What is AI regulation in Mali?
AI regulation: countries and regions
Mali has no dedicated artificial intelligence law, bill or AI regulator. AI is governed indirectly, mainly through Law No. 2013-015 of 21 May 2013 on the protection of personal data, enforced by the Autorite de Protection des Donnees a caractere Personnel (APDP), plus the telecoms and ICT regulator (AMRTP) and a national digital economy policy. Mali sits inside the African Union context but is currently suspended from the AU and has left ECOWAS.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
There is no AI Act in Mali and no published draft AI statute. If you build or deploy AI in Mali, you are not following an AI-specific rulebook; you are following general laws that happen to apply to AI, above all the personal data law of 2013.
That law, Law No. 2013-015, sets out data protection principles familiar from other regimes: lawful and fair collection, defined purposes, proportionality, accuracy, retention limits, security, and rights of access, rectification and objection. It created an independent authority, the APDP, to authorise processing, hear complaints, run inspections and impose sanctions. Mali has also created a public Centre for Artificial Intelligence and Robotics (CIAR-Mali) and validated a national digital economy policy, but these are capability-building measures, not binding AI regulation.
The honest position is that Mali regulates the data and telecoms that AI runs on, and the broad legal duties around automated decisions, rather than AI as a distinct legal category.
Why it matters
For organisations, the absence of an AI law does not mean an absence of obligations. Almost every practical AI system processes personal data, and that triggers the 2013 law and the APDP's powers. Mali operates a declaration and authorisation model: many processing operations must be declared to or authorised by the APDP before they run, and fees apply per filing. The APDP has become more active in enforcement: in connection with its 6 October 2025 extraordinary session reviewing roughly 2,000 declaration files, it was reported to have issued more than a hundred formal notices (mises en demeure) to companies for non-compliance with personal data obligations, and it has imposed fines. Article 2 of the law also restricts purely automated decisions that produce legal effects or profile a person, which is directly relevant to scoring, profiling and automated eligibility systems. Getting data governance right is therefore the main compliance lever for AI in Mali today, and the durable architecture (principles, an independent authority, declaration duties, sanctions) is unlikely to disappear even if a dedicated AI text eventually arrives.
How it works
The core instrument: Law No. 2013-015
Law No. 2013-015 of 21 May 2013 protects personal data in Mali. It applies to any processing carried out wholly or partly on national territory and binds public bodies, local authorities, private companies and individuals (with a narrow personal or household exemption). It sets out core principles in Article 7 (lawful, fair and non-fraudulent collection for specified, explicit and legitimate purposes; proportionality; accuracy; limited retention), a security duty (Article 8), tighter rules for sensitive data (Article 9), and restrictions on transfers abroad unless the destination ensures an adequate level of protection (Article 11). Individuals have rights of access and rectification (Articles 12 to 14), a right to be informed (Article 15) and a right to object (Article 19). The law was amended in 2017.
The regulator: APDP
Article 20 creates the Autorite de Protection des Donnees a caractere Personnel as an independent administrative authority. It has a 15-member college serving a single seven-year term. Its missions (Article 31) include setting norms for collection and processing, authorising data interconnection and transfers, advising data subjects and controllers, receiving and investigating complaints, carrying out inspections, imposing administrative sanctions, and referring offences to the public prosecutor. The APDP began operating around 2016. It also advises government on draft laws and decrees touching personal data, which is the channel through which AI-related data questions would normally reach a regulator in Mali. Awareness remains a constraint: in 2023 the APDP reported receiving only about twenty complaints, a figure attributed to many citizens not knowing their data protection rights.
Declarations, authorisations and sanctions
Controllers must declare intended processing to the APDP (Article 57), and some operations need prior authorisation. Administrative sanctions (Article 61) run from warnings and formal notices to orders to stop processing and withdrawal of approval. Financial penalties under Articles 65 and 66 reach from 2.5 million to 20 million CFA francs, alongside possible criminal penalties. Notably, entrave (obstructing an APDP inspection) is itself sanctionable.
The telecoms and ICT regulator: AMRTP
The Autorite Malienne de Regulation des Telecommunications, des Technologies de l'Information et de la Communication et des Postes (AMRTP) regulates telecoms, ICT and postal services. It was created by Ordinance No. 2011-024/P-RM of 28 September 2011 regulating the telecommunications and postal sector, replacing the Comite de Regulation des Telecommunications (CRT) that had been set up in 1999 by Ordinance No. 99-043/P-RM. It is an independent administrative authority. It licenses operators, manages the .ml domain, handles type approval of equipment and oversees the connectivity layer that AI services depend on. It does not regulate AI as such.
National digital strategy and AI capability
Mali has institution-building rather than AI law. The government created CIAR-Mali (Centre d'Intelligence Artificielle et de Robotique du Mali) by Ordinance No. 2023-022/PT-RM of 4 August 2023, a public scientific and technical body for AI and robotics research and training. In October 2024 the Ministry responsible for the digital economy validated a national digital economy policy (Politique Nationale de Developpement de l'Economie Numerique) and action plan covering 2025 to 2029, which explicitly references artificial intelligence and cloud computing; it was validated at official level rather than adopted by decree. In February 2025 CIAR-Mali and the APDP signed a cooperation agreement framed around ethical AI development.
Regional and continental context
At the continental level, the African Union endorsed a Continental Artificial Intelligence Strategy in 2024, a non-binding, development-focused framework built on five focus areas (harnessing AI benefits, building capabilities, minimising risks, fostering cooperation, and stimulating investment) that asks member states to adopt national AI approaches. Mali is an AU member but has been suspended from AU activities since 2 June 2021, when the AU Peace and Security Council's 1001st meeting decided "to immediately suspend the Republic of Mali from participation in all activities of the African Union, its Organs and institutions, until normal constitutional order has been restored in the country". Mali also withdrew from ECOWAS effective 29 January 2025; the ECOWAS Commission confirmed that, under Article 91 of the Revised ECOWAS Treaty, the three withdrawing countries would "officially cease to be members of ECOWAS from January 29, 2025". Mali now sits in the Alliance of Sahel States. Mali has not ratified the AU's Malabo Convention on Cyber Security and Personal Data Protection.
Examples
Direct marketing and SMS campaigns: an APDP deliberation of 16 August 2023 sets conditions for direct prospecting, including a ban on sending marketing SMS and using automated calling between 19:00 and 08:00 and on Sundays and public holidays. An AI-driven outreach tool used in Mali must respect these timing and consent rules.
Workplace and HR systems: the APDP treats payroll, attendance and personnel files as processing that must be declared or authorised, with filing fees. An employer deploying AI-based HR analytics would need to complete these formalities before running the system.
Video surveillance: in 2025 the APDP imposed a 5 million CFA franc fine on the Clinique medicale Kouakou in Missabougou, Bamako, under Article 65 of Law No. 2013-015, for entrave (obstruction) of an inspection of an illegally installed video surveillance system. AI features such as facial recognition added to such cameras would fall under the same declaration and sensitive-data rules.
Common misunderstandings
"Mali has an AI Act." It does not. There is no dedicated AI statute, bill or AI regulator. AI is governed through general data, telecoms and sector rules.
"No AI law means no rules apply." Wrong. The 2013 data protection law, the APDP's declaration and authorisation regime, and the restriction on automated decisions in Article 2 all bite on AI that uses personal data.
"The CIAR-Mali centre is a regulator." It is not. CIAR-Mali is a public research and training body for AI and robotics, not a supervisory authority with enforcement powers.
"Mali is bound by the African Union Continental AI Strategy." The strategy is non-binding guidance, not law. Mali is also currently suspended from the AU and has left ECOWAS, which weakens the regional channel.
"Because Mali signed up to African data frameworks, the Malabo Convention applies." Mali has not ratified the Malabo Convention, so it is not bound by it; the operative instrument is the national 2013 law.
Risks and boundaries
This article describes data, telecoms and policy instruments, not an AI law, because Mali has none. The framework has real limits. The 2013 law predates modern generative AI and says nothing specific about training data, model transparency or large language models. Enforcement capacity is constrained: the APDP reported receiving only about twenty complaints in 2023, suggesting low awareness rather than full compliance. Mali's political situation adds uncertainty: it is under a transition government, suspended from the AU, and outside ECOWAS, so regional harmonisation routes are disrupted. The national digital economy policy was validated at official level but is a policy, not binding regulation, and its AI provisions are aspirational. Treat any future AI-specific text as possible but unconfirmed; no draft AI bill has been published. Where status is uncertain, assume the 2013 law and APDP practice govern.
What to do next
Start from data protection: map what personal data your AI system uses and check whether it needs a declaration or prior authorisation from the APDP. Build consent, purpose limitation and retention controls in from the start, and document them. Pay attention to Article 2: if your system makes automated decisions with legal effects or profiles individuals, design in human review. Respect the direct marketing timing and consent rules. Check transfer rules before sending Malian personal data abroad, including to cloud or model providers. Treat the AU Continental AI Strategy and global norms as direction-of-travel and align voluntarily where practical, using recognised tools such as risk-based controls and AI impact assessments. Watch the APDP and the Ministry responsible for the digital economy for new deliberations or policy text, and keep your governance documentation ready to adapt.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Mali have a dedicated AI law?
No. Mali has no AI Act, no published AI bill and no AI-specific regulator. AI is governed indirectly through the 2013 personal data law, telecoms and ICT rules, and a national digital policy.
Which law matters most for AI in Mali?
Law No. 2013-015 of 21 May 2013 on the protection of personal data, enforced by the APDP. Almost any AI system using personal data falls under it.
Who is the data protection regulator?
The Autorite de Protection des Donnees a caractere Personnel (APDP), an independent administrative authority created by the 2013 law and operational from around 2016.
Do I have to register AI processing with the APDP?
Often yes. The law requires controllers to declare processing, and some operations need prior authorisation; filing fees apply. Check each use case.
What can the APDP do if I breach the rules?
It can issue warnings, formal notices, orders to stop processing and withdraw approvals, and impose fines (Articles 65 and 66 set amounts up to 20 million CFA francs), with criminal referral possible.
Is Mali bound by the African Union AI strategy or the Malabo Convention?
The AU Continental AI Strategy is non-binding guidance. Mali has not ratified the Malabo Convention. Mali is also suspended from the AU and has left ECOWAS.
What is CIAR-Mali?
The Centre d'Intelligence Artificielle et de Robotique du Mali, a public research and training body created by ordinance in 2023. It is not a regulator.
Could a dedicated AI law arrive soon?
Possibly, but nothing is confirmed. No AI bill has been published. The realistic near-term framework remains the 2013 data law and APDP practice.