Who controls AI systems once governments adopt them?

Governments across Africa are beginning to adopt AI systems into public services without clear answers to a basic question: who controls these systems once they are in use?

The risk is not theoretical. It is operational.

A system may meet procurement requirements. It may come with documentation, assurances, and technical safeguards. But once it is deployed into a government workflow, the harder question is no longer whether it is compliant on paper. The question is whether the government can actually see it, control it, or stop it if conditions change.

That is where AI governance starts to matter in practice.

In many African countries, the challenge is not the absence of policy. Nigeria, Kenya, Rwanda, and South Africa, among others, are already shaping the field through data protection laws, digital strategies, and emerging AI frameworks. The African Union is also pressing for wider adoption across the continent. The harder problem is whether governments have enough leverage to make those rules bind when the systems they adopt are often built, maintained, and supported elsewhere.

Procurement is not just how governments buy technology. It is how they decide what kinds of systems they are willing to depend on, and under what conditions.

When a government adopts an AI system, it is not simply purchasing software. It is accepting a set of relationships: who can access the system, who maintains it, what infrastructure it depends on, and how it can change over time. Those relationships determine whether the government retains meaningful control.

The shift is simple but important. In AI, risk is no longer just about ownership. It is about access and control.

A system may be built by one company but supported by another, hosted on infrastructure the government does not own, and updated in ways that are not fully visible. The critical question is not just who owns the system. It is who can reach it.

Every few weeks, headlines announce new partnerships between major international technology companies and African governments. Microsoft, for example, announced in March 2025 that it would invest ZAR 5.4 billion to expand its cloud and AI infrastructure in South Africa, including capacity intended to support government entities and other organizations using Azure services.

These deals are often framed as capacity-building. But they also concentrate control. When core infrastructure, cloud access, and system updates sit outside government ownership, the question is no longer just what governments are adopting. It is what they are becoming dependent on.

Similar dynamics are now scaling at the continental level. In February 2026, the African Union Commission and Google signed a landmark partnership to advance Africa’s sovereign AI and digital capacity under the AU’s broader continental strategy.

These partnerships are not isolated. Similar arrangements are taking shape across multiple countries and providers. The underlying question is the same in each case: when critical systems depend on external infrastructure and support, who ultimately controls how those systems function over time?

That is why procurement decisions are starting to change.

Governments are asking different questions: who has access to the system, what sits underneath it, who supports it, and what happens if those conditions change after adoption. These are not technical details. They are governance decisions.

One way to see what this looks like in practice is to look at the United States.

The US is not waiting for a comprehensive AI law to shape how systems are used inside government. It is already doing so through procurement. Agencies are setting conditions through contracts, including requirements around disclosure, auditability, oversight, and system dependencies. These choices determine which systems are trusted, what kinds of access are acceptable, and what level of visibility the government requires before adopting a tool.

Those decisions do not stay inside the government. They shape vendor behaviour, push firms to redesign how their systems are accessed and supported, and signal to the broader market which governance features are becoming necessary.

The lesson is not that African governments should copy the US approach. It is that procurement can function as a form of governance when it is used to set conditions on access, visibility, and control before systems are adopted. The alternative is not neutrality. It is exposure.

The immediate risk is access. But the longer-term risk is dependency.

Once a government adopts an AI system, it becomes harder to replace. Data accumulates around it. Workflows adjust to it. Public services begin to rely on it. Over time, the institution starts to organise itself around the system it purchased.

At that point, the question is no longer just whether the system is secure. It is whether the government can realistically change course.

Exposure is a risk to monitor. Dependency is a constraint on action.

A government may be able to identify risk and still be unable to respond without significant disruption if it is too operationally tied to the system. That is why the moment of procurement matters. It determines what dependencies are accepted before they become difficult to unwind.

For many governments across Africa, procurement may be the most effective governance lever available in the near term.

It is where governments can require visibility into systems, set expectations around access and support, define what changes trigger reassessment, and ensure that they retain the ability to intervene if risks shift. Without that leverage, governance risks remaining a statement rather than a practice.

This issue extends beyond procurement itself. It touches cross-border data flows, downstream service dependencies, and the governance terms that travel with imported AI systems. But procurement is where these questions first become concrete. It is where governments decide what they are willing to rely on.

When procurement begins to function this way, government is no longer just buying technology. It is shaping authority inside the systems it adopts. It is deciding who can act, who can see, and who can intervene. That is not a technical detail. It is a governance choice.

For startups and providers working with governments, these expectations will increasingly shape how systems must be designed, supported, and priced to be viable in the public sector.

If AI governance is going to be real, it will not start with abstract principles alone. It will take shape in the terms governments set when they adopt systems, the visibility they require, and the control they retain once those systems are in use.