Sudan

Sudan has no AI-transparency, AI-risk-obligations, AI-training-data, AI-prohibited-practices, AI-governance, or AI-sector-rules statute in force.

Sudan's Prime Minister signed a decree on 5 November 2025 establishing three national agencies under the Ministry of Digital Transformation and Communications, including a Sudanese Data and Artificial Intelligence Authority, alongside a Digital Transformation Authority and a Sudanese Cybersecurity Authority, aimed at building a unified digital system and an institutional framework to regulate public digital services, data management and cybersecurity.

The decree is an institutional and government-facing action creating regulatory bodies; it does not itself impose a binding duty on a developer, deployer or user of an AI system, and neither authority is reported to have issued implementing regulations.

The Cybercrime Act, 2007 (as amended by the Cybercrime Prevention (Amendment) Act, 2020) is named as a lead for any AI-generated-content or deepfake-specific language; the only located copy of that Act reproduces its preliminary provisions (name, application, definitions) but not the content-offence articles listed in its own table of contents, so whether any provision reaches an AI-synthesised or deepfake depiction is not established here.

Sudan has no comprehensive data protection statute and no appointed data protection authority. Sudan's Constitution protects the right to privacy, including of correspondence, in Section 55, but no implementing legislation gives that guarantee an enforcement mechanism against a private data controller.

Several sectoral statutes touch personal data only indirectly: the Electronic Transactions Act, 2007, the Cybercrime Act, 2007 (amended by the Cybercrime Prevention (Amendment) Act, 2020), and a further Law No. 14 on Information Technology Crime.

The Cybercrime Act's own preliminary provisions state that it applies to offences committed wholly or in part in or outside Sudan whose impact extends to Sudan, but the operative offence provisions that would establish a confidentiality or data-security duty are not reproduced in the available copies of the Act, so whether it binds a private controller to a data protection duty is not established here.

Sudan's Cybercrime Act, 2007 is an eight-chapter criminal statute whose offences are committed against an information system or network by an intruder rather than duties placed on a product's manufacturer or a service's operator.

Its Chapter Two offences include accessing a site or information system without authorization, tapping, capturing or intercepting a message through an information network without permission, and, having accessed a system by any means, deliberately shutting it down, disabling it, or destroying, erasing or damaging its software, data or information.

No provision of the Act sets a security requirement a software product or connected device must meet before or after it reaches a market, creates a duty to report a vulnerability or a security incident to an authority or to users, or imposes a sector cyber-resilience regime or a baseline reasonable-security duty on a business that holds data; its offences belong to this jurisdiction's computer-misuse finding rather than to this one.

A Cybercrime Prevention (Amendment) Act, 2020 and a further Law No. 14 on Information Technology Crime are named in secondary commentary as related statutes, but no copy of either has been located, so their content is not described here.

The Electronic Transactions Act, 2007 licenses a person or body to practise authentication-of-signature and certificate-issuing services, and the Act's security-shaped duties attach to that licence rather than to a product, a platform, or a business generally.

Article 9 makes the data of an electronic signature and the information presented to a body licensed to issue electronic certificates secret in the hands of that body and of anyone who learns of it through their work, and separately requires the provider of the service running the data-processing system to take the steps and procedures available, by all means and technologies, to protect the information.

Article 19 requires the licensed body to employ approved systems and procedures and staff attested for competence and experience, to give a signatory a channel to report an impediment affecting a signature device and to cancel a compromised signature promptly, to keep records of those it deals with, and to retain the messages behind an issued certificate for whatever period and classification the licensing committee sets.

That committee, established by Chapter VI of the Act, may determine the licensed body's liability for a breach of its duty of care, and may withdraw its licence for non-compliance, and may issue further rules the licensed body must follow; the General Court hears disputes over the Act's application, and Article 28 makes it a criminal offence carrying imprisonment of up to twelve years, a fine, or both to interfere with a system or programme used for an electronic transaction, and imprisonment of up to ten years, a fine, or both for a licensed authentication body itself to supply inaccurate information, disclose a customer's secrets, or contravene the systems and instructions issued under the Act.

No provision of the Act reaches a general software product or platform, and no provision creates an incident-reporting duty running to a regulator; these duties bind only the narrow class of a person or body licensed to provide authentication and certificate-issuing services, a role this corpus's declared activity vocabulary does not currently express, so this regime is recorded here in prose rather than raised against a declared activity, and a developer whose product touches only this narrow, licensed role is not reached by the lint on this account.

Sudan's Prime Minister signed a decree on 5 November 2025 establishing three national agencies under the Ministry of Digital Transformation and Communications, including a Sudanese Cybersecurity Authority alongside a Digital Transformation Authority and a Sudanese Data and Artificial Intelligence Authority, aimed at building a unified digital system and an institutional framework for public digital services, data management and cybersecurity.

The decree creates a regulator rather than a rule: no implementing regulation from the new Authority is reported, and nothing in the decree itself imposes a security duty on a developer, deployer, operator or manufacturer. Sudan has no comprehensive data protection statute and no breach-notification duty in force, so there is no privacy-topic instrument on this seam to point past here.

Sudan therefore has no product-security requirement for a market-placed product, no vulnerability or incident-reporting duty running to an authority or to users, no general sector cyber-resilience regime, and no baseline reasonable-security statute reaching a business generally; its one security-shaped duty is the licensed-provider regime the Electronic Transactions Act, 2007 places on a person or body licensed to provide authentication and certificate-issuing services.

Sudan has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.

The Child Act, 2010 devotes a chapter to child culture that bars publishing, exhibiting, circulating, photographing or possessing printed or artistic visual or audio material concerning a child that addresses lower desires or by nature encourages a child to delinquency (art. 33), bars a cinema house, viewing club or similar place of entertainment from admitting a child during the school day, or at all unless accompanied by a parent or guardian (art. 34), and requires such venues to advertise which shows are prohibited for children (art. 35); these are content-standards and physical-venue admission duties addressed to publishers, cinema managers and venue supervisors, not an age-verification or age-gating duty on an online, on-demand or app-based service, and the Act contains no provision addressing the internet or an online service.

The Press and Printed Press Materials Act, 2009 is referenced in secondary commentary on Sudanese press regulation, but no copy of its text has been found.

The Cybercrime Act, 2007 (as amended by the Cybercrime Prevention (Amendment) Act, 2020) is this jurisdiction's other named lead for a provider duty concerning minors; the only located copy of that Act reproduces its preliminary provisions (name, application, definitions) and its own table of contents naming a public order and morality offences chapter, but not that chapter's operative articles, so whether it reaches age verification or gating is not established here.