On 6 May 2026, the UK Information Commissioner's Office published guidance for public authorities on handling freedom of information requests that involve or are generated by AI systems (ICO). The guidance covers how authorities should treat the rising volume of AI-generated requests, including requests that misquote the law or cite fictitious cases, by applying existing FOI principles.
A UK guidance note matters in Lagos and Nairobi for a structural reason. Anglophone African data protection authorities operate statutes drafted in the GDPR family, adjudicate with thin domestic precedent, and cite ICO material as persuasive authority as a matter of routine. When the ODPC, Nigeria's NDPC or South Africa's Information Regulator needs a position on AI in public administration, the ICO document is the template on the desk.
The borrowing has already started. On 23 February 2026, Nigeria's NDPC signed the global joint statement on AI-generated imagery and privacy alongside more than 60 data protection authorities (Nairametrics), and under the GAID 2025, Nigerian entities of major importance must already address AI-driven processing in audit submissions. South Africa's Information Regulator has an active guidance programme and a demonstrated appetite for own-initiative codes. Kenya's ODPC is investigating AI-training data flows behind consumer wearables. None of these regulators needs new legislation to import the ICO's framing; guidance instruments are how they legislate in practice.
Why it matters. Two distinct compliance questions arrive with this wave. First, for public authorities: access-to-information regimes across the continent (Kenya's ATI Act 2016, Nigeria's FOI Act 2011, South Africa's PAIA) will meet AI-generated request volumes and AI-held records without any tailored rules, and DPA guidance will fill that vacuum first. Second, for anyone supplying AI systems to government: transparency expectations about training data, logic and outputs are being written now, in guidance, before procurement frameworks catch up. The ICO document is the clearest signal available of what those expectations will say.
Who is affected. African public bodies and their information officers; govtech and AI vendors selling into the public sector; and compliance teams at regulated entities whose audit files must describe AI processing, for whom the ICO's articulation of "meaningful transparency" is the practical drafting standard.
What to do now:
- Public bodies: inventory where AI already touches your records and request-handling, and write the disclosure position down before a requester forces the question.
- AI vendors to government: build an explainability file per deployment (training data provenance, logic summary, output limitations). The buyer's regulator will ask the buyer, and the buyer will ask you.
- Compliance teams: track your own DPA's guidance page quarterly. In this area the law moves by guidance note, and the enforcement follows the note, not the statute's silence.