DRC copper and cobalt: mining traceability data meets generative AI

In Kolwezi, a compliance analyst at a cobalt trader has until the evening to finish a due diligence report for a European buyer. She has three hundred pages to work with: site audits, supplier lists, photos, visit reports. She pastes the lot into an AI assistant to get a summary. The report is ready on time. The supplier names, the volumes and the audit findings are now outside the company.

The scene is ordinary, and that is exactly the problem. The more traceability requirements grow, the more sensitive documents teams produce, and the more tempted they are to hand them to AI to keep up.

The DRC at the heart of battery supply chains

The Democratic Republic of the Congo is the world's largest cobalt producer and one of the major copper producers. Most of the activity is in Lualaba and Haut-Katanga, around Kolwezi and Lubumbashi, before a long road journey to ports on the Indian Ocean and the Atlantic.

The sector is governed by the Mining Code, revised by Law No. 18/001 of 9 March 2018. The state has also tightened its grip on cobalt: exports were suspended in February 2025, then replaced from October 2025 by a quota system set by ARECOMS, the regulator for strategic mineral substances. Every tonne exported therefore leaves a precise administrative and commercial trail.

Due diligence generates a lot of data

International buyers follow the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals. In Europe, the Batteries Regulation sets its own due diligence obligations, whose start has been pushed back to 2027. To meet these expectations, Congolese companies and their partners build up large files:

• maps of suppliers, sites and intermediaries;

• audit reports, non-conformity findings and action plans;

• registers of artisanal miners, with names, ID documents and sometimes photos;

• reports received through grievance mechanisms;

• tonnages, grades, prices, offtake contracts and export documents.

What this data is worth, and to whom

A supplier list with volumes and prices is of direct interest to a competitor. A negative audit finding taken out of context can hurt a partner or a cooperative. A register of artisanal miners holds personal data about people who are often vulnerable, and a poorly protected grievance report can expose the person who filed it.

This information is also central to relations with the state. Quotas, declarations and export documents commit the company to the authorities. Letting them flow through tools nobody controls is a legal and commercial risk at the same time.

The Congolese framework on personal data

Since Ordinance-law No. 23/010 of 13 March 2023 on the Digital Code, the DRC has had a full data protection regime. Explicit consent is the rule, identification numbers fall under an authorisation regime and transfers out of the country are restricted. The Data Protection Authority provided for by the Code has not yet been created, but ARPTIC carries out its tasks on an interim basis. We cover these rules in our article on the DRC Digital Code 2023 and AI.

So for a miner register or a grievance report sent to an AI assistant hosted abroad, the question is far from theoretical. European buyers, for their part, are bound by the GDPR and expect comparable safeguards, as our EU AI Act and GDPR compliance checklist explains.

Where AI enters the chain

1. Summarising reports from audits or site visits, often long and in several languages.

2. Translation between French, English, Chinese and Swahili, depending on the partners.

3. Answering questionnaires from buyers and auditors, with internal documents copied and pasted in.

4. Analysing spreadsheets of tonnages, prices or quotas to prepare a meeting.

None of these uses is malicious. They respond to real pressure: tight deadlines, long documents and partners who speak several languages. That is why a simple ban almost always fails: teams switch to their phones or personal accounts, and the company loses all visibility.

Protecting data without slowing compliance

The goal is not to ban AI for compliance teams, who need it to meet deadlines. It is to let the work through and hold back the data that must not leave.

• Classify due diligence files as confidential by default.

• Define approved tools and forbidden data: miner identities, people who file grievances, prices, contracts.

• Control on the device, at the moment of the prompt, and anonymise names, numbers and amounts while keeping their format, as our guide to format preserving anonymization explains.

• Log prevented incidents, which are useful in front of an auditor, a buyer or a regulator.

To organise the work, our 90-day rollout playbook sets out a realistic timeline, starting with the teams that handle the most sensitive files.

Key takeaways

• Traceability of Congolese copper and cobalt produces highly sensitive data.

• These files are often handed to AI to save time.

• The 2023 Digital Code and buyers' requirements apply together.

• Control on the device lets teams use AI without exposing suppliers, miners or contracts.

ZeusLock detects and anonymises sensitive data right on the device, before it is sent to ChatGPT, Copilot or Gemini, and keeps a record of incidents. Book a demo to protect your mining traceability data.