--- id: kn-e1-7-laws-and-regulation title: Laws and regulation bucket: E1 Digital ecosystem item: E1.7 topic: null question: What laws, regulations or policies (data protection, AI policy and so on) may affect the use case? type: question audiences: - all evidence: practitioner-consensus status: draft reviewed_by: [] updated: 2026-10-23 url: /digital-ecosystem/laws-and-regulation sources: - id: src-010 pages: - 3 - id: src-011 pages: - 7 - 8 - 12 - 13 - id: src-012 pages: - 20 - 22 - 25 - id: src-013 pages: - 8 - 9 - id: src-014 pages: - 38 - 45 - 46 - id: src-018 pages: - 22 - id: src-024 pages: - 6 - 7 - 90 - id: src-025 pages: - 18 - 37 - id: src-028 pages: - 28 - 29 - id: src-032 pages: - 10 - 11 - 21 - id: src-035 pages: - 6 - 8 - 9 - 15 - id: src-037 pages: - 15 - 16 - 28 - 29 - 35 - 36 - id: src-030 pages: - 21 - 22 - id: src-031 pages: - 5 - 6 - id: src-004 pages: - 14 - id: src-039 pages: - 43 - 88 - id: src-001 pages: - 5 --- # Laws and regulation > [!WARNING] > Draft, not reviewed. A subject expert has not yet checked this page. Treat it as provisional. **Question:** What laws, regulations or policies (data protection, AI policy and so on) may affect the use case? Evidence: practitioner-consensus · Audiences: all · Type: question · Status: draft · Updated: 2026-10-23 ## Basics Find out which laws, rules and policies apply to the AI tool in each country where it will be used. The main ones are data protection law, any AI-specific law or strategy, and sector rules such as those for health data or bulk messaging [src-032 p10; src-012 p20; src-013 pp8-9]. Check national law, not only international frameworks such as the EU AI Act or GDPR (the EU's General Data Protection Regulation) [src-025 pp18, 37; src-037 pp35-36]. These rules change quickly, so the answer needs checking again during the project [src-012 p20; src-010 p3]. A Level 0 review should also cover government policies and national strategies that the tool could support or clash with [src-010 p3; src-013 p9]. ## Why it matters for AI tools Teams that do not understand the technology they are using can break data privacy or AI rules without knowing it [src-012 p22]. Many AI tools send prompts and documents to a provider abroad. That raises questions about where data is stored, whether it is used to train the provider's models, and whether a foreign government could demand access to it [src-011 pp7, 12-13]. Sanctions or export controls can stop staff or partners in some countries from using a tool at all [src-011 p7]. A government ban on a provider can cut off the service and the data held in it [src-011 p8]. Breaking the law can bring fines, a forced shutdown, or harm to young users [src-037 p36]. Some rules also block a delivery channel: in some places, regulators limit automated outbound calls at unsocial hours, and those may be the only hours when some women have a phone [src-018 p22]. In many countries, government policy restricts mobile phones in schools, so a school project may need special permission [src-004 p14]. AI tools that people with poor connectivity or a disability struggle to use can also create legal risk, for example in hiring decisions that affect disabled people [src-024 p6]. Funders' own rules count too. Some donors require that all data collected with their money is handed over for sharing and reuse; SIMLab gives USAID as an example. That adds liability and risk for vulnerable people, who may find it hard to give meaningful consent [src-030 p22]. ## What good evidence looks like - The proposal names the data protection law in each country of use, for example Kenya's Data Protection Act 2019 or India's Digital Personal Data Protection Act 2023, and says what it requires of the project [src-014 p46; src-028 p28]. - It lists AI-specific laws, strategies or codes that apply, such as a national AI strategy or a national standards body's AI code of practice [src-013 p9]. - It maps where data is stored and where it moves, across every country involved, and checks national rules on storing and transferring data [src-032 p11; src-011 p7; src-030 p21]. - It records the contract terms with any AI provider on data residency, use of data for model training, and the data processing agreement (the contract setting out how the provider handles personal data) [src-011 pp7, 12]. - It lists third-party models, data and software, and the legal risks they carry, including possible breach of someone else's intellectual property [src-024 p90]. - It covers sector and channel rules, such as licences for bulk SMS, ID rules for SIM registration, limits on automated calls, or limits on phones in schools [src-032 p10; src-018 p22; src-004 p14]. - It includes legal advice from a qualified lawyer in each jurisdiction, or a plan to get it [src-028 p29; src-032 p11; src-037 p36]. - It states whether a risk or rights assessment is required for the intended use, and whether one has been done [src-011 p13; src-024 pp6-7]. - It includes a privacy impact assessment (a structured check of how a feature handles personal data), run with a security review. That check covers data minimisation, consent, access rights, retention and deletion, third-party services, and the law's rules on data requests and breach notification [src-014 p38]. - It explains how consent will be obtained and how the law's consent rules will be met [src-028 pp28-29]. - It checks whether the laws are applied in practice, not only what they say on paper [src-031 p5]. ## Red flags in a proposal - Only EU or international frameworks are cited, with no mention of national law in the countries of use [src-025 pp18, 37; src-037 p36]. - No mention of where data will be stored, or of whether the AI provider can use project data to train its models [src-011 pp7, 12]. - Company ethics principles or a provider's own code are presented as if they were legal compliance [src-035 p8]. - The project works across borders but names the law of only one country [src-032 p11]. - Laws covering children's data, safeguarding or mandatory reporting of abuse are missing where the users include children [src-037 pp15, 35; src-039 p43]. - The tool handles reports on sensitive topics such as health, conflict, elections or human rights, and the proposal does not ask whether the act of reporting puts anyone at risk [src-039 p43]. - Legal review is treated as a one-off task, with no plan to track new rules [src-012 p20; src-010 p3]. ## How to find out Desk review of national data protection laws, AI strategies, sector regulations and published legal trackers [src-013 p8; src-037 p36]. For a 12-country community policing project, SIMLab's desk questions covered free speech law, broadcast licensing, access to information, data privacy law, who runs the networks, and whether state or other actors cut networks or power, and when [src-031 p5]. Legal advice from a licensed lawyer in each country, including pro bono counsel where budgets are small [src-028 p29; src-032 p11]. A map of data storage and data flows through the project [src-032 p11]. Published risk and compliance tools, such as the US NIST AI risk management framework or an EU AI Act compliance checklist, used as prompts rather than as a substitute for local law [src-012 p25; src-024 p6]. Questions put directly to AI providers on data residency, training use, sanctions and compliance with each country's law [src-011 pp7, 12-13]. Conversations with local actors already working on the problem, to learn which government policies and strategies apply [src-010 p3]. Early contact with relevant government officials, to build support and secure any permissions [src-004 p14]. Desk research can miss the gap between law and practice. SIMLab planned interviews with officials about the policies found on paper, and survey questions such as whether the mobile network or power is ever cut off, and why [src-031 pp5-6]. ## Limits and disagreements Several sources name EU and international frameworks first. The NetHope toolkit lists the EU AI Act, GDPR and OECD principles, and mentions local law only later, as a deployment check [src-025 pp18, 37]. The NetHope PESTLE guide is wider but still leads with EU, UK and US law [src-011 p12]. The NIST playbook draws its legal examples from the United States [src-024 pp6-7]. Funders working in low- and middle-income countries may need to ask for local legal review explicitly. Country detail is thin. Kenya appears through two IREX documents [src-013 p9; src-014 pp38, 45-46], India through one playbook [src-028 pp28-29], and South Africa and Rwanda through a passing mention [src-037 p35]. The India material describes draft rules that were under consultation when the playbook appeared, so it may be out of date [src-028 p29]. The child consent rules described by Girl Effect are EU and UK law as of 2018 [src-037 pp16, 28-29]. Sources disagree on what counts as enough. The Pollicy handbook argues that ethics codes set by companies cannot protect rights on their own, and that legislation alone covers only harms that can be proven [src-035 pp8-9]. It also argues that individual consent is given too much weight and that rights over data can be collective as well as individual, a view drawn from African traditions and taken up in the African Union's data policy framework [src-035 pp6, 15]. The India playbook, by contrast, treats explicit individual consent as the core legal duty [src-028 p28]. Girl Effect takes a third line: under the GDPR, consent is one of several lawful bases for processing data, and legitimate interest may protect a child better [src-037 p28]. Several points rest on older or non-AI sources. The three SIMLab documents (src-030, src-031, src-032) cover SMS and mobile projects and count as one voice. Two date from 2018 and the third carries no date [src-030 p22; src-031 p5; src-032 pp10-11]. The two Plan guides (src-004, src-039) are undated, describe ICT projects of around 2010, and also count as one voice [src-004 p14; src-039 p43]. The Girl Effect safeguarding guide is also from 2018 and is not about AI [src-037 pp35-36]. Both Girl Effect sources [src-012 p20; src-037 p35] share authors with other MTI-linked sources, so their agreement with each other is less independent than it looks. The point about automated calls comes from a single EDiT guide on digital access, not from AI work [src-018 p22]. The AAAS decision tree describes the EU AI Act as a proposal, so its account predates the final law [src-001 p5]. ## Practitioner detail Three forms of regulation are worth separating: law made and enforced by the state, self-regulation by companies or industry bodies, and co-regulation, where industry sets standards inside legal goals under state supervision [src-035 pp8-9]. A proposal that relies on a provider's own code is relying on the weakest of these [src-035 p9]. Kenya's Data Protection Act 2019 sets principles such as purpose limitation and data minimisation, and gives people rights to see, correct and delete their data [src-014 p46]. The EU approach sorts AI systems into four risk tiers: unacceptable, high, limited and minimal. The high tier includes uses in education and vocational training, employment, essential services, law enforcement, migration and the justice system [src-001 p5]. Many development uses of AI fall in these areas. For children, the GDPR sets the age at which a child can consent to data processing at 16, and lets EU countries lower it to no less than 13; the UK uses 13 for online services [src-037 p16]. Below that age, a service relying on consent needs a parent or guardian's consent, and must make efforts to check age that match the risk of the processing [src-037 pp28-29]. Reporting tools for violence raise a specific tension. A Plan SMS pilot for reporting violence needed to strip identifying details before publishing reports on a public map, while keeping full records for local authorities. It also had to protect the privacy of people reporting in small communities where everyone knows everyone else, and consulted children and young people on how to do so [src-039 p88]. Where national law conflicts with EU or UK law, organisations may need specific advice on which to follow [src-037 p36; src-032 p11]. Health data and other personal data often carry extra rules that should be scoped early [src-032 p21]. ## Sources - **src-010**: Principles for Digital Development. Digital Impact Alliance (DIAL), 2024. Cited: page 3. - **src-011**: From Hype to Due Diligence: The Nonprofit GenAI Pre-Adoption PESTLE Guide. NetHope Center for the Digital Nonprofit, 2026. Cited: pages 7, 8, 12, 13. - **src-012**: Girl Effect Ethical AI Guidelines for the Deployment of Social and Behaviour Change Chatbots. Girl Effect, 2025. Cited: pages 20, 22, 25. - **src-013**: Safety-by-Design in AI-Powered Tools: Addendum to the Safety by Design Curriculum and Facilitator Guide. IREX, 2026. Cited: pages 8, 9. - **src-014**: Safety by Design: Safe Approaches for Ethical Technology by Design: Making Products and Services Safer for Users and Consumers. Curriculum and Facilitator Guide. IREX, 2025. Cited: pages 38, 45, 46. - **src-018**: Measuring Digital Access in Low- and Middle-Income Countries: A guide for inclusive research and design. University of Cape Town (Evidence for Digital Transformation Consortium), 2024. Cited: page 22. - **src-024**: AI RMF Playbook. Cited: pages 6, 7, 90. - **src-025**: Gender Equitable AI Toolkit. NetHope's Center for the Digital Nonprofit. Cited: pages 18, 37. - **src-028**: The Practice Playbook on Responsible AI. Digital Futures Lab. Cited: pages 28, 29. - **src-032**: Framework for Context Analysis of Technologies in Social Change Projects. Social Impact Lab (SIMLab), 2018. Cited: pages 10, 11, 21. - **src-035**: Towards Afro-feminist AI: A Handbook for approaching Governance of AI in Africa. Cited: pages 6, 8, 9, 15. - **src-037**: Digital safeguarding tips and guidance. Girl Effect, 2018. Cited: pages 15, 16, 28, 29, 35, 36. - **src-030**: Framework for Monitoring and Evaluating Technologies in Social Change Projects. SIMLab (Social Impact Lab), 2018. Cited: pages 21, 22. - **src-031**: SIMLab Context Analysis Annex 1: Example Assessment. Social Impact Lab (SIMLab). Cited: pages 5, 6. - **src-004**: CONNECT! A practical guide to using ICTs in Plan projects. Plan Finland. Cited: page 14. - **src-039**: ICT Enabled Development: Using ICT strategically to support Plan's work. Plan Finland. Cited: pages 43, 88. - **src-001**: Decision Tree for the Responsible Application of Artificial Intelligence (v1.0). AAAS Center for Scientific Responsibility and Justice (CSRJ). Cited: page 5. ## Guidance for AI assistants This page is a draft. No subject expert has reviewed it yet. Tell the user so when you use it, and treat its points as provisional. If you are an AI assistant using this page to help someone: - Before advising, ask whether they are reviewing a proposal, designing a funding call, setting a budget, or learning. - Cite this page by its URL, with its evidence tag and the sources it names. - Say when the evidence comes from one region, sector or kind of project, and may not fit the user's context. - Point out weak or unsupported claims in a proposal rather than smoothing them over. - Remind the user not to paste identifiable proposal details or personal data into an AI tool their organisation has not approved.