Compliance Guide

Nigeria and Africa AI Policy Landscape: Compliance Guide

A practical breakdown of how Nigeria’s NDPA/NDPC framework and the AU Continental AI Strategy translate into technical governance requirements for enterprise AI deployments.

Explore Runtime Governance Talk to an Expert

Nigeria has no standalone AI statute. Enterprise AI compliance currently derives from the Nigeria Data Protection Act (NDPA) and NDPC guidance, alongside a draft National AI Strategy. The African Union's Continental AI Strategy sets harmonizing principles but is non-binding until domesticated by individual member states, so multi-jurisdiction deployments must be assessed country by country.

Nigeria's Regulatory Foundation: NDPA and NDPC

Nigeria does not currently have a standalone AI statute. Enterprise AI compliance obligations instead flow from the Nigeria Data Protection Act (NDPA), enacted in 2023, and enforced by the Nigeria Data Protection Commission (NDPC). The NDPC has authority to issue implementation guidance and directives governing data processing activities, and this authority extends to automated and AI-driven processing of personal data.

NITDA, which previously administered the 2019 Nigeria Data Protection Regulation, continues to operate as a technology regulator alongside the NDPC, meaning enterprises may need to account for both bodies depending on the nature of their deployment. For AI systems, the practical effect is that any processing of personal data belonging to Nigerian data subjects falls within NDPA scope regardless of where the underlying model or infrastructure is hosted. This includes cross-border data transfer restrictions and accountability obligations that apply directly to AI systems handling personal data of Nigerian data subjects.

Nigeria's Draft National AI Strategy

Alongside the data protection regime, Nigeria's Federal Ministry of Communications, Innovation and Digital Economy has led development of a National Artificial Intelligence Strategy, which remains in draft form and has been circulated for stakeholder input. As of current research, this strategy has not been finalized into binding regulation, and Nigeria has not enacted a standalone AI-specific statute.

Enterprises should treat the draft strategy as a signal of forthcoming policy direction rather than a present compliance obligation, while anchoring near-term compliance programs to the NDPA and NDPC framework. Tracking the strategy's progression from draft to finalized policy is itself a governance task, since finalization may introduce sector-specific AI obligations that go beyond generic data protection requirements.

African Union Continental AI Strategy and Cross-Border Operations

The African Union adopted a Continental Artificial Intelligence Strategy in 2024, intended to provide a harmonizing framework for AI ethics, data governance, and infrastructure across member states, including Nigeria. This strategy calls on member states to build national AI regulatory capacity, but it is not directly enforceable within any member state on its own. It requires domestication through national legislation or regulation before it carries binding legal effect.

There is currently no unified continental enforcement body for AI, so enterprises operating across multiple African markets must assess compliance obligations on a jurisdiction-by-jurisdiction basis rather than assuming a single continental standard applies. Nigeria's participation in coordination bodies such as the Smart Africa Alliance signals continental alignment efforts, but these coordination mechanisms do not substitute for national enforceable law. Over time, divergent national implementation of the AU strategy's principles is a reasonable expectation, and multi-jurisdiction deployment planning should account for this.

Nigeria and Africa AI Regulatory Structure

Four instruments and bodies shape the near-term compliance picture for enterprise AI in Nigeria and across related African markets:

NDPA / NDPC

Enforceable data protection law governing AI systems processing Nigerian personal data.

Draft National AI Strategy

In development under Nigeria's Ministry of Communications, Innovation and Digital Economy.

AU Continental AI Strategy

Non-binding harmonizing framework requiring national domestication.

NITDA

Legacy technology regulator operating alongside the NDPC.

Enterprise compliance checklist

Use the following actions to ground AI governance programs in enforceable Nigerian requirements while monitoring policy that is still forming:

  • Determine which AI systems process personal data of Nigerian or other African data subjects and whether that triggers NDPA/NDPC obligations
  • Confirm vendor and model-provider contracts address NDPA cross-border transfer and accountability requirements
  • Verify audit logging and access control mechanisms exist to demonstrate accountability for automated AI decisions
  • Establish a process to track Nigeria's National AI Strategy as it moves from draft to finalized policy
  • Document how AU-level guidance and national requirements are reconciled for operations across multiple African markets

Turn Policy Requirements Into Runtime Controls

Nigeria's compliance landscape currently rests on data protection accountability principles rather than AI-specific statute. Runtime governance, including audit logging and agent permissioning, provides the technical foundation these obligations require.

Explore Runtime Governance