What is AI regulation in Liberia?
AI regulation: countries and regions
Liberia has no dedicated artificial intelligence law, AI regulator or binding AI rules. As of mid-2026 the country also has no enacted data protection statute; a Personal Data Protection bill was submitted to the Legislature but is not yet in force. AI questions are handled indirectly through the telecoms regulator (the Liberia Telecommunications Authority), a national digital strategy, a cybercrime bill and regional African Union and ECOWAS frameworks.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Liberia is at an early, policy-led stage of AI governance. There is no statute that defines artificial intelligence, no AI-specific regulator, and no binding duties such as risk classification, transparency obligations or mandatory impact assessment. What exists is a mix of digital strategy documents, a telecoms regulator with a general mandate, pending legislation on data and cybercrime, and regional commitments through the African Union and ECOWAS.
The closest thing to data governance today is found in policy rather than enacted law. Section 5.15.1 of Liberia's National Information and Communications Technology Policy (2019 to 2024) sets out fair-processing principles for personal data, but a policy is not an enforceable statute. A standalone Personal Data Protection bill, developed by the Ministry of Posts and Telecommunications with EU and Internews support, was validated by stakeholders and submitted to the Legislature, but it has not been enacted.
So if you are deploying AI in Liberia, you are operating in a space governed by general law, sector rules (such as Central Bank of Liberia payment rules), telecoms regulation, and regional instruments, rather than by a bespoke AI regime.
Why it matters
For organisations, the absence of a dedicated framework cuts both ways. There are no AI-specific licensing hurdles or conformity assessments to clear, which lowers the barrier to deployment. But there is also little legal certainty: no statutory definition of personal data, no data protection authority to give guidance or adequacy decisions, and limited recourse for individuals harmed by automated decisions. That uncertainty is itself a risk, especially for regulated sectors, cross-border data flows and any system processing sensitive personal data. Liberia's own government and development partners have framed the lack of a data protection framework as a source of legal uncertainty that can impede trade and innovation. Forward-looking organisations should expect the rules to tighten as the data protection bill, the cybercrime bill and African Union-aligned strategies mature, and should build to the higher regional and international standard now rather than retrofit later.
How it works
No dedicated AI law or regulator
There is no Liberian statute governing artificial intelligence and no body designated to regulate it. AI is not defined in law, and there are no binding obligations specific to AI developers or deployers. Government activity to date is capacity-building and policy framing rather than regulation. The United Nations Development Programme launched a UNDP AI Sprint in November 2025, during which approximately 70 government officials received foundational AI training organised around the state's roles as regulator, user and enabler. Separately, the AI Challenge Liberia 2025, launched at the EJS Ministerial Complex in Monrovia under the patronage of President Joseph Nyuma Boakai and First Lady Kartumu Y. Boakai, is an open competition inviting individuals, teams and firms to submit innovative entries and build local talent.
The telecoms regulator: the Liberia Telecommunications Authority
The Liberia Telecommunications Authority (LTA) is an independent commission established by the Telecommunications Act of 2007. Its mandate covers licensing telecommunications operators, managing radio spectrum and numbering, regulating competition and interconnection, and consumer protection. It is a telecoms regulator, not an AI or data protection authority. Its most relevant data-adjacent activity is the SIM card registration regime: working with the National Identification Registry, the LTA requires mobile subscribers to register SIM cards against a biometric national ID, an exercise that processes large volumes of personal and biometric data without a comprehensive data protection statute behind it.
National digital strategy and ICT policy
The Ministry of Posts and Telecommunications (MoPT) leads digital policy. The "Whole of Government" National Digital Strategy (2025 to 2029) is built on three pillars: Digital Infrastructure and Cyber Security; Governance and Service; and Digital Empowerment of Citizens and Businesses. It commits to developing policies and legislation including a Data Protection Law, a Cybercrime Act and a new National ICT Policy, and proposes a dedicated implementation institution, a Liberia Digital Transformation Agency, to be established by legislation. The strategy references responsible data use but does not itself create AI rules or enforceable AI duties.
Data protection: policy now, statute pending
Liberia has no enacted data protection law. The National ICT Policy (2019 to 2024), at Section 5.15.1, sets out fair-processing principles, but these are policy commitments, not enforceable statutory rights. A standalone Personal Data Protection bill (titled "An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia"), developed by MoPT with EU and Internews support, was validated by stakeholders in December 2024 and submitted to the Legislature by President Joseph Boakai. As of the most recent authoritative status (the Data Protection Africa factsheet, last updated 28 January 2026), there is still no data protection law in force and no data protection authority appointed.
Cybercrime legislation
A Cybercrime Act of 2025 passed the Liberian Senate with amendments on 4 November 2025, on a review report presented by the Committee on Posts and Telecommunications. The Senate then communicated its concurrence to the House on Thursday in January 2026, which (per reporting) "effectively clears the way for the bill to be forwarded to President Joseph Nyuma Boakai for signature"; the Act "awaits presidential assent." As of mid-2026 there is no confirmed report that the President has signed it, so it should be treated as awaiting assent rather than in force. The bill provides for a Liberia National Cyber Security Council and commits Liberia to acceding to the Budapest Convention and the African Union's Malabo Convention.
Regional context: ECOWAS and the African Union
Liberia is a member of ECOWAS and the African Union, and regional instruments fill some of the domestic gap. The ECOWAS Supplementary Act on Personal Data Protection (2010) is a binding regional instrument that requires member states to enact data protection laws and establish data protection authorities; in practice it is relied on in Liberia as a secondary source rather than fully domesticated. At continental level, the African Union adopted its Continental Artificial Intelligence Strategy in July 2024, a non-binding framework that encourages member states to develop national AI strategies and strengthen data governance. The AU's Malabo Convention on cyber security and personal data protection entered into force in June 2023, but Liberia is not among its ratifying states.
Examples
Telecoms and identity data: An operator complying with the LTA's SIM registration rules collects biometric and identity data verified against the National Identification Registry. Because there is no data protection statute, the controls on that data come from contracts, LTA regulations and sector practice rather than a privacy law with enforceable data-subject rights.
Public-sector AI capacity building: Through UNDP support, Liberian ministries are being introduced to AI for service delivery and decision support, alongside plans to establish a master's programme in Artificial Intelligence and Cybersecurity at the University of Liberia and to scale digital and AI skills training for youth, targeting 50,000 young people. This is governance readiness and skills development, not deployment under a regulatory regime; any AI used in government currently operates without AI-specific statutory safeguards.
Cross-border data transfer: A company moving personal data out of Liberia has no domestic transfer statute to follow. In practice the ECOWAS Supplementary Act is treated as the reference point, restricting transfers outside the region unless the destination offers an adequate level of protection.
Common misunderstandings
"Liberia has an AI law." It does not. There is no AI statute, no AI regulator and no binding AI-specific duties.
"The LTA regulates AI." The LTA is the telecoms regulator under the Telecommunications Act of 2007. It is not an AI authority or a data protection authority.
"Liberia has a data protection act in force." It does not. A bill exists and has been submitted to the Legislature, but as of early 2026 no data protection law was enacted and no data protection authority existed.
"The African Union AI Strategy is binding on Liberia." It is not. The Continental AI Strategy is a guiding framework; it does not impose binding obligations on member states.
"Liberia has ratified the Malabo Convention." It has not. The Convention entered into force in 2023 on the strength of other states' ratifications; Liberia is not among the ratifying countries.
Risks and boundaries
This article describes governance architecture, not legal advice. The central boundary is that Liberia has no dedicated AI framework: no AI definition, no regulator, no risk tiers, no mandatory AI impact assessment. The data protection bill and the cybercrime bill are both pending or awaiting assent, and their final texts, effective dates and enforcement bodies could change before they take effect. Status here is stated as of mid-2026 from the most recent official and authoritative sources available; legislative status in Liberia can move quickly, so verify current standing before relying on it. Regional instruments (ECOWAS, AU) shape expectations but do not, by themselves, give individuals enforceable domestic rights in Liberia in the absence of national implementing law.
What to do next
Do not assume a regulatory vacuum means no obligations: general law, consumer protection, sector rules (for example Central Bank of Liberia payment rules requiring local hosting or access) and contractual commitments still apply. Build your AI and data governance to a credible external benchmark now, such as the ECOWAS Supplementary Act and recognised data protection principles, so you are ready when Liberia's data protection law takes effect. Track three things specifically: enactment and entry into force of the Personal Data Protection bill (and the identity and powers of any data protection authority it creates); presidential assent to and commencement of the Cybercrime Act of 2025; and the establishment of any Liberia Digital Transformation Agency. Treat biometric and identity data (for example SIM and national ID linkages) as high risk and apply strong consent, security and minimisation practices voluntarily. Document your AI use and run impact assessments even though they are not yet mandated, because that discipline reduces legal and reputational exposure and positions you for future compliance.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Liberia have a law that regulates artificial intelligence?
No. There is no dedicated AI statute, no AI regulator and no binding AI-specific obligations in Liberia as of mid-2026.
Is there a data protection law in Liberia?
No enacted law. A Personal Data Protection bill has been developed and submitted to the Legislature, but as of early 2026 it was not in force and no data protection authority existed.
Who regulates technology and communications in Liberia?
The Liberia Telecommunications Authority (LTA), an independent commission created by the Telecommunications Act of 2007, regulates telecoms, spectrum, competition and consumer protection. It is not an AI or data protection regulator.
What rules apply to personal data right now?
Policy principles in the National ICT Policy (2019 to 2024) and, as a secondary reference, the binding ECOWAS Supplementary Act on Personal Data Protection (2010), alongside sector rules. There is no comprehensive national data protection statute in force.
Has Liberia adopted the African Union Continental AI Strategy?
Liberia is an AU member and has engaged with continental AI initiatives, but the Continental AI Strategy (adopted July 2024) is a non-binding framework; it does not create domestic legal obligations.
Is there a cybercrime law in Liberia?
A Cybercrime Act of 2025 passed the Senate on 4 November 2025 and cleared the Legislature, but as of mid-2026 there is no confirmed report of presidential signature, so treat it as awaiting assent.
Can I transfer personal data out of Liberia?
There is no domestic transfer statute. In practice the ECOWAS Supplementary Act is the reference, restricting transfers outside the region unless the destination provides adequate protection.
Should I run AI impact assessments even though they are not required?
Yes. Voluntary impact assessments and documentation reduce legal and reputational risk and prepare you for the data protection and cyber laws expected to take effect.