The EU's AI Act reaches Africa — without Africa's input
The EU's AI certification framework directly affects systems deployed across Africa: mobile credit scoring, e-ID, fraud detection. Five countries must align. The African Union has its own answer.
Severity
2Affected country
NGSector
Technology & cloudPublished
22 May 2026
Our score measures operational relevance to Africa — not the global virality of the story.
Contents · 5
The problem at a glance
The European Union has just published its first certification scheme for "high-risk" AI systems. The timeline is not Brussels' alone: Nigeria, Egypt, South Africa, Morocco and Kenya each have digital adequacy agreements under negotiation with the EU. For these five countries, the European standard is no longer optional.
What "high-risk" actually means in Africa
The European definition covers AI systems used in education, employment, essential services and biometrics. Applied to the continent, that includes:
— Wave and M-Pesa's credit scoring engines, which categorise millions of unbanked people. — e-ID systems rolling out in Nigeria (NIN), Kenya (Huduma Namba) and Ghana (Ghana Card). — Fraud detection engines at West African central banks.
These systems will face transparency, audit and documentation obligations that their operators have not planned for.
The African Union plays its hand
This is not a capitulation. The AU is finalising its African AI Framework (AAF) for the July 2026 summit. The text diverges from EU rules on one central point: training data sovereignty.
The AU wants models deployed on the continent to be trained — at least in part — on African data, and for that data to remain under local jurisdiction. The EU has no comparable provision. This disagreement is unresolved.
Why this is a cybersecurity issue
The audit obligations imposed by the EU AI Act require access to models and their training data. For systems supplied by third parties (typically European or American), that access runs through interfaces that African operators do not control.
In practice: if a credit scoring system deployed in Senegal must be audited for EU compliance, the auditor accesses sensitive data on Senegalese citizens through infrastructure not under Senegalese authority. The exposure vector is real.
What is happening now
Nigeria and Morocco's ICT ministries have been in consultation with Brussels counterparts since Q1 2026. Rwanda, an active observer, is already adapting its national AI framework to anticipate convergence.
For others, the risk is being forced to retroactively apply standards they had no role in writing — as happened with GDPR between 2018 and 2022.
— ◆ —