Nigeria and Africa AI Policy Landscape: Compliance Guide

Nigeria's Regulatory Foundation: NDPA and NDPC

Nigeria does not currently have a standalone AI statute. Enterprise AI compliance obligations instead flow from the Nigeria Data Protection Act (NDPA), enacted in 2023, and enforced by the Nigeria Data Protection Commission (NDPC). The NDPC has authority to issue implementation guidance and directives governing data processing activities, and this authority extends to automated and AI-driven processing of personal data.

NITDA, which previously administered the 2019 Nigeria Data Protection Regulation, continues to operate as a technology regulator alongside the NDPC, meaning enterprises may need to account for both bodies depending on the nature of their deployment. For AI systems, the practical effect is that any processing of personal data belonging to Nigerian data subjects falls within NDPA scope regardless of where the underlying model or infrastructure is hosted. This includes cross-border data transfer restrictions and accountability obligations that apply directly to AI systems handling personal data of Nigerian data subjects.

Nigeria's Draft National AI Strategy

Alongside the data protection regime, Nigeria's Federal Ministry of Communications, Innovation and Digital Economy has led development of a National Artificial Intelligence Strategy, which remains in draft form and has been circulated for stakeholder input. As of current research, this strategy has not been finalized into binding regulation, and Nigeria has not enacted a standalone AI-specific statute.

Enterprises should treat the draft strategy as a signal of forthcoming policy direction rather than a present compliance obligation, while anchoring near-term compliance programs to the NDPA and NDPC framework. Tracking the strategy's progression from draft to finalized policy is itself a governance task, since finalization may introduce sector-specific AI obligations that go beyond generic data protection requirements.

African Union Continental AI Strategy and Cross-Border Operations

The African Union adopted a Continental Artificial Intelligence Strategy in 2024, intended to provide a harmonizing framework for AI ethics, data governance, and infrastructure across member states, including Nigeria. This strategy calls on member states to build national AI regulatory capacity, but it is not directly enforceable within any member state on its own. It requires domestication through national legislation or regulation before it carries binding legal effect.

There is currently no unified continental enforcement body for AI, so enterprises operating across multiple African markets must assess compliance obligations on a jurisdiction-by-jurisdiction basis rather than assuming a single continental standard applies. Nigeria's participation in coordination bodies such as the Smart Africa Alliance signals continental alignment efforts, but these coordination mechanisms do not substitute for national enforceable law. Over time, divergent national implementation of the AU strategy's principles is a reasonable expectation, and multi-jurisdiction deployment planning should account for this.