What is AI regulation in Somalia?
AI regulation: countries and regions
Somalia does not currently have a dedicated AI law or a published national AI strategy in force. As of 8 June 2026, AI in Somalia is governed mainly through general digital and data rules, especially the Data Protection Act 2023, the communications and cybersecurity framework, constitutional rights, and sector specific obligations. Somalia is also beginning to build AI governance capacity through the Somalia National AI Center, while African Union and UNESCO instruments provide the main policy direction for any future AI framework.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
AI regulation in Somalia currently means regulating the uses of AI, rather than regulating AI through a single stand alone AI act. If an AI system processes personal data, profiles people, supports important decisions, moves data abroad, or operates in communications or critical infrastructure, existing Somali law already starts to matter.
That is different from having a full national AI statute. In the official Somali sources reviewed, no enacted AI specific law and no published national AI strategy in force were identified. Instead, Somalia's current model is a mix of hard law, mainly data protection and communications law, plus institution building, policy development and regional guidance.
For operators, that distinction matters. You do not wait for a future "AI law" before doing governance work. In Somalia, the practical questions are already familiar: what data is being used, what lawful basis supports the processing, whether people are being profiled or scored, whether there is meaningful human review, who regulates the service, and whether the data leaves Somalia.
Why it matters
This matters because organisations can create legal and trust problems with AI in Somalia even without an AI specific act. If an AI tool processes personal data, uses biometrics, monitors behaviour, makes or supports significant decisions, or sends data to foreign clouds, the Data Protection Act can apply. The law also reaches some foreign operators if they target people in Somalia or monitor their behaviour there.
It also matters because Somalia is building more digital public infrastructure. As digital government, interoperability, cybersecurity capability and national data systems grow, AI governance stops being a future issue and becomes an immediate procurement, compliance and accountability issue. The organisations most exposed are not only tech vendors. They include telecoms, digital service providers, public bodies, buyers, advisers and international actors working with Somali data.
How it works
Somalia does not yet have a dedicated AI act
In the official Somali material reviewed, no dedicated AI statute and no published national AI strategy in force were identified. The clearest sign of state level AI interest is the Somalia National AI Center, founded in October 2024 as a government affiliated institution. Its published remit is research, education, industry adoption and advice on ethical AI policy formulation and implementation. That is important, but it is not the same thing as binding regulation. For now, Somalia should be understood as a jurisdiction with emerging AI governance capacity, not a jurisdiction with a comprehensive AI code.
The binding baseline is general data and digital law
For most real world AI use, the key legal anchor is the Data Protection Act 2023. It applies where the controller is domiciled, resident or operating in Somalia, where processing occurs in Somalia, or where the processing relates to monitoring behaviour in Somalia or targeting goods or services to people in Somalia. That makes the Act relevant not only to local deployers, but in some cases to offshore providers serving Somali users.
The broader digital framework also matters. The National Communications Law establishes the National Communications Authority as Somalia's communications regulator and gives it licensing, rule making, consumer protection and confidentiality functions. In January 2026, Parliament also approved a Cybersecurity Law establishing a national framework for cybersecurity, including responsibilities for the Ministry of Communications, the technical role of the NCA, duties for critical infrastructure operators, incident reporting, response structures and SOM-CIRT. None of this is AI specific, but it can govern the infrastructure and security layer on which AI services run.
The Data Protection Act contains the most AI relevant rules
The Act is not called an AI law, but several of its rules are directly relevant to AI systems.
First, it sets the usual processing principles and lawful bases. Personal data must be processed fairly and transparently. Processing needs a lawful basis such as consent, contract, legal obligation, vital interests, public interest or a legitimate interest basis. Personal data must be collected for specific purposes, limited to what is necessary, kept no longer than needed, and kept accurate.
Second, the Act is especially important where AI uses sensitive data. Somali law expressly treats biometric data, health status, political opinions or affiliations, race, clan or ethnic origin, and certain other categories as sensitive personal data. That has obvious relevance for face recognition, voice tools, risk scoring, identity systems and many public sector or high consequence uses.
Third, the Act contains a specific restriction on solely automated decision making. A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects or similarly significant effects. Narrow exceptions exist, mainly where the decision is necessary for a contract, expressly authorised by written law with suitable safeguards, or authorised by the person's consent.
Fourth, transparency duties are broader than a simple privacy notice. Before collection, the controller must tell the person the legal basis, the purposes, data sharing, complaint rights and any automated decision making, including profiling, together with the significance and likely consequences for the person. That is highly relevant for AI systems used to rank, score, filter or personalise.
Fifth, high risk processing triggers extra obligations. A data controller of major importance must carry out a data protection impact assessment before processing likely to create high risk to rights and freedoms, submit the report to the Authority before the processing, and consult the Authority if high risk remains. For many consequential AI deployments, this is the closest Somali law currently comes to a risk based AI review.
Cross border data use is already regulated
Because many AI systems depend on foreign hosting, external model providers or regional data sharing, the Act's transfer rules matter in practice. A controller cannot transfer personal data outside Somalia unless an adequate protection condition is met, the recipient has suitable legal or contractual safeguards, or one of the listed derogations applies. Those derogations include informed consent, contractual necessity and a narrow compelling legitimate interest route with safeguards and Authority notification.
This means the practical governance question is not only "are we using AI?" It is also "where is the training, inference or support data going, and on what legal basis?" For many deployers, especially those using foreign cloud or platform providers, transfer analysis will be one of the first serious compliance steps.
The institutional picture is starting to take shape
The Data Protection Authority is the main institution with the strongest direct relevance to AI uses involving personal data. The Act establishes it as an independent agency with supervisory and enforcement functions. Its public website shows it is operational and already offering registration and licensing services, complaints and investigations, data breach notification, guidance and advisory opinions, and training. It also states that the Council of Ministries approved Data Protection Act Regulations on 5 January 2026.
The DPA's enforcement powers are significant on paper. After investigation it can order a controller to stop unlawful processing, remedy the breach, pay compensation, account for profits and pay an administrative penalty of up to US$1 million or the Somali currency equivalent. Failure to comply can create a further offence, which the Act states can carry a fine of up to US$1 million and imprisonment for up to two years. Orders can be challenged by way of judicial review in the Supreme Court.
The Ministry of Communications and Technology remains the main policy ministry for the digital sector. Under the National Communications Law it prepares general communications policy and supervises the NCA, while the NCA operates as an independent regulator for communications and related digital services. The NCA's current public materials also point to a cybersecurity role and link to the Somalia National AI Center as a connected initiative.
SNAIC matters institutionally, but in a different way. It appears to be a capacity, research and policy support institution, not a regulator. Its public materials say it aims to advise on ethical AI policy, train talent, support research and work with public bodies and universities. That suggests Somalia is building internal capability for future AI governance even though the binding legal core still sits elsewhere.
Regional and international instruments matter, but mainly as soft law and policy direction
Somalia's future AI framework is likely to be shaped by African Union and UNESCO instruments more than by an immediate domestic AI act. The African Union Executive Council endorsed the Continental Artificial Intelligence Strategy in July 2024. That Strategy is not directly binding domestic legislation in Somalia, but it is the main continental reference point for Africa centred, development focused, responsible AI governance. It encourages states to build national strategies, governance structures, capacity and rights based safeguards.
Somalia is also part of UNESCO's global AI ethics architecture. UNESCO's Recommendation on the Ethics of Artificial Intelligence applies to UNESCO member states, and UNESCO's Global AI Ethics Observatory lists Somalia as a country where the AI Readiness Assessment Methodology is underway. UNESCO also published a 2025 call for a lead national expert for Somalia to develop a country report based on that readiness work. Taken together, this suggests Somalia is in a diagnostic and institution building phase rather than a legislative end state.
One notable regional point is what Somalia has not yet done. According to the African Union treaty status list dated 2 February 2026, Somalia had neither signed nor ratified the Malabo Convention on Cyber Security and Personal Data Protection. That does not prevent Somalia from using domestic law or softer AU instruments, but it does mean Somalia is not yet tying its digital governance framework to that treaty route.
The near term position is a patchwork, not a vacuum
It would be wrong to say Somalia has "no AI regulation". The more accurate view is that Somalia currently regulates AI through a patchwork of data protection law, communications law, cybersecurity law, constitutional protections and emerging policy institutions. It would also be wrong to say Somalia already has a settled AI governance code. The legal architecture is still developing, AI specific public rulebooks are not yet in force, and some of the detail that practitioners will want, such as stable public text for the new DPA regulations or a published national AI strategy, remains incomplete.
For now, Somalia fits best into the category of sectoral and horizontal regulation by existing law, with soft law and institution building pointing toward a more explicit AI governance model later.
Examples
A foreign or local digital service uses AI profiling to score Somali users for eligibility, fraud review or personalised access. If that processing targets people in Somalia or monitors their behaviour there, the Data Protection Act can apply. The operator needs a lawful basis, must explain any automated decision making and likely effects, and cannot rely on a solely automated decision with legal or similarly significant effects unless one of the Act's exceptions applies.
A bank, telecom or large platform uses AI on customer data and sends the data or model support traffic to infrastructure outside Somalia. The key legal work is not only vendor due diligence. It is also transfer analysis under the Act, deciding whether an adequate protection route, contractual safeguard route or derogation is available, and whether Authority notification is required. If the organisation is a controller of major importance and the processing is high risk, it should also expect DPIA and DPO obligations.
A ministry or public body adds AI capability to a digital public service as Somalia's e-government and interoperability agenda expands. The public sector does not get a free pass. The Data Protection Act was written to cover secure government processing of personal data, the DPA can oversee government institutions, and the e-Government Strategy itself stresses security, privacy, interoperability and data governance. In practice, that means public sector AI should be designed with privacy, access control, accountability and human review from the start.
Common misunderstandings
"Somalia has no AI law, so AI is unregulated." Not quite. Somalia has no dedicated AI act, but AI uses can still be governed by the Data Protection Act, communications law, cybersecurity rules and constitutional protections.
"The Somalia National AI Center is the AI regulator." No. Its published role is capacity building, research, partnerships and policy support. The main binding enforcement institution for personal data issues is the Data Protection Authority.
"Only Somali companies need to care." No. The Data Protection Act can also apply to processing that monitors behaviour in Somalia or targets goods or services to people in Somalia.
"AI only becomes a legal issue if it makes the final decision." Not necessarily. Many AI deployments still trigger duties around lawful basis, transparency, profiling, sensitive data, security, transfers and DPIAs even where a human remains in the loop.
"The African Union AI Strategy is already Somali domestic law." No. It is an important regional strategy and policy reference point, but it is not a Somali statute and does not by itself create domestic penalties.
Risks and boundaries
The biggest boundary is that Somalia's AI regime is still emerging. The official sources reviewed support a clear conclusion that there is no dedicated AI statute in force, but they do not yet show a mature body of AI specific case law, regulator decisions or a published national AI strategy that settles the policy model.
A second boundary is that the Data Protection Act is powerful but not universal. It is most relevant when AI involves personal data. It is less complete as a framework for AI safety, model governance, compute, foundation models, market concentration or non personal data uses. Those topics would need future legislation, standards or sector rules if Somalia wants a fuller AI rulebook.
A third boundary is implementation detail. The DPA website states that Data Protection Act Regulations were approved in January 2026, but in the public sources reviewed the stable legal text and gazette trail were not readily identifiable. That means some operational detail may still evolve.
A fourth boundary is treaty alignment. Somalia can take guidance from AU and UNESCO instruments, but the AU treaty status list still showed Somalia had not signed or ratified the Malabo Convention as of 2 February 2026. So regional alignment currently rests more on strategy and soft law than on that treaty.
What to do next
Treat Somalia as a live compliance jurisdiction now, not as a waiting room for a future AI act. Start by mapping whether your AI use touches personal data, profiling, biometrics, behaviour monitoring or significant decisions. Then identify the lawful basis, the data flows, the transfer route, the safeguard model and whether a human review step is needed.
If you are likely to be a controller of major importance, prepare for registration, DPO designation and DPIA work. Build a simple evidence file that records the purpose of the AI use, inputs, risks, safeguards, human oversight, retention rules and transfer controls. Make sure you have a breach process and a regulator contact path.
If you buy AI rather than build it, ask suppliers where data is processed, whether the tool profiles people, how significant decisions are reviewed, whether model providers receive Somali data, and what contractual transfer safeguards exist. Also keep watching the DPA, MOCT, NCA, SNAIC, AU and UNESCO channels, because Somalia is clearly moving from broad digital governance into more explicit AI governance capacity.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Somalia have an AI law today?
No dedicated AI law was identified in force in the official Somali sources reviewed as at 8 June 2026.
Does Somalia have an official national AI strategy?
No published national AI strategy in force was identified. Somalia does, however, have a government affiliated AI institution, SNAIC, and UNESCO readiness work under way.
What law matters most for AI in Somalia right now?
For most deployments, the Data Protection Act 2023 is the key law because it regulates personal data processing, profiling, significant automated decisions, DPIAs, transfers and enforcement.
Who is the main regulator for AI issues in Somalia?
There is no single dedicated AI regulator. The Data Protection Authority is the main body for AI uses involving personal data. The NCA matters where communications networks, digital services, cybersecurity or critical infrastructure are involved. MOCT leads policy. SNAIC is not the main enforcement body.
Are solely automated decisions restricted in Somalia?
Yes. The Data Protection Act gives people a right not to be subject to a decision based solely on automated processing, including profiling, where it has legal or similarly significant effects, subject to limited exceptions.
Can a foreign AI company fall within Somali law?
Yes. The Data Protection Act can apply if the processing relates to monitoring behaviour in Somalia or targeting goods or services to people in Somalia.
Does Somali law regulate cross border AI data use?
Yes. Personal data transfers outside Somalia need an adequate protection route, suitable safeguards, or a valid derogation under the Data Protection Act.
How important is the African Union AI Strategy for Somalia?
It is important as a regional policy reference and a likely guide for future Somali policymaking, but it is not itself a Somali domestic statute.