Setting AI rules in Nigeria without stopping useful work

A programme officer uses a chatbot to tidy a donor report the night before it is due. Someone in HR tries an AI tool to sort 400 applications. A finance analyst pastes a supplier spreadsheet into a free assistant to find duplicates. Nobody asked permission, because nobody said permission was needed.

If you lead an organisation, a ministry or a programme, this is probably already happening in your teams. Much of it is useful. Some of it carries risks that nobody has examined yet. Banning AI tools tends to push their use out of sight, and saying nothing leaves each person to decide alone. The workable path lies between the two: a small set of clear rules that people can follow on a busy day.

This article explains what the rules currently are and offers a practical structure you can adopt. It is general information, not legal advice. Confirm how the law applies to you with your legal adviser or data protection officer.

What Nigerian law expects today

Nigeria does not yet have an AI-specific law. A Digital Policy Alert report, reflecting information to July 2026, confirms this and lists several AI-related bills before the National Assembly. They include proposals for a national AI commission and a regulatory framework for AI providers. They are proposals, and their final shape is not known. It is sensible to watch them, but do not build your policy around a draft.

The federal government's National Artificial Intelligence Strategy is led by the Federal Ministry of Communications, Innovation and Digital Economy, with the National Information Technology Development Agency (NITDA) as a key implementing body. The published document is dated September 2025 and covers 2025 to 2029. It sets national direction; it does not impose obligations on your organisation.

The law that already applies is the Nigeria Data Protection Act 2023 (NDPA). Whenever an AI tool touches personal data, the Act's ordinary duties apply: a lawful basis, security, and an impact assessment for high-risk processing. Section 37 also limits decisions based solely on automated processing that have legal or similarly significant effects on people. Where such a decision is permitted, the person must be able to obtain human intervention, express their view and contest it. Our separate guide to the NDPA in day-to-day work covers these duties in more detail.

The regulator's direction is clear. On 25 October 2026, the Nigeria Data Protection Commission (NDPC) urged responsible AI use and said people need a lawful basis before uploading others' personal information into AI systems. Three days later, the National Commissioner called for privacy, security and accountability to be built into every stage of AI development and deployment.

The frameworks you meet through partners

Many Nigerian organisations encounter international AI rules indirectly, through a funder's due diligence form, a European customer's contract or a partner's procurement checklist.

The EU AI Act. The Act can apply to providers and deployers outside the EU where the AI system's output is used in the EU. Its timeline changed in 2026. According to the European Commission's AI Act page, updated 19 October 2026:

• prohibited practices and AI literacy duties have applied since 2 February 2025
• obligations for general-purpose AI models have applied since 2 August 2025
• transparency rules took effect in August 2026
• after the "Digital Omnibus" amendment entered into force on 27 July 2026, high-risk obligations for uses such as employment, education and biometrics now apply from 2 December 2027, and those for AI embedded in regulated products from 2 August 2028

If you serve EU markets, ask your adviser whether and how the Act reaches you. Do not assume either way.

The NIST AI Risk Management Framework. The US National Institute of Standards and Technology published this voluntary framework in January 2023. It organises AI risk work into four functions: govern, map, measure and manage. NIST says the framework is being revised.

ISO/IEC 42001. Published in December 2023, this international standard sets out requirements for an AI management system: the policies, roles, risk processes and controls an organisation uses to run AI responsibly. Organisations can seek certification against it from an accredited certification body. Most do not need to start there.

These frameworks differ in legal force, but they ask for similar evidence: you know where AI is used, someone owns it, risks are assessed, people review what matters and problems are recorded. The practices below build that evidence.

Eight practices a mid-sized organisation can adopt

1. Keep an inventory of where AI is used

List every AI tool in use, official or not: what it is, who uses it, for what task and what data goes into it. Make it safe to declare current use, so people report what they actually do rather than what they think is allowed. A spreadsheet is enough to begin.

2. Name an owner for each use

Each entry needs a named person who answers for it: someone who can explain what the tool does, approve changes and pause it if needed. Also name one senior person, often the head of risk or a deputy director, who holds the overall policy.

3. Sort uses into risk tiers

Not everything needs the same scrutiny. Three tiers are usually enough:

• Low: drafting internal notes, summarising public documents, brainstorming. The user checks the output before using it.
• Medium: anything published or sent outside the organisation, such as reports, letters or social posts. A second person reviews it before release.
• High: anything that affects a decision about a person, such as eligibility, hiring, credit, discipline or access to a service. A named person makes and records the decision, a data protection impact assessment is considered, and the use needs approval before it starts.

Consider a hypothetical scholarship agency. Using AI to draft its newsletter is low risk. Using AI to rank applicants is high risk: a person must make each decision, and an applicant must be able to ask for a human review.

4. Set data rules for public AI tools

Most incidents start with what someone pasted. Write a short rule that everyone can remember. For example: never paste personal data, case files, contracts, credentials or unpublished financial information into a public AI tool. Name the approved tools, if any, where more is allowed, and explain why.

5. Ask vendors the same questions every time

Before adopting an AI product, ask: Where is our data processed and stored? Is it used to train the vendor's models? Who can access it? How long is it kept, and how do we get it back or delete it? What happens when the model changes? What testing evidence can you share? Record the answers with the contract.

6. Test before you deploy

For medium and high-risk uses, try the tool on realistic examples before real work depends on it, including difficult and unusual cases. Write down what "good enough" means first, such as acceptable error types, and who signs off. Repeat the test when the tool or the task changes.

7. Log incidents and near misses

Give staff one simple way to report when AI output was wrong, biased, leaked something or misled someone. Log the date, tool, what happened, who was affected and the fix. Some incidents involving personal data may also be breaches with legal reporting duties. Your incident log should connect to that process.

8. Train people on real tasks

Short, practical sessions work better than a policy circulated by email. Use your own scenarios: what may be pasted, how to check a summary against its source and when to escalate. Make the review responsibility explicit. The tool drafts; a person decides.

Starting this month

You do not need all eight at once. A one-page policy covering the risk tiers and data rules, plus a first inventory, gives staff clarity within weeks. Owners, vendor questions, testing and the incident log can follow as you learn where AI is actually used.

The aim is not to slow people down. It is to let useful work continue while making sure that, when something goes wrong, someone knows, someone owns it and someone can fix it.

Where VIS can help

In September 2026, VIS delivered responsible AI training for NIMC and NPC with SudoForce Limited, through the Digital Identity Capability Strengthening Programme. Participants worked through AI risk, assurance and model risk review using a fictional scenario with synthetic data.

We offer practical AI training built around your own tasks, and technology consulting that helps you assess where AI fits, evaluate vendors and set workable review processes. If you want a broader starting picture first, our Vordia readiness assessment also covers cybersecurity and operational readiness.

If your teams are already using AI and you want rules they will actually follow, talk to us about your situation.

• AI governance
• Responsible AI
• NDPA 2023
• EU AI Act
• Risk management
• Nigeria