What is AI regulation in Gabon?
AI regulation: countries and regions
Gabon has no dedicated artificial intelligence law or AI regulator as of June 2026. AI is governed indirectly through existing instruments: the personal data protection law (Law 001/2011, as modified by Law 025/2023), enforced by the Authority for the Protection of Personal Data and Privacy (APDPVP); the telecoms regulator ARCEP; and cybersecurity and electronic transactions laws. A national AI strategy, supported by UNESCO, is under development but not yet adopted.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
There is no single statute in Gabon that says "this is how AI must be built or used". Instead, anyone deploying AI in Gabon must work within laws that already exist for data, telecommunications and cybersecurity. The most important of these is the personal data protection law, originally Law 001/2011 of 25 September 2011 and substantially rewritten by Law 025/2023, which is enforced by an independent regulator now called the APDPVP.
That data law matters for AI because it was modernised to include concepts that sit at the heart of machine learning. Its definitions section expressly covers terms such as algorithm, machine learning, supervised and unsupervised learning, and data protection impact assessment. It also gives individuals a right to object to decisions taken solely by automated processing, including profiling, and a right to obtain human intervention.
Alongside this, the government has begun building AI policy. With UNESCO support it created a National Technical Committee for AI (CTN-IA) and completed a readiness assessment that is intended as the foundation for a future national AI strategy. That strategy is still being prepared, not yet adopted.
Why it matters
For organisations deploying or governing AI in Gabon, the practical point is that compliance duties are real even though no AI-specific law exists. If your system processes personal data, and most useful AI does, you fall squarely under Law 025/2023 and the supervisory powers of the APDPVP. That means lawful basis, transparency, security, declaration or authorisation of processing, and limits on purely automated decisions. The APDPVP has shown it conducts on-site inspections and requires registration of processing, so the gap between "no AI law" and "no obligations" is wide and easy to misjudge. Reading Gabon as a regulatory vacuum is a mistake: the architecture is data protection, telecoms and cybersecurity law, applied to AI use cases.
How it works
No dedicated AI statute yet
As of June 2026, Gabon has not enacted a law that regulates AI as such, and has not created an AI regulator. Gabon's own telecoms regulator has stated plainly that there is no regulatory framework specific to AI in the country, only legal provisions that have an indirect bearing on it. This is the honest starting point: AI is regulated in Gabon by general law, not special law.
The data protection law (Law 001/2011, modified by Law 025/2023)
The backbone of AI-relevant regulation is personal data protection. The founding statute is Law 001/2011 of 25 September 2011. It was significantly modernised by Law 025/2023, adopted on 9 July 2023, promulgated by Decree 166/PR of 12 July 2023 and published in the Journal Officiel No. 218 Bis of 15 July 2023. The revised law applies to public and private bodies and to processing carried out on Gabonese territory or using means located there, with a duty for foreign controllers to designate a local representative in some cases.
Two features make this law directly relevant to AI. First, its definitions section expressly defines algorithm, machine learning, supervised learning, unsupervised learning, reinforcement learning and data protection impact assessment. Second, Articles 66 to 68 give a person the right to object to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects, and a right to obtain human intervention, to express a view and to contest the decision. These are recognisably similar to European data protection concepts.
The data regulator: APDPVP
Law 025/2023 transformed the former Commission Nationale pour la Protection des Donnees a Caractere Personnel (CNPDCP) into the Autorite pour la Protection des Donnees Personnelles et de la Vie Privee (APDPVP). The APDPVP is an independent administrative authority. It informs controllers and individuals of their rights and duties, authorises or receives declarations of processing, issues standards and regulations, conducts inspections and can sanction breaches. The law provides for provincial representations across the country, and the authority reports annually to the President, government and Parliament.
The telecoms regulator: ARCEP
The Autorite de Regulation des Communications Electroniques et des Postes (ARCEP) regulates electronic communications and postal services. It was created by Ordinance 000008/PR/2012 of 13 February 2012, ratified by Law 006/2012 of 13 August 2012, and is governed by a Regulation Council. ARCEP is not an AI regulator, but it is relevant because AI is increasingly embedded in network operation, and ARCEP has described a shift towards "regulation by data" and is exploring AI for tasks such as automated handling of operator declarations.
Cybersecurity and electronic transactions
Two further laws complete the digital framework. Law 027/2023 of 12 July 2023 regulates cybersecurity and the fight against cybercrime, imposing security duties on public and private organisations. Law 025/2021 of 28 December 2021 regulates electronic transactions, recognising electronic signatures and electronic commerce. Neither targets AI, but both shape the environment in which AI systems handling data and transactions must operate.
Emerging AI policy and institutions
On the policy side, the government, with UNESCO support, launched the UNESCO Readiness Assessment Methodology (RAM) in December 2023, initiated by the Ministry of New Technologies, Information and Communication, and created a National Technical Committee for AI (CTN-IA). The RAM final report was presented to the Prime Minister in January 2024 and is described by the Prime Minister's office as the foundation of a future national AI strategy. Gabon also hosts the Centre Gabonais de l'Innovation (CGI), accredited by the ITU as an AI acceleration and innovation centre and counted among 17 such centres worldwide. Lead responsibility for digital and AI policy now sits with the Ministry of Digital Economy, Digitalisation and Innovation.
Central African and African Union context
Gabon's framework also sits within continental instruments. Gabon ratified the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention), which entered into force on 8 June 2023 after Mauritania became the fifteenth state to ratify under Article 36. The African Union Executive Council endorsed the Continental Artificial Intelligence Strategy at its 45th Ordinary Session in Accra, Ghana, on 18 to 19 July 2024, encouraging member states to develop national AI approaches anchored in data governance. Gabon's national strategy work is being framed as aligned with these instruments.
Examples
Automated decisions in hiring or credit. A company in Libreville using an algorithm to screen job applicants or score credit applicants is operating under Articles 66 to 68 of Law 025/2023. If a decision is based solely on automated processing and significantly affects a person, that person can demand human intervention and contest the result, and the controller must build in safeguards.
Workplace monitoring and biometrics. The data authority has issued standards and acted on processing such as geolocation of vehicles and biometric or attendance systems. An organisation deploying AI-assisted video analytics or biometric access control must declare or seek authorisation for the processing and meet security duties, as the APDPVP carries out on-site inspections of such systems.
Election-period data use. Ahead of the 2025 electoral cycle, the APDPVP required political parties and independent candidates to file simplified compliance declarations and ran field inspections to check how voter data was being collected and used. AI-driven targeting or analysis of voter data would fall under this same supervision.
Common misunderstandings
"Gabon has an AI law." It does not. As of June 2026 there is no dedicated AI statute and no AI regulator. AI is governed through data protection, telecoms and cybersecurity law.
"No AI law means no rules." Wrong. Most AI processes personal data, which triggers the full force of Law 025/2023 and the APDPVP's powers, including limits on automated decision-making.
"The national AI strategy is already in force." It is not. The UNESCO readiness report is a foundation document; the strategy itself is still under development and has not been adopted.
"The data regulator is still called the CNPDCP." The CNPDCP was replaced by the APDPVP under Law 025/2023. The older name still appears in legacy documents.
"The Malabo Convention or the AU strategy directly regulates companies in Gabon." These are continental instruments that shape national law and policy; they do not themselves impose directly enforceable duties on individual organisations in the way the national data law does.
Risks and boundaries
This article describes a framework that is partly settled and partly in motion. What is confirmed: Gabon has a modernised data protection law (Law 025/2023), an independent data authority (APDPVP), a telecoms regulator (ARCEP), cybersecurity and electronic transactions laws, and has ratified the Malabo Convention. What is pending or uncertain: there is no dedicated AI law, no AI regulator, and no adopted national AI strategy; the strategy remains under development. Transition periods and detailed implementing rules under Law 025/2023 may still be set by the regulator. This is not legal advice; specific obligations depend on the processing involved, and organisations should verify current requirements directly with the APDPVP. Penalty levels and enforcement practice can change as the authority matures.
What to do next
Treat the data protection law as your primary AI compliance instrument. Map where your AI systems process personal data, then check lawful basis, transparency, security and declaration or authorisation duties under Law 025/2023. Pay particular attention to any solely automated decisions that significantly affect people, and build in human review, the ability to contest, and an impact assessment where risk is high. Register relevant processing with the APDPVP and keep a record of processing activities. Watch for the national AI strategy and any implementing rules, since these will shape future duties. If you operate regionally, align your Gabon approach with the broader African Union data and AI direction so you are not caught out by convergence.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Gabon have a dedicated AI law?
No. As of June 2026 there is no AI-specific statute and no AI regulator. AI is governed through existing data protection, telecoms and cybersecurity law.
Which law matters most for AI in Gabon?
The personal data protection law, Law 001/2011 as modified by Law 025/2023, because most AI processes personal data and the law covers automated decisions and machine learning concepts.
Who is the data protection regulator?
The Autorite pour la Protection des Donnees Personnelles et de la Vie Privee (APDPVP), an independent authority created by Law 025/2023 to replace the former CNPDCP.
Does Gabon restrict automated decision-making?
Yes. Under Articles 66 to 68 of Law 025/2023, a person can object to a decision based solely on automated processing, including profiling, where it has significant effects, and can require human intervention.
Is there a national AI strategy?
Not yet. With UNESCO support Gabon completed a readiness assessment and created a National Technical Committee for AI, but the strategy itself is still under development.
What is ARCEP's role in AI?
ARCEP regulates electronic communications and posts, not AI. It is relevant because AI is used in networks, and it has signalled a move towards regulation by data.
Has Gabon signed continental data and AI instruments?
Gabon ratified the African Union Malabo Convention, which entered into force in June 2023, and is a member state under the AU Continental AI Strategy endorsed in July 2024.
What should companies do now?
Treat Law 025/2023 as the operative AI compliance instrument, register relevant processing, manage automated decisions carefully and monitor the forthcoming national AI strategy.