionals.
• Nigeria adopted its national strategy in 2025, and Rwanda, Mauritius and South Africa are at various stages of strategy or framework development.

The danger is that strategies become press releases. A recurring critique from analysts at the Carnegie Endowment and others is that African countries are racing to write AI strategies while the underlying foundations - data protection enforcement, connectivity, skilled regulators - lag behind. A strategy without a functioning data-protection authority is a house with no foundation.

Why data protection is the real front line

The AU strategy leans heavily on existing data protection and governance laws to do the regulatory work, and this is smart, because most African AI harm will not come from science-fiction superintelligence. It will come from biased credit-scoring, opaque hiring tools, and surveillance systems bought from abroad and pointed at citizens. The Malabo Convention on data protection has finally reached the threshold to enter into force, but ratification and, more importantly, enforcement remain thin across the continent. Governance that exists only on paper is worse than useless - it creates the illusion of protection.

What Africa should actually do

I want to be constructive, not just critical. Here is what I would push for.

1. Enforce what exists before writing more. Fund and empower data protection authorities. A single well-run regulator that can investigate an abusive AI deployment does more than three new policy documents.
2. Regulate use, not just technology. The smartest path for resource-constrained states is to police high-risk applications - lending, health, policing, elections - rather than trying to license every model. This is achievable with existing sectoral regulators.
3. Coordinate through the AU and Smart Africa so we are a bloc, not 54 price-takers. A harmonised African standard gives our negotiators leverage with hyperscalers and gives our startups one market to build for instead of dozens.
4. Build interoperability with the EU AI Act rather than resentment of it. If African businesses want to sell into Europe, aligning key definitions and transparency norms is a trade advantage, not a surrender.
5. Insist on local context in the rules. Rules written for economies where nearly everyone is formally employed will misfire in economies where the majority work informally. Our governance must reflect our reality.

The bottom line for African businesses

If you run a company, do not wait for the law to catch up before you get your own house in order. Know where your data lives, know which AI vendors you depend on, and know whether their systems could put you on the wrong side of a European or a Kenyan regulator. Regulation is coming from multiple directions at once, and the businesses that treat governance as a feature rather than a burden will win contracts that others cannot touch. This is also why I keep warning founders against buying AI before your business is ready - governance readiness is part of being ready.

The governance race is not about whether Africa gets rules. Rules are coming whether we write them or not. The race is about whether those rules are made with us or simply applied to us. The Continental Strategy proves we can show up with a plan. Now we have to prove we can enforce one.