African regulators are meeting in Douala to discuss rules for AI and other transformative technologies. But setting rules and controlling the technology are not the same thing.
Three anchors to enter the analysis without losing the thread.
01
AI is a chain, not one product
A meal needs ingredients, a kitchen, energy, cooks, recipes, equipment and a way to serve customers.
02
Regulation sets the rules of the field
Traffic law works even when cars are imported.
03
Four different kinds of power matter
A third is purchasing power. Governments and large companies can shape markets through what they choose to buy.
Imagine a country that manufactures no cars.
It can still set speed limits, require seat belts, inspect imported vehicles and decide how people may drive on its roads.
It does not need to build cars to write traffic rules.
But there is a limit.
If the vehicles, spare parts, embedded software and manufacturing standards are all designed elsewhere, the country controls how cars are used locally. It does not control the whole industry behind them.
Artificial intelligence raises a similar question.
From 29 September to 2 October 2026, Douala is hosting an ITU regional workshop on digital regulation for transformative technologies in Africa. Cameroon's Telecommunications Regulatory Board says about 100 participants from 17 countries are discussing AI, data governance, cybersecurity, collaborative regulation and regulatory sandboxes.
Africa is already writing and discussing rules.
The harder question is how much power rules provide when much of the underlying technology is still produced elsewhere.
AI is a chain, not one product
Think about a restaurant.
A meal needs ingredients, a kitchen, energy, cooks, recipes, equipment and a way to serve customers.
Saying “I control the restaurant” means something different if you only own the dining room, if you own the kitchen, or if one supplier can stop all your ingredients tomorrow.
AI also has layers.
There is data. There is computing infrastructure. There are chips and data centres. There are trained models. There are cloud platforms. And there are the applications people actually use.
A country can be strong in one layer and dependent in another.
Global data shows how concentrated some of those layers remain. Stanford's 2026 AI Index reports that industry produced more than 90 percent of notable frontier models in 2025. The same report highlights physical concentration in infrastructure: the United States hosts by far the largest number of AI data centres, while production of leading-edge AI chips remains heavily dependent on a small number of manufacturers, especially TSMC.
Those numbers do not mean Africa is destined to remain a customer. They show why “building an AI application” and “controlling the critical layers that make it possible” are different levels of capability.
That is why technological sovereignty cannot be reduced to owning a local chatbot.
Regulation sets the rules of the field
Traffic law works even when cars are imported.
AI regulation can impose obligations around data protection, safety, discrimination, transparency, accountability and sensitive uses.
That is real power.
The African Union adopted a Continental AI Strategy in 2024 that covers infrastructure, skills, data, governance and risk, while encouraging member states to develop national strategies.
But law does not manufacture chips or data centres.
It can define what is allowed. It cannot, by itself, create an alternative supplier.
Four different kinds of power matter
One is the power to decide what is legal.
Another is the power to build.
A third is purchasing power. Governments and large companies can shape markets through what they choose to buy.
The fourth is the power to leave.
An organisation has more leverage when it can change providers without rebuilding everything.
These powers do not always sit in the same place.
A state can have strong legal authority while relying on foreign cloud and models. A local company can build an excellent product while depending on an external model. A market can influence global providers even if it does not manufacture the technology.
Europe shows that rules can travel
Columbia law professor Anu Bradford uses the term “Brussels Effect” to describe how European rules can influence companies outside Europe.
The basic mechanism is easy to understand.
If a manufacturer sells the same product into many markets and one very large market imposes a strict standard, it may be cheaper to apply that standard everywhere than maintain different versions.
A local rule can therefore have global consequences.
Africa's demographic scale gives it potential leverage, but population is not the same thing as an integrated market. Regulation, payments, infrastructure, language and purchasing power remain fragmented.
Turning size into bargaining power requires coordination.
Sometimes the rule is already inside the machine
Lawrence Lessig popularised the phrase “code is law”.
The point is not that software replaces legislation.
Imagine a car park barrier that physically refuses to open after 10 p.m.
A sign can state the closing time. The barrier makes the rule executable.
Digital systems also contain rules in their architecture.
A platform can make data export easy or difficult. An API can force every developer into a particular format. A model can refuse certain requests before any human decision is made.
Some of the power around AI therefore lives in technical choices made outside African regulatory institutions.
Law can govern those choices, but first it needs to understand where they exist.
Regulatory sandboxes are a way to learn before freezing the rules
A sandbox is easier to understand as a learner's permit.
A new driver is allowed to practise under specific conditions before receiving full freedom on the road.
A regulatory sandbox gives an innovative product a limited environment in which it can operate while regulators observe real risks and behaviour.
This is useful for fast-moving technology.
But a sandbox is not an industrial strategy.
It helps a regulator learn. It does not automatically create infrastructure, companies or local alternatives.
Dependence is not automatically failure
No modern country produces every technology it uses.
The useful question is not whether Africa can become completely independent.
It is which dependencies are acceptable and which become dangerous when concentrated in one provider.
Using foreign software can be perfectly rational.
The problem changes when data cannot be exported, prices can rise without alternatives or an outage can stop a critical public service.
That is the difference between having a preferred baker and discovering that the same baker owns the only mill, the only delivery road and the key to your kitchen.
Infrastructure gives rules more weight
A rule becomes stronger when there is a credible alternative.
If an administration requires sensitive data to stay local, reliable local infrastructure must exist.
If it requires portability, standards and alternative providers must be able to receive that data.
If it wants AI systems audited, people with the skills to perform those audits are necessary.
Sovereignty is therefore not built in law alone.
The African Union's Data Policy Framework already takes a similar approach to data. It does not simply argue that data should be trapped inside national borders. It calls for common governance that can enable trusted data flows while strengthening African capacity to host, manage, protect and create value from data.
That distinction matters. A closed digital border is not automatically sovereign if the country behind it still depends entirely on foreign software, cloud infrastructure and expertise. An open system can retain meaningful agency when data is portable, suppliers are replaceable and local capabilities are strong.
Sovereignty is also built in universities, data centres, procurement, research, networks and companies.
Africa does not have to choose between regulation and innovation
The debate is often presented as a choice.
One side wants stronger safeguards. The other fears that regulation will slow local innovation.
Both concerns can be legitimate.
Weak rules can expose citizens to unsafe or discriminatory systems. Poorly designed rules can also impose costs that local startups struggle to absorb while global companies handle them easily.
The central question is therefore proportionality, sequencing and implementation capacity.
The Douala workshop is about AI, data, cybersecurity and regulatory tools.
But the deeper question is about power.
When Africa says it wants a voice in AI governance, does that mean a voice in international discussions, authority over local use, leverage over suppliers, the ability to build alternatives, or enough capacity to say no when a dependency becomes unacceptable?
Those are different forms of power.
Real technological sovereignty may begin not when every dependency disappears, but when those dependencies are visible, diversified and negotiable.
Sources and method
Facts that may change over time were checked against the sources below. Observations and interpretations are presented as such in the article.
What if the best way to learn AI is to begin with an annoying real task? An essay on practical use, judgement, learning and the ordinary moments where AI becomes genuinely useful.
