Côte d'Ivoire Law 2013-450: ARTCI Compliance for Generative AI

In Abidjan, generative AI has already reached the office. From the Plateau to Cocody, teams at telecom operators, banks, insurers and startups use it to write proposals, summarize contracts or answer customers.

But every prompt that contains a customer's name, phone number or file is personal data processing under Ivorian law. And in Côte d'Ivoire, that processing has a clear framework: Law No. 2013-450 of 19 June 2013, supervised by ARTCI.

Law 2013-450 in a nutshell

Law No. 2013-450 on the protection of personal data applies to any organization that collects or uses information that can identify a person in Côte d'Ivoire. It gives the role of data protection authority to the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), which also regulates the telecom sector.

The text does not mention artificial intelligence. Yet it fully covers these uses: pasting a customer database into ChatGPT or sending a contract to Copilot is processing personal data, and often moving it out of the country.

Declaration or authorization: the basic rule

The principle is simple: personal data processing requires a prior formality with ARTCI. Depending on its nature, this is either a declaration or a request for authorization. Processing of sensitive data, for example, falls under the authorization regime.

Transfers of data abroad are among the operations covered by these formalities. The law only allows a transfer to a third country if that country offers an adequate level of protection. Most consumer AI assistants process data on servers outside Africa. For an Ivorian company, uncontrolled use of these tools can therefore amount to a transfer without the required formalities.

What ARTCI changed in 2026

2026 marks a step up. In January, ARTCI opened the national register of data protection correspondents and asked data controllers to appoint and register their correspondent. The profile and working conditions of this role are set by a text from August 2024.

In July 2026, ARTCI launched CERTINUM, an online platform to file authorization requests and follow compliance procedures. Formalities are now simpler, and failing to complete them is harder to justify.

• An appointed correspondent, registered with ARTCI.

• Up to date formalities, filed electronically.

• Controlled transfers, including those that go through AI tools.

A digital sector moving fast

Abidjan is one of the main economic and digital hubs of West Africa. Telecom operators, mobile money players, banks and the city's many startups handle large volumes of customer data every day. Customer contact centers, well established in the economic capital, are a good example: an agent who pastes a conversation into an AI assistant to draft a reply also transfers the customer's identity.

The country has also set a clear ambition. In March 2025, a national strategy for artificial intelligence and data governance was presented to the Prime Minister, with a five year horizon. It focuses on skills, ethics, local data hosting and governance. The message to companies is consistent: innovate, but keep control of your data.

The concrete risks for an Ivorian company

Risky situations are rarely dramatic. They are ordinary actions, repeated every day:

1. A sales rep uploads a prospect list to generate personalized emails.

2. An HR officer compares full CVs, with photos and phone numbers.

3. A lawyer has a contract summarized that includes a partner's contact details.

4. A developer pastes an extract from a production database to fix a query.

Traditional security tools struggle to see these flows, because they travel over encrypted connections to legitimate websites. We explain why in Why email and network DLP fails on ChatGPT. The cost of these invisible leaks is often underestimated, as our analysis of the real cost of Shadow AI in 2026 shows.

Practical compliance for AI use

Here is a realistic approach, adapted to the Ivorian framework:

• Appoint and register your data protection correspondent, if you have not done so yet.

• List the AI tools in use in each department, including those installed without approval.

• Include these uses in your ARTCI formalities, especially for transfers outside the country.

• Set simple rules on which data must never go to an external AI.

• Protect data before it is sent, automatically, rather than relying on vigilance alone.

• Keep a record of prevented incidents so you can prove it.

To organize this work week by week, follow our 90-day rollout playbook. To see Côte d'Ivoire in its regional context, read our article on generative AI and data protection in West Africa.

How ZeusLock helps

ZeusLock is installed on your employees' devices and browsers. It detects personal and confidential data in real time in prompts and files sent to ChatGPT, Copilot, Gemini or Claude. Depending on your rules, it anonymizes them while keeping their format, warns the user or blocks the upload. Every event is logged, which gives you concrete evidence to present to ARTCI or your auditors.

Summary

In Côte d'Ivoire, Law 2013-450 applies to AI just as it does to any other processing. With the correspondent register and the CERTINUM platform, ARTCI has made compliance simpler and more visible. Companies that set rules for AI use now gain on two fronts: productivity and the trust of their customers.

Want to know which data your teams already send to AI tools? Book a ZeusLock demo.