AI by country
AI by country: guides for teams starting out
Each guide covers the data law, the AI policy, where AI fits first and the first steps for a company in that country. Every fact links to its source. Not legal advice.
Africa
South Africa
South Africa has no dedicated AI law. The Protection of Personal Information Act (POPIA) is the rule that matters most today, including its section 71 on decisions made only by automated processing. The national AI policy is not in place yet: a draft was withdrawn in April 2026 and a revised version is still being prepared as of 26 October 2026.
Data law: Protection of Personal Information Act 4 of 2013 (POPIA), main provisions in force since 1 July 2020
East Africa
Kenya
Kenya has no dedicated AI law as of 26 October 2026. The Data Protection Act, 2019 is the law that applies to AI today, and the Data Protection Commissioner and the Central Bank of Kenya have both put out draft AI guidance this year. A company should work out which decisions about people it automates, what data leaves Kenya, and whether its sector regulator is about to issue new rules.
Data law: Data Protection Act, 2019, in force since 25 November 2019
North Africa
Morocco
Morocco has no AI law in force as of 26 October 2026. The rule that applies today is Law 09-08 on personal data, enforced by the CNDP, which covers automated decisions, transfers of data abroad and declarations to the regulator. A government framework law on AI is reported as a draft and we found no sign that it has been adopted.
Data law: Law 09-08 (promulgated by Dahir of 18 February 2009), in force
South Asia
Bangladesh
Bangladesh has a data protection law, the Personal Data Protection Act, 2026, but no AI law. The national AI policy is still a draft, so the data law is the main rule to plan around. Most of it is already treated as in force.
Data law: Personal Data Protection Act, 2026 (Act 63 of 2026, 10 April 2026). Mostly in force; sections 23 and 31 to 35 wait for a start date
Nepal
Nepal approved a National AI Policy in August 2025, but it is a policy, not a law, and we found no dedicated AI law as of 26 October 2026. Personal data is covered by the Privacy Act, 2075 (2018), which has consent rules and criminal penalties but no data protection regulator. Banks should also watch Nepal Rastra Bank's draft AI guidelines.
Data law: Privacy Act, 2075 (2018), in force. No separate data protection law
Sri Lanka
Sri Lanka has no dedicated AI law and, as of 26 October 2026, we found no final national AI policy. The rule that matters now is the Personal Data Protection Act, No. 9 of 2022, whose core duties for controllers and processors start on 1 January 2027. A company starting with AI has a few months to map its data and fix its contracts.
Data law: Personal Data Protection Act, No. 9 of 2022. Phased: core duties from 1 January 2027
South-East Asia
Indonesia
Indonesia has no dedicated AI law as of 26 October 2026. The rules that bite today come from the Personal Data Protection Law (Law No. 27 of 2022), which is in force, and a detailed implementing regulation that starts on 16 January 2027. The agency that will enforce the law has still not been set up, so check the current position before you build.
Data law: Personal Data Protection Law, Law No. 27 of 2022. In force. Implementing Government Regulation No. 33 of 2026 starts 16 January 2027.
Southeast Asia
Philippines
The Philippines has no general AI law as of 26 October 2026. AI projects that touch personal data are covered by the Data Privacy Act of 2012 (RA 10173) and a December 2024 National Privacy Commission advisory on AI. Banks and other BSP-supervised firms also have central bank AI principles, and a House AI bill is still being drafted.
Data law: Data Privacy Act of 2012 (RA 10173), in force
Vietnam
Vietnam has a dedicated Law on Artificial Intelligence, in force since 1 March 2026, and a Law on Personal Data Protection, in force since 1 January 2026. Together they set risk tiers for AI systems, labelling duties and rules on moving personal data abroad. Banks face a new State Bank circular that takes effect on 15 November 2026.
Data law: Law No. 91/2025/QH15, in force since 1 January 2026
West Africa
Nigeria
Nigeria has no standalone AI law as of 26 October 2026. The rules that apply today come from the Nigeria Data Protection Act 2023 and the NDPC's 2025 General Application and Implementation Directive (GAID), which has an article on AI. Plan for impact assessments, human review of automated decisions and careful handling of data sent abroad before you build or buy anything.
Data law: Nigeria Data Protection Act 2023, in force; GAID 2025 effective 19 September 2025
Not sure where your team stands?
Take the free five-minute AI readiness assessment, or talk to an engineer.
