AI Act outside Europe: in Nigeria, Kenya, Egypt and South Africa, existing laws are not enough to prepare for them

A comparative legal analysis shows that local data or cybersecurity rules help, without resolving issues of territorial scope or risk ranking.

The European AI Regulation does not only concern companies located in the Union: it also applies to those serving European customers, buying from European suppliers or producing results used in the EU. A published study on arXiv measures what this implies for four African countries, South Africa, Nigeria, Kenya and Egypt, through an analysis of texts, a literature review and comparative scenarios.

Conclusion: Existing national frameworks (data protection, financial regulation, cybersecurity, corporate governance) provide a useful basis, but leave unanswered the territorial scope, the role of each actor (supplier, deployer...), the level of risk, the responsibility of suppliers and access to evidence of compliance. The authors propose a seven-step approach: mapping exposure, inventorying AI systems, classifying roles and risks, organizing governance, adapting contracts, managing evidence and monitoring on an ongoing basis. They argue for proportionate and interoperable compliance rather than a uniform exercise based on Europe.