Comply54

Open-source AI governance enforcement for African regulatory compliance.

See comply54 in action: disaster.comply54.io — watch AI agents cause regulatory disasters, then watch comply54 block them live.

---

What it does

Comply54 intercepts AI agent tool calls and evaluates them against African regulatory frameworks — CBN, NDPA, NHA, NAICOM, KDPA, POPIA, and more — before execution. Blocked calls never reach the tool.

Agent decides to call transfer_funds(amount=15_000_000)
         │
         ▼
   comply54 guard  ──► CBN NIP cap exceeded ──► ToolMessage error returned
         │                                       Agent explains to user
         ✗ tool never executes

No OPA binary required. No subprocess. Works in serverless environments.

---

How it relates to agt-policies-nigeria

kingztech2019/agt-policies-nigeria          comply54
──────────────────────────────────          ────────────────────────────────────
The policy SOURCE.                          The enforcement and tooling LAYER.

• Rego policy packs (NDPA, CBN, ...)  ──▶  • PackSpec registry indexes them
• Cited in Microsoft AGT main         ──▶  • Sector classes compose them
• OPA tests (306 passing)             ──▶  • LangGraph / CrewAI / AutoGen adapters
• Stays at kingztech2019 forever      ──▶  • regopy evaluates in-process (no binary)

agt-policies-nigeria is where the policy files live — permanently cited in Microsoft Agent-OS.

comply54 is where the ecosystem lives — the enforcement engine, sector compositions, framework adapters, and CI tooling that make those policies consumable from LangChain, LangGraph, CrewAI, AutoGen, and any OPA pipeline.

---

Research

"Africa does not have an AI regulation gap. It has an accountability gap."

The Enforcement Gap: Why Africa's AI Regulations Need Runtime Enforcement
Oluwajuwon Omotayo · July 2026 · Comply54 Research Working Paper No. 1
DOI: 10.5281/zenodo.21324303 · Download PDF · Zenodo record

The paper documents the enforcement gap — the space between Africa's AI regulatory frameworks (NDPA 2023, KDPA, POPIA, GAID 2025, NIMC Act 2026, and nine more) and the enforcement infrastructure AI agents need to honour them before acting. It covers 12 African jurisdictions and proposes runtime enforcement as the solution, implemented here in comply54.

If you use comply54 in research or academic work, please cite:

Omotayo, O. (2026, July 12). The enforcement gap: Why Africa's AI regulations need runtime
enforcement. Comply54 Research Working Paper No. 1. Zenodo.
https://doi.org/10.5281/zenodo.21324303

---

Quick Start

Install

# Core (no framework)
pip install comply54

# With LangGraph / LangChain
pip install "comply54[langgraph]"

# With CrewAI
pip install "comply54[crewai]"

# Everything
pip install "comply54[all]"

Nigerian Fintech Agent (LangGraph)

from comply54.sectors import NigeriaFintechCompliance
from comply54.langchain import Comply54Guard, comply54_route
from langgraph.graph import END, StateGraph
from langgraph.prebuilt import ToolNode

compliance = NigeriaFintechCompliance()
guard = Comply54Guard(compliance, context={"kyc_tier": 3})

graph = StateGraph(AgentState)
graph.add_node("agent", call_model)
graph.add_node("comply54_guard", guard)       # intercepts before tools run
graph.add_node("tools", ToolNode(tools))

graph.add_conditional_edges("agent", should_continue,
    {"comply54_guard": "comply54_guard", END: END})
graph.add_conditional_edges("comply54_guard", comply54_route,
    {"tools": "tools", "agent": "agent"})     # blocked → agent, clear → tools
graph.add_edge("tools", "agent")

Direct check (no framework)

from comply54.sectors import NigeriaFintechCompliance

compliance = NigeriaFintechCompliance()

result = compliance.check(
    action="transfer_funds",
    params={"amount": 15_000_000, "currency": "NGN"},
    context={"kyc_tier": 3},
)

print(result.overall)                          # "deny"
print(result.primary_violation.messages[0])   # "CBN NIP Framework: ..."

Compliance certificate (for auditors)

cert = compliance.certificate(
    action="transfer_funds",
    params={"amount": 5_000_000, "currency": "NGN"},
    context={"kyc_tier": 3},
)
print(cert.to_json())   # tamper-evident JSON with SHA-256 integrity hash

Signed receipt (cryptographic proof, offline verifiable)

pip install 'comply54[signing]'

from comply54 import NigeriaFintechCompliance
from comply54.receipts import ReceiptSigner, verify_receipt, digest_input

# One-time: generate keypair (store private key in your secret manager)
private_pem, public_pem = ReceiptSigner.generate_keypair()

compliance = NigeriaFintechCompliance(signing_key=private_pem)

result = compliance.check(
    action="transfer_funds",
    params={"amount": 8_000_000, "currency": "NGN"},
    context={"sanctions_screened": True},
)

# Compact Ed25519-signed JWT — store alongside your audit log
print(result.receipt_token)   # eyJhbGciOiJFZERTQSIs...

# Verify offline — no network call, no comply54 installation needed
payload = verify_receipt(result.receipt_token, public_pem)
assert payload.decision == result.overall
assert payload.jti == result.audit_id

# Confirm the receipt covers the exact call
recomputed = digest_input(
    action="transfer_funds",
    params={"amount": 8_000_000, "currency": "NGN"},
    context={"sanctions_screened": True},
)
assert payload.input_digest == recomputed

---

Sector Packs

Sector packs are the main entry point. One import wires up all relevant regulatory frameworks for your use case.

Nigerian Sector Packs

Sector class	Regulations covered	Use case
NigeriaFintechCompliance	NDPA + CBN + BVN/NIN + NFIU AML + OWASP	Payment agents, digital banking
NigeriaHealthcareCompliance	NHA 2014 + NDPA (special-category) + FMOH AI Policy + OWASP	EHR agents, clinical decision support
NigeriaInsuranceCompliance	Insurance Act 2003 + NAICOM Guidelines + NFIU AML + NDPA + OWASP	Claims processing, underwriting

Other Sector Packs

Sector class	Jurisdictions	Use case
KenyaFintechCompliance	KE	Kenyan payment agents
PanAfricanFintechCompliance	NG, KE, ZA, GH, RW, EG, ET, MU, TZ, UG	Multi-market agents

from comply54.sectors import (
    NigeriaFintechCompliance,
    NigeriaHealthcareCompliance,
    NigeriaInsuranceCompliance,
    KenyaFintechCompliance,
    PanAfricanFintechCompliance,
)

---

Policy Packs

All packs use in-process Rego evaluation via regopy — no OPA binary required.

Universal Agent Safety Controls

Pack ID	Regulation	OWASP Ref
universal/prompt-injection	OWASP Agentic AI — LLM01/ASI01	LLM01
universal/pii-leakage	OWASP LLM06 — Sensitive Information Disclosure	LLM06
universal/tool-permissions	OWASP LLM08 — Excessive Agency	LLM08
universal/human-approval	OWASP LLM09 — Overreliance	LLM09
universal/model-routing	OWASP LLM03/LLM05 — Model Selection Controls	LLM03/LLM05
universal/code-review-agent	OWASP LLM08 / ASI01 / ASI02 / ASI09 — AI Code Review Agent Governance	LLM08

Nigerian Regulatory Packs

Pack ID	Regulation	Authority
nigeria/ndpa	Nigeria Data Protection Act 2023	NDPC
nigeria/cbn	CBN Transaction Limits & Tiered KYC (FPR/DIR/GEN/CIR/07/003)	CBN
nigeria/bvn-nin	CBN BVN Framework & NIBSS Scheme Rules	CBN / NIBSS
nigeria/nfiu-aml	MLPPA 2022 / NFIU AML Guidelines	NFIU
nigeria/nha	Nigeria National Health Act 2014 / FMOH AI Policy	FMOH / MDCN
nigeria/naicom	Insurance Act 2003 / NAICOM Operational Guidelines 2021 / Market Conduct 2023	NAICOM

East Africa

Pack ID	Regulation	Authority
kenya/kdpa	Kenya Data Protection Act 2019	ODPC
mauritius/dpa	Mauritius Data Protection Act 2017	DPC Mauritius
tanzania/pdpa	Tanzania Personal Data Protection Act 2022	PDPC Tanzania
uganda/dppa	Uganda Data Protection and Privacy Act 2019	PDPO Uganda
ethiopia/pdp	Ethiopia Personal Data Protection Proclamation 1321/2024	ECA
rwanda/dpa	Rwanda Law No. 058/2021 on Personal Data Protection	RISA

Southern Africa

Pack ID	Regulation	Authority
south-africa/popia	Protection of Personal Information Act 4 of 2013	Information Regulator ZA

West Africa

Pack ID	Regulation	Authority
ghana/dpa	Ghana Data Protection Act 843 of 2012	DPC Ghana

North Africa

Pack ID	Regulation	Authority
egypt/pdpl	Egypt Personal Data Protection Law No. 151/2020	PDPRL Egypt

---

Framework Adapters

LangGraph (recommended)

from comply54.langchain import Comply54Guard, comply54_route

# Comply54Guard is a callable LangGraph node.
# It reads AIMessage.tool_calls, evaluates each via comply54,
# and injects ToolMessage errors for any blocked calls.

guard = Comply54Guard(
    NigeriaFintechCompliance(),
    context={"kyc_tier": 3},
    block_on_escalate=False,   # True = escalate decisions also block
)

LangChain StructuredTool

from comply54.langchain import comply54_tool

# Exposes comply54 as a tool the agent can call to self-check
tool = comply54_tool(NigeriaFintechCompliance())
agent = create_react_agent(llm, tools=[*my_tools, tool])

CrewAI

from comply54.crewai import build_compliance_tools

tools = build_compliance_tools(NigeriaFintechCompliance())
agent = Agent(role="Fintech Agent", tools=tools, ...)

AutoGen

from comply54.autogen import comply54_tools
from autogen_agentchat.agents import AssistantAgent

agent = AssistantAgent(
    name="finance_agent",
    model_client=client,
    tools=comply54_tools([transfer_funds, check_balance], NigeriaFintechCompliance()),
)

Direct OPA (from agt-policies-nigeria)

git clone https://github.com/kingztech2019/agt-policies-nigeria
cd agt-policies-nigeria
opa test policies/rego/ -v   # 306 tests

---

Example Agents

Three complete LangGraph demo agents are in examples/:

Example	Sector	Regulations demonstrated
examples/nigeria_fintech_agent/	Fintech	CBN NIP cap, Tier KYC limits, Maker-Checker, NFIU AML
examples/nigeria_health_agent/	Healthcare	NHA patient consent, AI diagnosis oversight, NDPA special-category
examples/nigeria_insurance_agent/	Insurance	NAICOM auto-denial cap, anti-discrimination, life underwriting, fraud

export ANTHROPIC_API_KEY=sk-ant-...
cd examples/nigeria_fintech_agent && python agent.py
cd examples/nigeria_health_agent  && python agent.py
cd examples/nigeria_insurance_agent && python agent.py

---

Adding a New Pack

See CONTRIBUTING.md for the full guide. Quick summary:

1. Write comply54/packs/<jurisdiction>/<pack>.rego with Rego deny, escalate, audit, allow rules
2. Add a PackSpec entry in comply54/core/packs.py
3. Compose it into a sector class in comply54/sectors/
4. Add tests in tests/

---

Validation & CI

pip install -e ".[dev]"

# Run all tests
pytest tests/ -v

# Validate pack registry
python tools/validate.py

# OPA tests (requires opa binary)
opa test comply54/packs/ -v

# Lint Rego
regal lint comply54/packs/

---

Disclaimer

Comply54 policy packs are community-maintained governance starter templates, not certified legal compliance instruments. Organisations must perform their own assessments with qualified legal and regulatory advisors before deploying in regulated environments.