The Evidence Desk London Brussels Lagos Abuja Nairobi Johannesburg

Policy is not proof.

A living record of the regulatory clocks ticking across the UK/EU–Africa corridor — what each one demands you prove, and the part everyone skips: what it does not mean. Read from the primary source. Dated. Stamped. Not opinion.

● Updated 4 July 2026 Maintained by J&A AI Governance Primary sources only
Every entry is read from the primary source — the actual circular, the actual Article — then dated and stamped. If it isn't verified, it doesn't publish. There is no gossip here and no named-company rumour; only dated, public-interest infrastructure. In a field drowning in confident, unsourced output, that discipline isn't a nicety. It's the product.
The Corridor Clock

What's ticking — and what it actually requires.

The corridor doesn't run on one rulebook. It runs on several, on different clocks, that a Lagos fintech and a London bank read differently. This is the board that reconciles them.

Every entry below is read from the primary source — the actual regulation, circular, treaty or standard — cited by its reference, and stamped with the date it was last confirmed against that source.
Status
Jurisdiction
CLOCK · 01 Live EU Verified · 4 Jul 2026

EU AI Act — Article 50 transparency

DateRegulation in force 1 Aug 2024; Article 50 transparency obligations apply 2 Aug 2026. Under the Digital Omnibus (adopted 29 Jun 2026), the Art. 50(2) marking of AI-generated content is eased to 2 Dec 2026 for systems already on the market.
Primary sourceRegulation (EU) 2024/1689, Art. 50; Digital Omnibus (2026)
What it requiresMachine-readable marking of AI-generated or AI-manipulated content, and clear disclosure when a person is interacting with an AI system.
What it does not mean

Not “add a line to your chatbot.” It means provable, interoperable marking your serving stack actually emits — and can show a reviewer.

CLOCK · 02 Live EU Verified · 4 Jul 2026

EU AI Act — high-risk obligations (Digital Omnibus)

DateHigh-risk timeline amended by the Digital Omnibus, formally adopted 29 Jun 2026 (Parliament 16 Jun; Council 29 Jun), Official Journal publication expected Jul 2026. Standalone high-risk systems (Annex III) now apply 2 Dec 2027; high-risk embedded in regulated products (Annex I) 2 Aug 2028.
Primary sourceDigital Omnibus amending Regulation (EU) 2024/1689; European Parliament & Council
What it requiresFor high-risk systems: risk management, data governance, logging, human oversight, technical documentation and conformity assessment — unchanged in substance.
What it does not mean

Not “high-risk got cancelled.” The obligations are intact — only the date moved. The extra runway is time to build the evidence, not a reason to stop.

CLOCK · 03 Live Nigeria Verified · 4 Jul 2026

CBN — automated AML & model governance

DateIssued 10 Mar 2026, effective immediately; implementation roadmap due within 3 months (by 10 Jun 2026); full compliance 18 months for banks / 24 months for other financial institutions.
Primary sourceCBN circular BSD/DIR/PUB/LAB/019/002 — Baseline Standards for Automated AML/CFT/CPF Solutions (12 standards, 100 requirements)
What it requiresNamed model ownership, explainable alerting, independent validation, change control and tamper-proof audit trails for automated AML/monitoring.
What it does not mean

Not “buy an AML tool.” It means prove you govern the model — who owns it, how an alert is explained, where the audit trail lives.

CLOCK · 04 Live Nigeria Verified · 4 Jul 2026

Nigeria NDPA / NDPC — data & impact assessments

DateNigeria Data Protection Act signed 12 Jun 2023; operationalised by the NDPC's General Application and Implementation Directive (GAID), which sets the DPIA duty.
Primary sourceNDPA 2023; NDP Act — General Application and Implementation Directive (GAID)
What it requiresA lawful basis, accountable data governance, and a data-protection / algorithmic impact assessment where processing is high-risk.
What it does not mean

Not a privacy-policy PDF on the website. It means a documented data-flow and impact trail a regulator can actually follow.

CLOCK · 05 Live UK Verified · 4 Jul 2026

UK — Data (Use and Access) Act 2025

DateRoyal Assent 19 Jun 2025; PECR/cookie-consent changes and most Part 5 data-protection changes in force from 5 Feb 2026 (Commencement No. 6); statutory complaints-procedure duty (s.103) by 19 Jun 2026.
Primary sourceData (Use and Access) Act 2025; ICO guidance
What it requiresNew cookie exemptions with an info-and-opt-out duty; a formal data-protection complaints procedure; higher PECR penalties.
What it does not mean

Not “GDPR is gone.” The bar moved — and PECR now bites like GDPR, up to £17.5m or 4% of turnover.

CLOCK · 06 Live UK ↔ EU Verified · 4 Jul 2026

UK–EU data adequacy — renewed

DateRenewed by the European Commission 19 Dec 2025; valid to 27 Dec 2031, with a review after four years. Followed a six-month technical extension in Jun 2025 while the DUAA was assessed.
Primary sourceEuropean Commission adequacy decisions (GDPR and LED), 19 Dec 2025
What it requiresPersonal data can keep flowing from the EU/EEA to the UK without extra transfer safeguards — the backbone of UK–EU–Africa data chains.
What it does not mean

Not permanent. It's reviewed in four years, and UK divergence under the DUAA is being watched — build transfers that could survive a re-assessment.

CLOCK · 07 Context Nigeria Verified · 4 Jul 2026

Nigeria — National AI Strategy (NAIS)

DatePublished Sep 2025 by the Federal Ministry of Communications, Innovation & Digital Economy with NITDA; a 2025–2029 national vision.
Primary sourceNational Artificial Intelligence Strategy (NAIS), FMCIDE / NITDA
What it requiresA national direction for responsible, inclusive AI — governance, skills and infrastructure — not yet a set of firm-level obligations.
What it does not mean

Not a rule you comply with tomorrow. It's the signal of where Nigerian AI governance is heading — the binding pieces follow it.

CLOCK · 08 Context Kenya Verified · 4 Jul 2026

Kenya — National AI Strategy 2025–2030

DateLaunched 27 Mar 2025 by the Ministry of Information, Communications & the Digital Economy; non-binding, sitting over the Data Protection Act 2019 and the ODPC.
Primary sourceKenya National AI Strategy 2025–2030; Data Protection Act 2019
What it requiresA regional-leadership strategy that leans on existing law — data protection under the ODPC, cyber rules — rather than new AI statute.
What it does not mean

Not an AI Act. It's direction and coordination; the enforceable duties still run through Kenya's data-protection and cyber law.

CLOCK · 09 Context South Africa Verified · 4 Jul 2026

South Africa — National AI Policy Framework

DatePublished Oct 2024 by the Department of Communications & Digital Technologies; under consultation as the basis for a future AI policy and Act.
Primary sourceSA National AI Policy Framework (2024); POPIA
What it requiresA human-centred, risk-based framework aligned to POPIA and the Information Regulator — a policy direction, not yet enforceable AI rules.
What it does not mean

Not law. It's the scaffolding for a future AI Act; today the enforceable obligations are POPIA's.

CLOCK · 10 Context Cross-border Verified · 4 Jul 2026

ISO/IEC 42001 — AI management system

DateEdition 1, published December 2023 — the first AI management system standard.
Primary sourceISO/IEC 42001:2023
What it requiresAn auditable AI management system — governance, roles, lifecycle controls and continual improvement.
What it does not mean

Not a certificate to frame on the wall. It's an operating system a buyer's auditor can walk through.

CLOCK · 11 Context Cross-border Verified · 4 Jul 2026

Council of Europe — Framework Convention on AI (CETS 225)

DateOpened for signature 5 Sep 2024 in Vilnius; the UK is among the signatories and the EU ratified on 15 May 2026. Enters into force once five signatories (three of them CoE members) ratify.
Primary sourceCETS No. 225
What it requiresSignatories to align AI with human rights, democracy and the rule of law — the direction of travel for the floor, not a firm-level rule yet.
What it does not mean

Not something a fintech complies with tomorrow. It's a signal of where the baseline is heading — worth watching, not yet worth panicking over.

Desk Notes

The short, stark ones.

Single ideas, said once, sharply. The reasoning underneath the clock — model risk made vivid enough to repeat in a board meeting.

Black Box Note 01

A model without an owner is not governed. It is merely deployed.

Black Box Note 02

The risk is not that the AI exists. It is that nobody can evidence how it is controlled.

Evidence Card — Ownership

Who owns the AML model — compliance, product, engineering, the vendor? If the answer is “everyone,” the evidence answer is “no one.”

Evidence Card — Oversight

“Human in the loop” is not evidence. Evidence is who reviews, what they can override, and what happens when they disagree with the model.

Investor DD 01

Before the model demo, ask for the model inventory. A founder who can't list the systems cannot govern them.

Corridor Watch — Lagos → London

A fintech crossing the border doesn't just import customers. It imports evidence expectations — and they travel with the product.

The Real Read

Long-form, when the argument earns it.

Not weekly. When something is worth a thousand words — the essays and the legibility teardowns that read the corridor out loud.

Essay · Featured

Cannes Lions 2026 wasn't a creativity festival. It was an enclosure.

A week of keynotes read as a map of who is about to own what — and why governance is the newest toll-booth in the trust economy. The question underneath all of it: who will own the means of verification?

Read the essay →
In the queue
  • The legibility teardown: the rejection letter your investor would write Next
  • What “explainable” has to mean before a bank will accept it Drafting
  • Regulation → Evidence: one clause, turned into artefacts Series
Download the PDF ↓
The Evidence Vault

Take the evidence with you.

The artefacts behind the desk — the data, the checklists, the proof standards. Downloadable, dated, and built to be inspected.

Interactive · Map

Global AI Governance — who actually has AI law?

A live world map and “narrowing” funnel: who has comprehensive law, who has sectoral rules, who has only a policy — colour-coded and sourced.

Open the map →
Dataset · XLSX

Master AI Governance Tracker — 2026

250 countries × the binding-law reality: policy, statute, status and key dates, plus the EU AI Act timeline and CoE convention — the data behind the map.

Download the tracker →
Flagship proof · PDF

CBN AML AI Governance Checklist

A glass-box self-assessment for automated AML governance evidence — the exact categories a reviewer inspects.

View the checklist →
Entry offer · PDF

AI Policy QuickScan — one-pager

The first paid diagnostic on a page: two days of effort, delivered as evidence not theory — scope, price and what you get back.

Read the one-pager →

The clocks don't wait for enforcement. Neither should your evidence.

If one of the clocks above is ticking for you — a bank review, a diligence process, a board sign-off — start with a QuickScan and know exactly where you stand.

Book a QuickScan call → contact@ja-ai.co.uk