The instruction usually arrives without much detail. Someone at board level, or a minister, or a managing director has seen what AI can do and wants the organisation to "do something with it". Vendors are already booking demonstrations. A colleague in another agency or bank says they have launched a pilot. You are the person who has to decide where to start and what to spend.

Asking whether your organisation is ready can feel like a delay. In practice, it is what makes the spending useful. You can answer most of the readiness questions in a week, with the people you already have, before any money leaves the budget.

## Why pilots stall

The published evidence points less at the AI model than at what surrounds it. In July 2024, Gartner [predicted that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025](https://www.gartner.com/en/newsroom/press-releases/2024-07-29-gartner-predicts-30-percent-of-generative-ai-projects-will-be-abandoned-after-proof-of-concept-by-end-of-2025). It named four causes: poor data quality, inadequate risk controls, escalating costs and unclear business value. In February 2025, [Gartner reported](https://www.gartner.com/en/newsroom/press-releases/2025-02-26-lack-of-ai-ready-data-puts-ai-projects-at-risk) that 63% of organisations in a survey of 1,203 data management leaders either did not have, or were unsure whether they had, the right data management practices for AI. It predicted that through 2026, organisations would abandon 60% of AI projects that are not supported by AI-ready data.

These are global surveys and forecasts, not Nigerian measurements. The useful point is what they describe: most of the reasons a pilot stalls exist before the first tool is bought. That means you can find them in advance.

## A self-check you can run this week

Start with one candidate use case, not "AI" in general. Readiness depends on the job. An organisation may be ready to draft internal meeting summaries and not ready to answer customer enquiries about account balances.

Gather four to six people, which we come back to below. For each question, record one of three answers: **clear yes**, **partly** or **no / don't know**. Treat "don't know" as a real answer. It usually points to the gap.

The questions are grouped into four areas: digital transformation, cybersecurity, operational excellence and innovation readiness.

### 1. Digital transformation: is the foundation in place?

- Is the information this use case needs already digital, and can someone say exactly where it lives?
- Who owns that information, and could you get a representative sample within a week?
- Do the relevant systems share information, or does it move by email, spreadsheet and paper?

A weak answer sounds like "it's all in the system", followed by nobody being able to name the system. Imagine a hypothetical state agency that wants AI to summarise permit applications. Half the applications arrive as scanned paper forms, and each office uses a different version. The first useful project there is a consistent intake form, not an AI tool.

### 2. Cybersecurity: can you protect what AI will touch?

- Do you know which of this information is personal or sensitive, and is it labelled as such?
- Is there a written rule on what staff may paste into public AI tools?
- If a vendor hosts the system, do you know where your data goes, who can see it, what they keep and how you would get it back?
- Can you see who accessed what, and when?

A weak answer is discovering that staff already use free chatbots with customer or patient information, and nobody has said yes or no. This matters beyond security. In October 2026, the Nigeria Data Protection Commission [urged ministries, departments and agencies](https://ndpc.gov.ng/ndp-act-compliance-ndpc-sets-privacy-benchmarks-for-public-sector-websites-at-2026-bpsr-scorecard/) to prioritise compliance with the Nigeria Data Protection Act 2023. Any AI use case that involves personal data falls within that conversation.

### 3. Operational excellence: is the process clear enough to improve?

- Can you draw the current process on one page, with a named owner at each step?
- Do you measure it today, for example turnaround time, backlog or error rate?
- When the AI output is wrong, who notices, who corrects it and who is accountable?

Without a baseline, you cannot tell whether a pilot helped. Consider a hypothetical bank complaints team that wants AI to classify incoming complaints. Each branch logs complaints differently, and nobody has a current turnaround figure. A pilot there could look promising in a demonstration and still prove nothing.

### 4. Innovation readiness: can the organisation absorb the change?

- Is there a named sponsor with budget authority and time to make decisions?
- Will the people who use the system help shape it, and will they have time to learn it?
- Have you agreed in advance what result would justify expanding the pilot, and what would stop it?
- Can procurement and legal support a small, time-limited pilot, or does every purchase follow a full tender?

A weak answer is a pilot whose success measure is "let's see", or one that frontline staff first hear about on launch day.

## Why IT should not answer alone

It is tempting to hand this checklist to the IT department. IT can speak with authority on systems, integration and security controls. It usually cannot say whether the process works the same way in every branch, whether the records are reliable, what the regulator expects, or whether the clinicians, officers or relationship managers who will use the output will trust it.

A better group includes the business owner of the process, someone from IT or data, someone from risk, compliance or legal, a frontline supervisor and someone from finance or procurement.

The disagreements between them are often the most useful result. If IT rates the data "good" and operations says half the records are re-keyed by hand, that gap is exactly where a pilot would have stalled. It is better to find it in a meeting room than three months into a vendor contract.

## Reading your results

- **Mostly clear yes:** choose a narrow pilot, record the baseline and agree the stop rule before you start.
- **A mix:** close the gaps first. A data clean-up, a staff usage policy or a one-page process map often costs less than the tool and makes the eventual pilot easier to judge.
- **Mostly no or don't know:** hold the tool budget. The most valuable spend right now is on foundations, and that work will serve any technology you adopt later.

None of these outcomes means you are behind. They mean you know where you stand, and you can explain your decision to the people who asked you to "do something with AI".

## If you want a structured version

A self-check like this is a good start, but it depends on who is in the room and how candid they are. If you want a more structured picture, VIS offers **Vordia**, an organisational readiness assessment that covers the same four areas: digital transformation, cybersecurity, operational excellence and innovation readiness.

Vordia collects input from several stakeholders, not just one department. It produces a gap analysis, readiness dashboards and an executive report you can take to leadership. It also includes progress tracking, so you can follow the gaps as you work on them.

The guided conversational assessment costs **NGN 29,000** for the first five organisations that sign up by 28 November 2026. Places at this launch price are limited to five organisations. After that, the price is NGN 49,000. If you would prefer a one-on-one or in-person assessment, VIS prices it according to your requirements.

[Request a Vordia assessment](https://www.vorbtech.com.ng/solutions/products/vordia) and the team will reply within two business days. They will walk you through how it works and agree with you whether it is the right first step.

Whichever route you take, run the check before you sign the next AI contract. You will spend with more confidence, and you will have a clear answer when someone asks why you started where you did.


Before you spend on AI, check whether you are ready

A programme officer uses a chatbot to tidy a donor report the night before it is due. Someone in HR tries an AI tool to sort 400 applications. A finance analyst pastes a supplier spreadsheet into a free assistant to find duplicates. Nobody asked permission, because nobody said permission was needed.

If you lead an organisation, a ministry or a programme, this is probably already happening in your teams. Much of it is useful. Some of it carries risks that nobody has examined yet. Banning AI tools tends to push their use out of sight, and saying nothing leaves each person to decide alone. The workable path lies between the two: a small set of clear rules that people can follow on a busy day.

This article explains what the rules currently are and offers a practical structure you can adopt. It is general information, not legal advice. Confirm how the law applies to you with your legal adviser or data protection officer.

## What Nigerian law expects today

**Nigeria does not yet have an AI-specific law.** A [Digital Policy Alert report](https://digitalpolicyalert.org/report/nigeria-ai-governance-approach), reflecting information to July 2026, confirms this and lists several AI-related bills before the National Assembly. They include proposals for a national AI commission and a regulatory framework for AI providers. They are proposals, and their final shape is not known. It is sensible to watch them, but do not build your policy around a draft.

The federal government's [National Artificial Intelligence Strategy](https://oecd.ai/en/dashboards/policy-initiatives/national-artificial-intelligence-strategy-nais) is led by the Federal Ministry of Communications, Innovation and Digital Economy, with the National Information Technology Development Agency (NITDA) as a key implementing body. The published document is dated September 2025 and covers 2025 to 2029. It sets national direction; it does not impose obligations on your organisation.

The law that already applies is the [Nigeria Data Protection Act 2023](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf) (NDPA). Whenever an AI tool touches personal data, the Act's ordinary duties apply: a lawful basis, security, and an impact assessment for high-risk processing. Section 37 also limits decisions [based solely on automated processing](https://www.adeolaoyinlade.com/en/?p=2681) that have legal or similarly significant effects on people. Where such a decision is permitted, the person must be able to obtain human intervention, express their view and contest it. Our separate guide to [the NDPA in day-to-day work](https://www.vorbtech.com.ng/blog/ndpa-gaid-day-to-day-compliance) covers these duties in more detail.

The regulator's direction is clear. On 25 October 2026, the Nigeria Data Protection Commission (NDPC) [urged responsible AI use](https://von.gov.ng/ndpc-urges-responsible-ai-use-data-protection/) and said people need a lawful basis before uploading others' personal information into AI systems. Three days later, the National Commissioner [called for privacy, security and accountability](https://techreviewafrica.com/news/8001/nigeria-data-protection-commissioner-calls-for-privacy-and-cybersecurity-in-ai-development) to be built into every stage of AI development and deployment.

## The frameworks you meet through partners

Many Nigerian organisations encounter international AI rules indirectly, through a funder's due diligence form, a European customer's contract or a partner's procurement checklist.

**The EU AI Act.** The Act can apply to providers and deployers outside the EU [where the AI system's output is used in the EU](https://artificialintelligenceact.eu/article/2/). Its timeline changed in 2026. According to the [European Commission's AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), updated 19 October 2026:

- prohibited practices and AI literacy duties have applied since 2 February 2025
- obligations for general-purpose AI models have applied since 2 August 2025
- transparency rules took effect in August 2026
- after the "Digital Omnibus" amendment entered into force on 27 July 2026, high-risk obligations for uses such as employment, education and biometrics now apply from 2 December 2027, and those for AI embedded in regulated products from 2 August 2028

If you serve EU markets, ask your adviser whether and how the Act reaches you. Do not assume either way.

**The NIST AI Risk Management Framework.** The US National Institute of Standards and Technology published this [voluntary framework](https://www.nist.gov/itl/ai-risk-management-framework) in January 2023. It organises AI risk work into four functions: govern, map, measure and manage. NIST says the framework is being revised.

**ISO/IEC 42001.** Published in December 2023, this [international standard](https://www.iso.org/standard/42001) sets out requirements for an AI management system: the policies, roles, risk processes and controls an organisation uses to run AI responsibly. Organisations can seek [certification against it](https://www.dqsglobal.com/en/explore/dqs-knowledge-center/iso-42001-explained) from an accredited certification body. Most do not need to start there.

These frameworks differ in legal force, but they ask for similar evidence: you know where AI is used, someone owns it, risks are assessed, people review what matters and problems are recorded. The practices below build that evidence.

## Eight practices a mid-sized organisation can adopt

### 1. Keep an inventory of where AI is used

List every AI tool in use, official or not: what it is, who uses it, for what task and what data goes into it. Make it safe to declare current use, so people report what they actually do rather than what they think is allowed. A spreadsheet is enough to begin.

### 2. Name an owner for each use

Each entry needs a named person who answers for it: someone who can explain what the tool does, approve changes and pause it if needed. Also name one senior person, often the head of risk or a deputy director, who holds the overall policy.

### 3. Sort uses into risk tiers

Not everything needs the same scrutiny. Three tiers are usually enough:

- **Low:** drafting internal notes, summarising public documents, brainstorming. The user checks the output before using it.
- **Medium:** anything published or sent outside the organisation, such as reports, letters or social posts. A second person reviews it before release.
- **High:** anything that affects a decision about a person, such as eligibility, hiring, credit, discipline or access to a service. A named person makes and records the decision, a data protection impact assessment is considered, and the use needs approval before it starts.

Consider a hypothetical scholarship agency. Using AI to draft its newsletter is low risk. Using AI to rank applicants is high risk: a person must make each decision, and an applicant must be able to ask for a human review.

### 4. Set data rules for public AI tools

Most incidents start with what someone pasted. Write a short rule that everyone can remember. For example: never paste personal data, case files, contracts, credentials or unpublished financial information into a public AI tool. Name the approved tools, if any, where more is allowed, and explain why.

### 5. Ask vendors the same questions every time

Before adopting an AI product, ask: Where is our data processed and stored? Is it used to train the vendor's models? Who can access it? How long is it kept, and how do we get it back or delete it? What happens when the model changes? What testing evidence can you share? Record the answers with the contract.

### 6. Test before you deploy

For medium and high-risk uses, try the tool on realistic examples before real work depends on it, including difficult and unusual cases. Write down what "good enough" means first, such as acceptable error types, and who signs off. Repeat the test when the tool or the task changes.

### 7. Log incidents and near misses

Give staff one simple way to report when AI output was wrong, biased, leaked something or misled someone. Log the date, tool, what happened, who was affected and the fix. Some incidents involving personal data may also be breaches with legal reporting duties. Your incident log should connect to that process.

### 8. Train people on real tasks

Short, practical sessions work better than a policy circulated by email. Use your own scenarios: what may be pasted, how to check a summary against its source and when to escalate. Make the review responsibility explicit. The tool drafts; a person decides.

## Starting this month

You do not need all eight at once. A one-page policy covering the risk tiers and data rules, plus a first inventory, gives staff clarity within weeks. Owners, vendor questions, testing and the incident log can follow as you learn where AI is actually used.

The aim is not to slow people down. It is to let useful work continue while making sure that, when something goes wrong, someone knows, someone owns it and someone can fix it.

## Where VIS can help

In September 2026, VIS delivered responsible AI training for NIMC and NPC with SudoForce Limited, through the Digital Identity Capability Strengthening Programme. Participants worked through AI risk, assurance and model risk review using a fictional scenario with synthetic data.

We offer practical AI training built around your own tasks, and technology consulting that helps you assess where AI fits, evaluate vendors and set workable review processes. If you want a broader starting picture first, our [Vordia readiness assessment](https://www.vorbtech.com.ng/solutions/products/vordia) also covers cybersecurity and operational readiness.

If your teams are already using AI and you want rules they will actually follow, [talk to us about your situation](https://www.vorbtech.com.ng/contact-us).


Setting AI rules in Nigeria without stopping useful work

The demonstration went well. The assistant found the right clause in a tender document in seconds, and the leadership team asked when everyone could use it. Then the harder questions arrived. Which documents is it allowed to read? Who checks its answers? What happens when it is wrong on a Friday afternoon, and who switches it off?

An AI demonstration can produce an impressive answer in seconds. Making that capability dependable inside an organisation takes more work: clear ownership, suitable data, measurable performance, security controls and a process for handling mistakes.

For Nigerian businesses and public-sector institutions, this means connecting those requirements to everyday service delivery. The objective might be faster document processing, better access to internal knowledge or more consistent customer support. Success depends on whether the work improves under real operating conditions, not in the demonstration room.

## Start with a workflow and a measurable problem

Begin with a task people already perform. Identify who does it, what information they use, where delays occur and what happens when something goes wrong. This creates a practical basis for deciding whether AI belongs in the process.

A procurement team, for example, might need help locating clauses across tender documents. An AI assistant could retrieve relevant passages and prepare a comparison for an officer to review. Its responsibility should be explicit: helping someone examine evidence, with approval retained by the authorised decision-maker.

Before building, record a baseline. Useful measures include handling time, correction rates, unresolved cases and cost per completed task. Choose a small set that reflects the operational problem. These measures will help determine whether the system earns its place in the workflow.

## Decide whether AI is the right tool

Some problems are better solved through clearer forms, database queries, search or fixed business rules. Where the inputs and required outputs are predictable, conventional automation may be easier to test and maintain.

AI can be useful when work involves varied language, documents, images or other inputs that are difficult to handle through rules alone. Even then, it often belongs within a larger software process.

Consider invoice processing. Software can validate required fields and check totals, while AI assists with extracting information from inconsistent layouts. Exceptions can go to a reviewer. Each component has a defined job, making failures easier to locate and correct.

## Prepare data and preserve access boundaries

An AI system cannot reliably compensate for outdated policies, conflicting records or unclear document ownership. Teams need to know which sources are authoritative, who maintains them and how changes reach the application.

For an internal knowledge assistant, preparation may involve removing duplicate documents, marking superseded guidance and assigning owners to important collections. Retrieval should lead users to the underlying material so they can inspect the evidence.

### Access should follow the user

Connecting an assistant to organisational data must preserve existing permissions. A member of staff should not gain access to confidential records simply because the assistant can search a larger collection.

Map the full data journey: inputs, retrieved documents, model providers, logs, backups and support access. Decide what information may enter the system, how long it is retained and who can inspect it. Provider terms and applicable Nigerian data-protection obligations require verification for the specific deployment.

## Define accountability before rollout

Assign a business owner who is responsible for the workflow’s outcomes and an engineering owner who maintains the application. Identify who handles security, data quality, user support and incidents. Smaller organisations may combine roles, but the responsibilities should remain explicit.

Also define the boundary between assistance and authority. Drafting correspondence has different consequences from sending it. Summarising an application differs from deciding eligibility for a public service.

Human review must be workable. Reviewers need access to source material, enough time to examine outputs and a clear way to reject or escalate them. A mandatory approval button offers little protection if staff cannot assess what they are approving.

## Evaluate against realistic cases

A convincing demonstration is not sufficient evidence for production use. Build an evaluation set from representative work, using appropriate permissions and removing sensitive information where necessary.

Include ordinary cases, incomplete records, ambiguous requests and inputs the system should decline or escalate. Where relevant, test scanned documents, local terminology and the languages users actually need.

Assess separate dimensions of quality. A response may sound fluent while misunderstanding the request or citing a passage that does not support its conclusion. Document extraction needs field-level checks; knowledge assistance needs checks for source accuracy and appropriate handling of missing evidence.

Set acceptance criteria before reviewing results. Repeat evaluations when models, prompts, source collections or integrations change. Keep some evaluation cases separate from development examples to check performance beyond familiar inputs.

## Build controls around the model

Treat model output as untrusted input to the rest of the application. Validate required fields, check business rules and restrict which actions the system can request. Retrieved documents and user submissions may contain instructions that attempt to redirect the model; they should not determine its permissions.

For systems that can take actions, use narrowly scoped credentials and enforce authorisation outside the model. Require approval where the consequences justify it, such as releasing payments or sending official communications.

Reliability also requires timeouts, sensible retry limits and a fallback process. If a provider becomes unavailable or a response fails validation, users should know whether to retry, continue manually or escalate. Avoid silently presenting an incomplete result as a completed task.

## Introduce AI through a controlled rollout

Start with a limited group and a bounded workload. Where practical, run the system alongside the existing process so teams can compare results before depending on it.

Train users on the actual workflow: what the tool can do, how to check its outputs and when to report a problem. Provide a feedback mechanism that captures the task and failure without unnecessarily exposing personal or confidential information.

For Nigerian deployments, assess the conditions of the intended users. Connectivity, device availability, document quality and support arrangements should be tested at participating offices. These conditions vary by organisation and location; rollout plans should follow observed needs.

## Monitor service quality and total cost

Once live, monitor completion rates, corrections, escalations, response times and service failures. Review samples of outputs because technical availability alone does not establish accuracy or usefulness.

Calculate costs across the complete workflow. Include model usage, infrastructure, integration maintenance, human review, support and rework. A low price per request can still produce an expensive service if many outputs need correction.

Establish a regular review of performance and incidents. Give an owner authority to pause the service or restore a previous configuration when agreed thresholds are breached.

## Make expansion an evidence-based decision

Expand when the first workflow meets its acceptance criteria and the organisation can support it. Each new use case needs its own assessment of data, consequences and operating conditions. What worked for internal knowledge search does not automatically transfer to decisions about citizens or customers.

## Where VIS can help

At Vorbtech Innovative Solutions (VIS), we build AI and software systems that are meant to be used every day, not just demonstrated. For a team moving from pilot to production, useful outputs from that work include a workflow assessment, an evaluation set with agreed acceptance criteria, an access-control design and an operating runbook that says who owns what when something goes wrong. Together they make the proposed service concrete enough to review, fund and manage.

If you are not yet sure your organisation is ready for a pilot at all, start with our article on [checking AI readiness before you spend](https://www.vorbtech.com.ng/blog/ai-readiness-before-ai-spending). If a pilot is already working and the question is how to rely on it, [discuss it with us](https://www.vorbtech.com.ng/contact-us).


From AI pilot to a service your team can rely on

In many organisations, the Nigeria Data Protection Act 2023 (NDPA) lives in a folder owned by the legal team. Meanwhile, personal data lives everywhere else: the admissions form, the HR spreadsheet, the customer database, the vendor tool someone signed up for last year, and the laptops staff take home.

That gap matters because the regulator's questions are mostly operational. When the Nigeria Data Protection Commission (NDPC) sent a 21-day compliance notice to tertiary institutions in February 2026, it asked for evidence of audit filings, a data protection officer, registration and [a summary of the technical and organisational measures protecting personal data](https://uubo.org/wp-content/uploads/2026/03/Regulatory-Alert-Nigeria-Data-Protection-Act-2023-NDPA-and-the-General-Application-and-Implementation-Directive-2025-GAID.pdf). Those are things your operations and IT teams either can or cannot show.

This guide translates the [NDPA](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf) and the NDPC's [General Application and Implementation Directive (GAID) 2025](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf) into everyday work. It is general information, not legal advice; confirm how it applies to you with your legal adviser or data protection officer (DPO).

## Know what you hold, and why

Every use of personal data needs a lawful basis. Section 25 of the Act lists six: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. If you rely on consent, you carry the burden of proving it, and silence or inactivity does not count (section 26).

In practice, this means a data inventory. For each system, record what personal data it holds, why, which lawful basis applies, who can access it, where it is stored, which vendors touch it and how long you keep it. Most of the obligations below depend on this list.

## Check whether you are "of major importance"

Several duties apply only to data controllers and processors of major importance. The NDPC's [updated registration guidance notice](https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf) includes organisations that process the personal data of more than 200 people in six months, and those operating in listed sectors such as education, health, financial services and public service. It sorts them into three tiers: Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL).

If you fall within these categories:

- **Register** with the NDPC, and notify it of significant changes within 60 days (section 44).
- **Designate a DPO** with expert knowledge of data protection law and practice (section 32). The DPO may be an employee or engaged under a service contract.
- **File Compliance Audit Returns** annually by 30 May if you are UHL or EHL, through a licensed Data Protection Compliance Organisation, unless the NDPC approves otherwise (GAID Article 10).

The GAID also expects every controller and processor to conduct a compliance audit within 15 months of starting business, and annually after that (Article 7).

Tier also affects the stakes. Where the NDPC finds a violation, the maximum penalty or remedial fee it can order for an organisation of major importance is the greater of ₦10 million or 2% of the previous year's annual gross revenue (section 48). For other organisations, it is the greater of ₦2 million or 2%.

## Make rights requests routine

People can ask whether you process their data, why, who receives it and how long you keep it, and request a copy in a commonly used electronic format (section 34). The Act requires this "without constraint or unreasonable delay". The GAID asks organisations to design systems that make access, correction and data portability straightforward, and to explain how people can complain (Article 7).

The operational test is simple: could your team find everything you hold about one person, across every system, within days rather than weeks?

## Assess high-risk processing before you start

Where processing is likely to pose a high risk to people's rights, the Act requires a data privacy impact assessment (DPIA) before processing begins (section 28). The GAID makes a DPIA mandatory, and to be filed with the Commission, in specific situations (Article 28). These include:

- student or pupil records in educational services
- health care and hospitality services
- financial services that process personal data through digital devices
- surveillance cameras in places the public can access
- sensitive personal data or vulnerable people
- cross-border data transfers

For schools, hospitals, banks and public bodies, a new system or vendor will often trigger this step.

## Treat security as an engineering task

Section 39 requires "appropriate technical and organisational measures" to protect personal data. Appropriateness depends on the volume and sensitivity of the data, the potential harm and the size of the organisation. The Act's examples include encryption, pseudonymisation, the ability to restore access after an incident, and regular testing of whether the measures work.

In day-to-day terms, this means knowing who can access which records, removing access when people leave, protecting devices that store personal data, and testing backups.

## Prepare for a breach before it happens

When a breach is likely to put people's rights at risk, the controller must notify the NDPC within 72 hours of becoming aware of it (section 40). If the risk to individuals is high, the controller must also tell them immediately, in plain language. Processors must inform the controller as soon as they become aware of a breach. Every breach must be recorded, whether or not it is reported. The NDPC runs an [online breach reporting portal](https://services.ndpc.gov.ng/breach/).

Seventy-two hours is short if nobody knows who decides. Agree in advance who assesses an incident, who reports it and what information they need.

## Put vendors and transfers in writing

When a processor handles personal data for you, section 29 requires a written agreement. The GAID lists what it should cover, including purpose, location of processing, lawful basis, security measures and evidence of the vendor's NDPA compliance (Article 34).

Transfers outside Nigeria, including many cloud and software services, need an adequate level of protection or one of the conditions in section 43, and you must record the basis you rely on (section 41).

## Give the work an owner

The GAID expects the DPO to report directly to management and to compile a semi-annual data protection report for management (Articles 12 and 13). It also expects staff training within six months of starting business and at least annually after that, a published privacy policy, and a cookie notice on the website's homepage that lets visitors accept or decline (Article 7). In June 2026, the NDPC added a [guidance notice on continuing professional development for DPOs](https://ndpc.gov.ng/wp-content/uploads/2026/06/Guidance-Notice-on-CPD-for-Data-Protection-Officers.pdf).

## A 30-day starting plan

You will not finish compliance in a month. You can, however, replace uncertainty with a clear list of gaps and owners.

**Week 1: ownership and status**
- Name an accountable executive and confirm who acts as DPO.
- Ask your legal adviser or DPO to confirm whether you are of major importance, and in which tier.
- Collect what already exists: privacy policy, registration records, past audit filings and vendor contracts.

**Week 2: inventory**
- Map your five most important systems: data held, purpose, lawful basis, access, location, vendors and retention.
- Note any processing that falls into the GAID's mandatory DPIA list.

**Week 3: vendors and access**
- List every vendor that handles personal data and check for a written agreement.
- Mark which vendors store or process data outside Nigeria.
- Review who has access to your most sensitive records and remove what is no longer needed.

**Week 4: response and reporting**
- Write a one-page breach procedure with names, the 72-hour clock and the reporting route.
- Set up one intake channel for rights requests and a way to search across systems.
- Schedule staff training and present the gap list to management, with owners and dates.

## Where VIS can help

Much of this work is technical: building the data inventory, controlling access, securing systems and making records findable. VIS's [cybersecurity](https://www.vorbtech.com.ng/services/cybersecurity) service covers security audits, penetration testing, secure authentication and compliance implementation support, within an agreed scope and written authorisation. Our [data engineering](https://www.vorbtech.com.ng/services/data-engineering) work helps organisations bring scattered data into pipelines and stores with clear ownership.

We do this alongside your legal advisers and DPO. VIS does not provide legal advice or certify compliance; our role is to help put the technical measures in place and make them easier to evidence.

If your team has started the inventory and found more systems than expected, [talk to us about the work](https://www.vorbtech.com.ng/contact-us).


What the NDPA asks of your team, day to day

The registration window opens on Monday. The adverts are out, the link is circulating on WhatsApp, and thousands of people will try to submit forms in the first few hours. If you are accountable for that portal, a quiet question probably sits at the back of your mind: what happens if it goes down, gets defaced or leaks applicants' data on the busiest day of the year?

You do not need to be a security specialist to answer it well. You need to know which checks matter most, what to ask your team or vendor, and who does what if something goes wrong. October is Cybersecurity Awareness Month, which makes this a good moment to ask. The checks are just as useful in any month before a busy window.

## Secure matters. Recoverable matters just as much.

No team can promise that a service will never be attacked. What you can control is how hard you make it, how quickly you notice, and how fast you can return to a state you trust. The US National Institute of Standards and Technology's [Cybersecurity Framework 2.0](https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework) organises this into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Half of them concern what happens after something has gone wrong.

The checks below are ordered roughly by how much risk they remove for the effort involved.

## Eight checks to run or ask about

### 1. Who has admin access, and is MFA switched on?

Ask for a list of every account that can change content, settings or data. Include vendor accounts, former staff and shared logins such as "admin@". Each account should belong to a named person who still needs it, and each should use multi-factor authentication (MFA). The US Cybersecurity and Infrastructure Security Agency (CISA) [encourages phishing-resistant MFA](https://www.cisa.gov/MFA) but is clear that "any MFA is better than no MFA". Broken access control is first on the [OWASP Top 10:2025](https://top10.owasp.org/2025/), the widely used list of web application risks.

*Hypothetical example:* a programme portal still has an active admin login for a contractor who left eighteen months ago, with no second factor. Nobody was negligent; nobody was asked to check. A ten-minute review closes the gap.

**Ask:** "Please send me the list of admin accounts and confirm MFA is enforced on each one."

### 2. Is the software, and everything it depends on, up to date?

Portals are assembled from frameworks, content management systems, plugins and libraries. A weakness in any of them becomes a weakness in your service, which is why OWASP lists software supply chain failures third in 2025.

**Ask:** "Who watches for security updates to our platform and plugins, and how quickly are critical fixes applied?" Update before a peak period, not during it.

### 3. Do the backups actually restore?

A backup you have never restored is a hope, not a plan. The UK National Cyber Security Centre's (NCSC) [guidance on preparing technical recovery](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/preparing/3-prepare-technical-recovery) advises storing backups separately from primary systems, making them immutable where possible because attackers target them, and regularly testing restoration "to ensure they function as expected".

*Hypothetical example:* a team runs nightly backups for a year. The first real restore shows that the backup holds the database but not the uploaded files: the ID scans and certificates applicants submitted. Every applicant would need to upload again.

**Ask:** "When did we last restore from backup, how long did it take, and did it include uploaded documents?"

### 4. Does someone read the alerts?

Unread logs protect nobody. OWASP's 2025 list includes "Security Logging and Alerting Failures" for this reason. Agree a short list of events that should reach a person: repeated failed admin logins, a new admin account, changes to public pages, sudden traffic spikes and the site going offline. A simple uptime alert that reaches two named phones is worth more than a sophisticated dashboard nobody opens.

**Ask:** "Who receives our alerts, including at weekends during a registration window, and what do they do next?"

### 5. Collect only the personal data you need, and protect what you keep

Registration forms often gather names, phone numbers, identity numbers, bank details and uploaded documents. Ask whether each field is needed, who can export applicant data, whether data is encrypted in transit and at rest, and when it will be deleted.

In Nigeria, the stakes are also legal. Under [section 40 of the Nigeria Data Protection Act 2023](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf), a data controller must notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a breach that is likely to result in a risk to people's rights and freedoms. Where the risk to individuals is high, they must be told immediately, in plain language. A vendor processing data on your behalf must notify you when it becomes aware of a breach. The clock starts when your organisation becomes aware, not when the investigation ends, so the people who would make that call need to know in advance who they are. Your data protection officer or legal adviser should confirm how these duties apply to your service.

### 6. What can your vendors reach?

Your hosting provider, developer, SMS gateway, payment provider and analytics tools may all touch the service or its data.

**Ask:** "Which vendors have access, through which accounts, and with MFA? Does each contract require prompt notice of a breach? Is access removed when an engagement ends?"

### 7. Write a one-page incident plan

Without a plan, the first hour of an incident goes on working out who is in charge. A one-page plan answers three questions:

- **Who decides?** For example, who can take the portal offline or extend a deadline.
- **Who communicates?** With applicants, leadership, partners and, where required, regulators.
- **How do we restore?** Which backup, who carries out the restore, and roughly how long it takes.

Add contact details for your vendor, hosting provider, data protection officer and legal adviser. Nigeria's national computer emergency response team, [ngCERT](https://cert.gov.ng/), receives reports of cyber incidents; ask your legal adviser which reporting routes apply to you. Then rehearse the plan once, around a table, for thirty minutes. The NCSC's free [Exercise in a Box](https://www.ncsc.gov.uk/information/exercise-in-a-box) shows how simple such an exercise can be.

### 8. Will it hold on the busiest day?

The NCSC's [denial of service guidance](https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection) begins with four practices: understand your service, understand your defences, create a response plan and test your response. The same thinking applies to the ordinary rush of genuine users.

*Hypothetical example:* a scholarship portal closes at midnight on Friday, and many applicants arrive in the final hours. Pages slow down, people resubmit, and duplicate records pile up. An honest status message and a deadline extension agreed in advance would have helped as much as extra servers.

**Ask:** "What peak load do we expect, have we tested at that level, and what does a user see if the site is slow?"

## A short list for this week

Before your next busy window, confirm that:

- Every admin account is named, needed and protected by MFA.
- Critical updates are applied and a change freeze is agreed for the peak.
- A restore has been tested recently and included uploaded files.
- Alerts reach a named person, including at weekends.
- Someone owns breach notification and understands the 72-hour rule.
- Vendor access is listed and reviewed.
- A one-page incident plan exists and has been rehearsed.
- The portal has been tested at the expected peak load.

None of this needs a large budget. It needs someone to ask, and someone to own each answer.

## Where VIS can help

At Vorbtech Innovative Solutions (VIS), we design, build and secure digital services. Our work includes the portal and workflow design for the [Nigeria Youth Investment Fund](https://www.vorbtech.com.ng/portfolio/nyif-portal) application journey, connecting submissions, supporting documents and reviewer activity, and responsive registration and engagement for delegates, exhibitors, sponsors and media at the [Niger State Green Economy Summit](https://www.vorbtech.com.ng/portfolio/niger-green-economy-summit).

Our [cybersecurity work](https://www.vorbtech.com.ng/services/cybersecurity) covers security audits, penetration testing, compliance implementation support, secure authentication and data protection, always within an agreed scope and with written authorisation. When a defined part of the work needs specialist depth, we work with our cybersecurity partner, CyberPlural.

If you would like a second pair of eyes before your next busy window, [discuss your service with us](https://www.vorbtech.com.ng/contact-us). We will start with how the service works and who relies on it, then agree what to check first.


Eight checks to keep your public portal secure and recoverable

It is Thursday evening and the investigation runs on Sunday. The draft is strong. Then the editor stops at the third paragraph and asks a simple question: where does this figure come from?

The reporter knows it is right. She remembers finding it. But the line in the draft came from a colleague's summary, which came from a shared document, which drew on a spreadsheet someone built from a set of procurement PDFs three weeks ago. The link to the original filing is somewhere in a WhatsApp thread. Forty minutes later, the team finds it. The figure holds. Nobody has time to check the other eleven.

That scene is hypothetical, but most editors and investigations leads will recognise it. The evidence was never lost. The trail around it was.

## Where source context goes missing

Investigations rarely slow down because a team cannot find information. They slow down because the evidence, its translations, the AI-assisted summaries and the editorial decisions end up in different places.

### Claims detach from their sources

A useful excerpt is copied into a planning document. The sentence survives; the URL, page number, date and surrounding context do not. Weeks later it reads like an established fact, and nobody can say whether it came from the filing itself or from a news report about the filing.

### Research gets repeated

A researcher spends a morning establishing which companies share a director. A week later, a reporter on the same project does it again, because the first result sits in someone's notebook and there is no shared record of what has been checked, translated or ruled out. Research teams in NGOs and institutions see the same thing when a policy brief is updated by someone who was not on the original project.

### Translations lose their reasoning

A key document or interview is translated from Hausa, Yoruba, Igbo, Pidgin or French. The translator makes a judgement call on an ambiguous phrase: did the speaker mean the money was promised, or that it was paid? The English version goes forward. The judgement call does not. When a lawyer or editor questions the line, the reasoning has to be rebuilt from memory, if it can be.

### AI summaries cannot be traced back

Someone runs a 200-page audit report through an AI tool and gets a tidy two-page summary, useful for orientation. But it does not say which pages each point came from, and one point merges two separate findings into a single claim. Once it is pasted into the working notes, it starts to look like evidence.

None of this is carelessness. It is what happens when capable people move fast across chat, email, shared folders, translation tools and AI assistants, each holding its own fragment of the story.

## Why it matters beyond the deadline

When the trail breaks, the cost appears in three places. Editors spend pre-publication time reconstructing provenance instead of testing the argument. Legal review becomes slower and less confident, because the team cannot quickly show what supports each sensitive claim. And the story's credibility rests on facts that only one person can vouch for, which is fragile when that person is on leave, has moved on or is simply exhausted.

For research teams, a finding in a policy brief has to stand up when someone asks where it came from, months after the analyst who produced it has changed roles.

## A two-minute workflow test

Choose one important conclusion in a current investigation or research project, and ask:

**Can an editor trace this conclusion to its original source, see how it was interpreted and know who approved it, in under two minutes?**

Run it on three or four claims, including one that relied on a translation and one that passed through an AI-assisted summary. If the answer is consistently yes, your workflow is doing its job. If not, the gap is rarely a single tool. It is continuity: the source, its interpretation and the decision about it live in different places.

## Habits that keep evidence traceable

These practices work with the tools you already have. A shared spreadsheet and a disciplined folder structure can carry most of them.

### Keep a source log from the first search

Give each source a short identifier and record where it came from, when it was retrieved, who found it and, where possible, an archived copy. Cite the identifier in working notes and drafts. A claim with an identifier can be traced. A claim without one is a lead, not evidence.

### Record provenance for AI-assisted work

Treat AI output as a pointer to evidence, not as evidence. The Associated Press set this out plainly in its [standards around generative AI](https://www.ap.org/the-definitive-source/behind-the-news/standards-around-generative-ai/) in August 2023: "Any output from a generative AI tool should be treated as unvetted source material." In practice, note which tool produced a summary, which document it was based on and who checked each point against the original pages. If a point cannot be matched to a page, it stays out of the draft.

### Write translation notes

Alongside each translated document or interview, record the translator, the source language and any phrase where the meaning was uncertain, with the alternatives considered. Machine translation can give a fast first pass across a large set of documents, but a fluent speaker should review every passage the story relies on.

### Leave handoff notes

When a strand of research changes hands, the next person needs to know what has been checked, ruled out and left open. Three short lines are often enough. They prevent the repeated morning of work, and the quiet assumption that something was verified when it was only found.

### Set review checkpoints

Agree in advance where an editor signs off on a claim: for example, when it enters the draft and again before legal review. Record who approved it and when. The [Paris Charter on AI and Journalism](https://rsf.org/en/paris-charter-ai-and-journalism), published by Reporters Without Borders and partner organisations in November 2023, is direct about this: media outlets "are liable and accountable for every piece of content they publish", and responsibilities tied to AI use should be "assigned to humans". A checkpoint makes that responsibility visible.

## Using AI without losing the trail

AI can help a small team read more: summarising long documents, producing first-pass translations and showing where a name appears across hundreds of pages. For newsrooms with limited staff and large public records, that is a real gain.

The condition is that speed does not cost the trail. Every AI-assisted step should point back to the material it drew on, and a named person should review whatever the story relies on. The Paris Charter says human decision-making "must remain central" to both long-term strategy and daily editorial choices. That is a workflow requirement as much as an ethical one. A reviewer can only exercise judgement if they can see what the AI was working from.

## Where Argus fits

Argus, the VIS research and document workspace, is built for teams whose material is scattered across tools. It has six modules: Command organises the assignment, Insight analyses documents, Digest produces source-linked summaries, Lingua translates, Query answers questions across the collection and Nexus supports collaboration. It does not replace editorial judgement or verification. People review what it produces.

For investigative teams, VIS is running a founding newsroom pilot, now open for applications. The terms are:

- one Nigeria-based investigative newsroom
- six weeks, with up to 10 named users and all six modules
- a fixed fee of NGN 1,500,000
- public, non-sensitive material only, so it suits a public-records investigation rather than work involving confidential sources

The pilot is an application, not a purchase. Taking part requires a readiness review and a signed order form. Scorecard targets are agreed with your team against a baseline of how you work today, so the evaluation starts from your own workflow.

If this sounds like your newsroom's week, you can [apply for the Argus founding newsroom pilot](https://www.vorbtech.com.ng/solutions/products/argus/pilot). If you lead a research or information team in an NGO or institution, or would rather talk through your workflow first, [discuss your Argus workflow with us](https://www.vorbtech.com.ng/contact-us).

Either way, run the two-minute test on your current project this week. It will show you where the trail breaks, and that is the right place to start, with or without new software.


Can your editor trace that claim in two minutes?

It is Monday morning, and a sales team in Lekki has nine new units to list by Friday. The photos came from the site manager's phone. Half are dim, two are tilted, and a mop bucket is standing in the corner of the best living-room shot. The two portals want one format, Instagram wants another, and the WhatsApp broadcast needs a flyer. Someone will write the description again, from scratch, for the ninth time this month.

Then somebody suggests using AI to "clean the photos up", and the room goes quiet, because nobody is sure how far that should go.

That scene is hypothetical, but if you post listings in Lagos, Abuja or Port Harcourt, parts of it will probably feel familiar. This article sets out a practical way to answer that question before the next batch of photos arrives.

## The listing work nobody sees

Most of the effort in property marketing goes into work that buyers never notice until it goes wrong. Photos arrive from different phones, at different times of day. Edits sit in a queue with whoever knows the software. The same facts about bedrooms, service charge and parking are rewritten for every portal, post and flyer, and each version drifts a little from the last.

The result is a portfolio that looks as though several different companies produced it. One listing is bright and well cropped. The next is grey and sideways. The description on Instagram mentions a feature that the portal listing leaves out. None of this comes from carelessness. It comes from many people doing a repeated job without a shared standard.

AI tools can help with much of this work. They can correct exposure, straighten verticals, resize images for each channel and draft copy in seconds. The problem is that the same tools can also add a sea view, remove a crack or replace tired tiles with marble. That is why the speed only helps if you decide in advance what the tools are allowed to change.

## Why honest listings are the stronger listings

A buyer or renter who arrives at a viewing and finds a smaller room, a different view or plainer finishes than the photos showed does not just lose an afternoon. They stop trusting the photos on your next listing too, and they may tell others why. A reputation for showing properties as they are takes years to build and one bad viewing to dent.

Some portals and regulators already draw the line. Nigeria Property Centre's [guidance on valid and invalid pictures](https://propertycentre.helpscoutdocs.com/article/37-valid-invalid-pictures-for-property-listings) treats doctored images, whether something has been added or something has been taken out, as invalid. It also rejects 3D images unless the listing says that the property is off-plan or under construction. Invalid pictures are removed, and accounts that keep uploading them may be flagged for review and eventually disabled.

The Advertising Regulatory Council of Nigeria (ARCON) names "visual or verbal exaggerations" among the advertising abuses in its [vetting guidelines](https://advertcouncil.gov.ng/documents/Vetting%20Guidelines.pdf). The [Federal Competition and Consumer Protection Act 2018](https://fccpc.gov.ng/wp-content/uploads/2022/07/FCCPA-2018.pdf) (section 123) also prohibits marketing representations that are likely to mislead consumers in any material respect. How these rules apply to a particular listing is a question for your legal adviser, but they all point the same way.

The opportunity is the other side of that line. If your photos match the viewing every time, honesty becomes part of your brand.

## A practical approach: one workflow, clear rules

You do not need a new system to start. You need one written standard that everyone, including any AI tool, works to.

### Start with one recurring workflow

Pick the job you repeat most. For a hypothetical lettings team in Port Harcourt, that might be "new two-bedroom rental listings": approved photos and a fact sheet go in, and a portal listing, three social posts and a WhatsApp flyer come out. Define the inputs, the outputs, who approves them and what "done" means. Expand to launches or brochures only after this one runs smoothly.

### Write down what an image may and may not change

Split edits into three groups.

- **Usually acceptable:** brightness and colour correction, straightening, cropping, sharpening and resizing for each channel.
- **Check the channel's rules first:** removing objects, virtual staging and sky replacement. Some portals treat any removed object as doctoring, so tidy the room before the photo is taken rather than afterwards.
- **Never:** changing the structure, room sizes, views, finishes, fittings, neighbouring buildings, the road or the condition of walls and ceilings.

A simple test helps: if a buyer would feel misled at the viewing, the edit is not acceptable.

### Label concept imagery on the image itself

Off-plan renders and staged rooms have a legitimate place in property marketing, provided they are clearly labelled. Put the label on the picture itself, for example "Artist's impression" or "AI-generated concept, not a photograph". Listing images are forwarded, screenshotted and reposted, and a caption rarely travels with them.

### Draft copy from a verified fact sheet

Give the AI tool a fact sheet that someone has confirmed: size, bedrooms, service charge, parking, power arrangements and the status of the title document. Ask it to draft from those facts only. If the fact sheet does not say "close to the airport" or "constant power", the copy should not say it either.

### Keep the final review with a person, and keep the originals

An agent who knows the property signs off every image and every description before it is published. They check edited photos against the originals, side by side. Store the originals with the published versions, so you can show a buyer, a portal or a colleague exactly what was changed.

## What can change

With a written standard, a new team member can produce a listing that matches the rest of the portfolio. Edits can move faster because fewer of them need a debate. Copy can stay consistent across channels because it starts from the same facts. These are possible benefits rather than guaranteed results, so agree a simple measure, such as time from photos to published listing, and check it against your own workflow.

Before your next batch goes out, ask five questions. Which workflow comes first? What may an image change? How is concept imagery labelled? Who signs off? Where are the originals kept?

## Where Revia fits

Revia is the VIS property marketing service for teams that want this kind of standard without building it alone. From property facts and images that you have approved, VIS uses AI to help produce branded listing assets, listing copy, social content, brochures and flyers. Your team keeps final review control.

The sample images on the [Revia page](https://www.vorbtech.com.ng/solutions/products/revia) follow the same principle. VIS created them from scratch, and each one is labelled as AI-generated concept imagery, not a customer result.

Client services are available now, with turnaround agreed to your scope. The public web demo app is still in development. Founding partners receive agreed benefits under a signed agreement, including preferential economics, monthly creative capacity through provisional credits, roadmap input and priority access to new modules.

The first step is to choose one recurring workflow and look at it together. [Book a Creative Workflow Audit](https://www.vorbtech.com.ng/solutions/products/revia), or email [ceo@vorbtech.com.ng](mailto:ceo@vorbtech.com.ng).


AI, engineering and digital change.
Ideas for your next decision.

Featured article

Before you spend on AI, check whether you are ready

More perspectives

Setting AI rules in Nigeria without stopping useful work

From AI pilot to a service your team can rely on

What the NDPA asks of your team, day to day

Eight checks to keep your public portal secure and recoverable

Can your editor trace that claim in two minutes?

Faster property listings with AI, without misleading buyers

AI, engineering and digital change.Ideas for your next decision.

Featured article

Before you spend on AI, check whether you are ready

More perspectives

Setting AI rules in Nigeria without stopping useful work

From AI pilot to a service your team can rely on

What the NDPA asks of your team, day to day

Eight checks to keep your public portal secure and recoverable

Can your editor trace that claim in two minutes?

Faster property listings with AI, without misleading buyers

A little perspectivefor your inbox.

AI, engineering and digital change.
Ideas for your next decision.

A little perspective
for your inbox.