AI governance in Ghana under Act 843 and the National AI Strategy

Ghana governs AI through its data protection law, with a national AI strategy and two new instruments in preparation. The binding rules today come from the Data Protection Act 2012 (Act 843), enforced by the Data Protection Commission. The National Artificial Intelligence Strategy 2025 to 2035, launched on 24 April 2026, sets the direction for what comes next. This guide covers what applies now and what to prepare for.

Register and know your AI

Section 46 of Act 843 requires every data controller to register with the Data Protection Commission, and section 53 prohibits processing personal data without registration. The application under section 47 describes the personal data processed, the purposes, the recipients, the countries data may be transferred to and the security measures. When AI systems change what data is processed or where it goes, the registration should keep up.

That makes an inventory of AI systems the first piece of work. For each system, record its purpose, owner, vendor, the personal data it uses, where that data is processed and whether it makes or shapes decisions about people. Include AI inside vendor products and tools staff adopt on their own. The AI system register guide covers what each entry should hold.

Handle automated decisions

Section 41 lets an individual require, by written notice, that any decision significantly affecting them is not based solely on automated processing of their personal data. Where a controller makes such a decision anyway, it must tell the individual as soon as reasonably practicable. The individual can require reconsideration within twenty-one days, and the controller has twenty-one days to reply in writing with the steps it will take. Decisions linked to contracts, decisions authorised or required by an enactment, and circumstances the Minister prescribes are outside the section.

In practice, any system that scores, ranks or decides about people needs three things. A record of whether a person is genuinely involved before the decision takes effect. A way to tell affected individuals when it is not. And a reconsideration route with a named reviewer who can change the outcome inside the twenty-one-day window. The human oversight guide covers how to make that review meaningful.

Assess the risky systems

Act 843 has no express impact assessment duty, but the Data Protection Commission runs a DPIA unit that reviews assessments submitted to it and issues a determination from the Executive Director. Its guidance asks organisations to consider a DPIA wherever processing is likely to result in high privacy risks, including new systems, sensitive or large-scale data and cross-border processing. Most AI systems that decide about people meet that description.

An AI impact assessment that sets out the system, its purpose, the people affected, the risks to them and the mitigations serves both the DPC’s process and the draft Bill’s future DPIA duty. The AI impact assessment guide sets out a structure, and a bias assessment covers the fairness question the national strategy’s Bias Mitigation Fund is aimed at.

Report security compromises

Section 31 requires the controller, or a third party processing data for it, to notify the Data Protection Commission and the data subject as soon as reasonably practicable where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person. An AI incident that exposes personal data, such as leakage through a model’s outputs or a compromised vendor, is a security compromise under that section, so AI incidents need a route into the breach process.

What is coming

Three developments will shape AI governance in Ghana over the next year or two.

• The draft Data Protection Bill 2025. Published by the Data Protection Commission, it would repeal Act 843 and create a Data Protection Authority. Clause 53 would require technology-driven decisions impacting data subjects to be explainable, contestable and subject to human oversight, and systems in critical sectors including health, finance, banking and government services to be audited bi-annually. It is a draft and not law.
• The National AI Strategy. It recommends an independent Responsible AI Authority in its first year, a National AI Office, mandatory transparency reports for public-sector AI systems and a data governance checklist for ministries, departments and agencies. Suppliers of AI to government should expect those requirements to reach them through procurement.
• A Bank of Ghana directive. In October 2026 the Governor announced that the Bank is developing a directive on AI in the financial sector, to promote responsible experimentation while keeping governance across the AI lifecycle and addressing data quality, model risk, cybersecurity and consumer protection.

All three point to the same records. An inventory, impact assessments, human oversight of decisions about people, monitoring and incident handling.

How Aicura supports the work

Aicura is an AI governance platform. Discovery and the AI register build the inventory, assessments record purpose, affected people, risks and mitigations, oversight records who reviews which decisions, monitoring watches each system once it is live, and incidents track each event to a final report. Aicura does not assess against Act 843 or Ghana’s AI strategy. It gives you the record that registration, reconsideration requests, DPIAs and breach notices depend on, and the decisions stay with you.

Aicura is hosted on AWS in Sydney, Australia, so using it involves processing personal data outside Ghana. Our data processing agreement sets out the safeguards that cover that transfer.

A note on this page

This is Aicura’s reading of Ghana’s Data Protection Act 2012, the draft Data Protection Bill 2025 and the National AI Strategy. It is not legal advice. Read the Act, the draft Bill and the strategy as published, and take advice on how they apply to your organisation.