Coverage of African AI policy has a recurring problem: it treats the adoption of a continental framework as though it were an implementation, and then reports the absence of implementation as a failure of the framework. Continental instruments do not work that way, and expecting them to obscures the questions worth asking.
What a continental strategy can do
It can establish shared vocabulary, so that national laws drafted separately are at least commensurable. It can give a national policymaker something to point at when arguing for domestic legislation. It can create a forum in which regulators with thin capacity compare notes rather than each solving the same problem alone. It can signal a common position in international negotiations where individual states have little weight.
These are real functions and they are worth having. None of them are implementation.
Capacity is the constraint
Several African states have published national AI strategies, and a smaller number have moved toward binding instruments. The gap between those two groups is mostly not about political will. It is about whether a regulator exists that can assess an AI system, whether anyone in the ministry has the technical background to draft a testable requirement, and whether there is a budget line for enforcement.
A jurisdiction that legislates without that capacity has produced a law that will be complied with by organisations that choose to and ignored by those that do not. This is not unique to Africa — it describes the early phase of most regulatory regimes anywhere — but it is the operative constraint, and it means capacity-building is a more consequential intervention than further policy development.
Data protection as the foundation
AI governance sits on top of data protection law, and coverage across the continent is uneven: some states have comprehensive frameworks with functioning authorities, some have statutes without authorities, and some have neither. Where the foundation is absent, an AI-specific instrument has nothing underneath it — no lawful basis framework, no rights mechanism, no supervisory body to extend.
The African Union's own data protection convention has moved slowly on ratification, which is a better predictor of where AI governance can take hold than any AI-specific document.
Infrastructure decides what is buildable
Regulatory choices operate within a physical envelope. Reliable power, affordable connectivity, and access to compute determine what can be built locally and what must be rented from elsewhere. A country whose researchers train models on infrastructure in another jurisdiction has limited practical leverage over how those systems behave, whatever its statute says.
The strategies that read as serious are the ones that treat infrastructure and skills as the primary instruments and regulation as the accompaniment, rather than the reverse. That ordering is uncommon in policy documents anywhere, and it is the thing worth looking for.