Laws and regulation

Basics

Find out which laws, rules and policies apply to the AI tool in each country where it will be used. The main ones are data protection law, any AI-specific law or strategy, and sector rules such as those for health data or bulk messaging src-032 p10; src-012 p20; src-013 pp8-9. Check national law, not only international frameworks such as the EU AI Act or GDPR (the EU's General Data Protection Regulation) src-025 pp18, 37; src-037 pp35-36. These rules change quickly, so the answer needs checking again during the project src-012 p20; src-010 p3.

A Stage 0 review should also cover government policies and national strategies that the tool could support or clash with src-010 p3; src-013 p9.

Why it matters for AI tools

Teams that do not understand the technology they are using can break data privacy or AI rules without knowing it src-012 p22. Many AI tools send prompts and documents to a provider abroad. That raises questions about where data is stored, whether it is used to train the provider's models, and whether a foreign government could demand access to it src-011 pp7, 12-13. Sanctions or export controls can stop staff or partners in some countries from using a tool at all src-011 p7. A government ban on a provider can cut off the service and the data held in it src-011 p8.

Breaking the law can bring fines, a forced shutdown, or harm to young users src-037 p36. Some rules also block a delivery channel: in some places, regulators limit automated outbound calls at unsocial hours, and those may be the only hours when some women have a phone src-018 p22. AI tools that people with poor connectivity or a disability struggle to use can also create legal risk, for example in hiring decisions that affect disabled people src-024 p6.

What good evidence looks like

• The proposal names the data protection law in each country of use, for example Kenya's Data Protection Act 2019 or India's Digital Personal Data Protection Act 2023, and says what it requires of the project src-014 p46; src-028 p28.
• It lists AI-specific laws, strategies or codes that apply, such as a national AI strategy or a national standards body's AI code of practice src-013 p9.
• It maps where data is stored and where it moves, across every country involved src-032 p11; src-011 p7.
• It records the contract terms with any AI provider on data residency, use of data for model training, and the data processing agreement (the contract setting out how the provider handles personal data) src-011 pp7, 12.
• It covers sector and channel rules, such as licences for bulk SMS, ID rules for SIM registration, or limits on automated calls src-032 p10; src-018 p22.
• It includes legal advice from a qualified lawyer in each jurisdiction, or a plan to get it src-028 p29; src-032 p11; src-037 p36.
• It states whether a risk or rights assessment is required for the intended use, and whether one has been done src-011 p13; src-024 pp6-7.
• It explains how consent will be obtained and how the law's consent rules will be met src-028 pp28-29.

How to find out

Desk review of national data protection laws, AI strategies, sector regulations and published legal trackers src-013 p8; src-037 p36. Legal advice from a licensed lawyer in each country, including pro bono counsel where budgets are small src-028 p29; src-032 p11. A map of data storage and data flows through the project src-032 p11. Published risk and compliance tools, such as the US NIST AI risk management framework or an EU AI Act compliance checklist, used as prompts rather than as a substitute for local law src-012 p25; src-024 p6. Questions put directly to AI providers on data residency, training use, sanctions and compliance with each country's law src-011 pp7, 12-13. Conversations with local actors already working on the problem, to learn which government policies and strategies apply src-010 p3.

Limits and disagreements

Several sources name EU and international frameworks first. The NetHope toolkit lists the EU AI Act, GDPR and OECD principles, and mentions local law only later, as a deployment check src-025 pp18, 37. The NetHope PESTLE guide is wider but still leads with EU, UK and US law src-011 p12. The NIST playbook draws its legal examples from the United States src-024 pp6-7. Funders working in low- and middle-income countries may need to ask for local legal review explicitly.

Country detail is thin. Kenya appears through two IREX documents src-013 p9; src-014 pp45-46, India through one playbook src-028 pp28-29, and South Africa and Rwanda through a passing mention src-037 p35. The India material describes draft rules that were under consultation when the playbook appeared, so it may be out of date src-028 p29.

Sources disagree on what counts as enough. The Pollicy handbook argues that ethics codes set by companies cannot protect rights on their own, and that legislation alone covers only harms that can be proven src-035 pp8-9. It also argues that individual consent is given too much weight and that rights over data can be collective as well as individual, a view drawn from African traditions and taken up in the African Union's data policy framework src-035 pp6, 15. The India playbook, by contrast, treats explicit individual consent as the core legal duty src-028 p28.

Several points rest on older or non-AI sources. SIMLab dates from 2018 and covers SMS and mobile projects src-032 pp10-11. The Girl Effect safeguarding guide is also from 2018 and is not about AI src-037 pp35-36. Both Girl Effect sources src-012 p20; src-037 p35 share authors with other MTI-linked sources, so their agreement with each other is less independent than it looks. The point about automated calls comes from a single EDiT guide on digital access, not from AI work src-018 p22.

Practitioner detail

Three forms of regulation are worth separating: law made and enforced by the state, self-regulation by companies or industry bodies, and co-regulation, where industry sets standards inside legal goals under state supervision src-035 pp8-9. A proposal that relies on a provider's own code is relying on the weakest of these src-035 p9.

Kenya's Data Protection Act 2019 sets principles such as purpose limitation and data minimisation, and gives people rights to see, correct and delete their data src-014 p46.

Where national law conflicts with EU or UK law, organisations may need specific advice on which to follow src-037 p36; src-032 p11. Health data and other personal data often carry extra rules that should be scoped early src-032 p21.