Ghanaian law first. International standards alongside.

Ghana

Data Protection Act, 2012 (Act 843)

Binding in Ghana

Ghana’s data protection law. It governs how personal data is collected, processed, kept and transferred, including when an AI system is the thing doing the processing.

What the assessment tests

• Registration as a data controller
• Lawful basis and purpose limitation for AI processing
• Data subject rights, including decisions made about people by automated means
• Retention, disposal and cross-border transfer

Because Act 843 is binding, a serious gap here can cap the data governance score regardless of how mature the rest of the organisation is.

Ghana

Cybersecurity Act, 2020 (Act 1038)

Binding in Ghana

Ghana’s cybersecurity law. For AI governance it sets the floor for access control, incident handling and the reporting duties that apply when an AI tool is part of an incident.

What the assessment tests

• Incident reporting procedures
• Access control over AI tools and the data they reach
• Security of systems that host or call AI services

Gaps in incident reporting cap the security dimension until a procedure exists and staff know how to follow it.

International standard

ISO/IEC 42001 — AI management systems

Benchmark

The international standard for an AI management system. Aegis uses it to judge whether governance is organised, owned and repeatable, not only whether a single control exists.

What the assessment tests

• AI policy and assigned roles
• An inventory of AI systems in use
• Risk and impact assessment
• Monitoring, review and improvement

Where an Act 843 or Act 1038 control and an ISO/IEC 42001 clause test the same thing, the crosswalk records them as equivalent so one answer serves both.

United States, voluntary

NIST AI Risk Management Framework

Benchmark

A widely used voluntary framework organised around govern, map, measure and manage. It gives boards a recognised vocabulary for AI risk.

What the assessment tests

• Governance and accountability structures
• Mapping AI use and its context
• Measuring and managing identified risks

Findings against the NIST AI RMF are reported as good practice, never as legal obligations.

European Union

EU Artificial Intelligence Act

Binding only where output reaches the EU

The EU’s risk-based AI law. Aegis treats it as binding only for AI systems whose output reaches the EU, such as exports, EU customers or EU staff. Everywhere else it is a benchmark of good practice.

What the assessment tests

• Human oversight of high-risk systems
• Transparency to people affected by AI
• Risk classification of AI use cases

During scoping we record which AI systems produce output that reaches the EU. Only those are assessed against the EU AI Act as binding.