Guinea Law L/2016/037: Build AI Governance Before the Regulator Does

In Conakry, Boké or Kamsar, artificial intelligence has already found its way into the office. An engineer asks ChatGPT to summarize a production report. A lawyer has Copilot review a contract. A customer service agent at a telecom operator drafts replies with Gemini. Nobody waited for a memo from management to get started.

The legal framework is moving more slowly. Guinea has had a data protection law since 2016, but the authority meant to enforce it is not yet fully in place. For a company, that gap is no reason to wait. It is actually the right time to set its own rules.

Law L/2016/037/AN: what it actually says

Law No. L/2016/037/AN of 28 July 2016 on cybersecurity and the protection of personal data is the reference text. It does not mention artificial intelligence, but it covers any operation on information that can identify a person. Pasting a customer file into an AI assistant is processing. Sending it to servers outside the country is a transfer.

Three points matter most when it comes to AI:

• Prior formalities. The law requires a declaration or an authorization request before processing starts. Health, biometric and genetic data, national ID numbers and data about offences require authorization.

• Transfers outside Guinea. They are only allowed to a country that offers an equivalent or higher level of protection, under the authority's oversight.

• Security. The data controller must protect data against any disclosure to unauthorized third parties.

An authority on paper, not yet up and running

The law provides for a personal data protection authority, whose organization is to be set by regulation. According to available legal analyses, this authority is not yet fully operational and the decrees on declaration procedures are still pending.

In practice, there is no desk yet where companies can file declarations, and no guidance on AI. But the law is in force. Security obligations and transfer rules already apply, and civil or criminal litigation can rely on them. When the authority is finally set up, it will also look at what companies did before.

The state is pushing AI, and companies are following

The political signal is clear. In December 2025, the ministry in charge of information technology validated, with UNDP, a national artificial intelligence roadmap for 2026 to 2035. It builds on a national assessment and starts with institutional, regulatory and technical foundations before bringing AI into public services. In 2025 the country also brought its first Tier 3 certified national data center into service.

In the private sector, two industries are on the front line:

• Mining. Guinea holds the largest bauxite reserves in the world. Mining companies and their contractors handle geological data, contracts, information on local communities and HR files for thousands of employees. Many work with parent companies abroad and English-language tools where AI is already standard.

• Telecoms and mobile money. Phone numbers, transaction histories, scanned ID cards: this is exactly the kind of data a busy agent might paste into a chatbot to make sense of a complaint.

Why build your governance before the regulator does

Waiting for the authority to publish its rules may look cautious. It is actually risky, for three reasons.

First, leaks give no warning. Once a mine plan, a staff list or a concession contract has gone to an external service, there is no way to call it back. We break down how this happens in the anatomy of an AI data leak.

Second, your partners are not waiting either. International groups, lenders and banks already ask their Guinean suppliers for proof that data is under control.

Third, uncontrolled use is costly even without a fine: lost time, renegotiated contracts, damaged trust. We put numbers on it in the real cost of Shadow AI.

Five workstreams for solid AI governance

1. Take stock. Which AI tools are used, by which teams, with which data? A two-week internal survey is enough to start.

2. Classify data. Geological data, contracts, staff files, subscriber data: define what must never leave the company.

3. Appoint an owner. A data lead, from legal or security, who keeps a record of processing, even before the authority opens its doors.

4. Write one simple rule. One page, in French, with examples from your own business. What is allowed and what is not.

5. Protect at the source. Detect and anonymize sensitive data before it reaches the AI, and keep a record of the incidents you prevented.

For the wider regional picture, read our article on generative AI and data protection in West Africa.

What ZeusLock brings

ZeusLock runs on your teams' devices and browsers. It spots sensitive data in real time in prompts and files sent to AI assistants: names, phone numbers, ID documents, financial data, technical information. Depending on your rules, it anonymizes while keeping the format, warns the user or blocks the request. Every event is logged, which gives you concrete evidence when the authority or a partner asks for it.

Key takeaways

Guinea has had a law since 2016, an AI roadmap since late 2025, and an authority still under construction. Mining, telecom and service companies that organize their AI use now will get ahead. They will be ready when the regulator arrives, and they will have protected their data in the meantime.

Want to know which data your teams are already sending to AI? Request a ZeusLock demo.