AI Regulation in Nigeria: Plenty of Drafts and Advisories, but Where Is the Law?

AI regulation in Nigeria is arriving in an unusual (or rather, usual) order: first the warnings, then the draft rules, then the deployments, and, we are assured, eventually the law. In roughly two weeks, the FCCPC proposed fines of up to ₦100 million for AI marketing, NITDA told organisations to stop pasting sensitive data into public chatbots, and INEC said it is bringing AI into the 2027 elections while its governance framework is “being finalised.” We have questions.

What Has Actually Happened in the Last Two Weeks?

The FCCPC (September 30). The draft Sales Promotion (Amended) Regulations, 2026 include a section on “Artificial Intelligence and Automated Marketing”. Businesses using AI or automated tools for promotions and customer engagement would have to register that use, clearly identify AI-generated content, give consumers an opt-out, and avoid manipulation or exploiting people’s data. Businesses would be responsible for whatever their AI says. Penalties: up to ₦100 million or 1% of the previous year’s turnover, whichever is greater, for companies, and up to ₦50 million for individuals. It is a draft, not law, and comments close on October 20.

NITDA (October 4). An advisory from its CERRT.NG team warned organisations and staff against entering personal, classified, or confidential information into public tools such as ChatGPT, Gemini, Claude, and Copilot. It urged the use of employer-approved tools, anonymising personal data first, and following “existing AI, information security and data protection policies”. It also said exposing personal data this way could amount to a personal data breach.

INEC (October 14). At the AI and Democracy Forum in Abuja, INEC’s chairman said algorithms “will not and must never decide” the 2027 vote. INEC has set up an AI unit and is exploring AI for spotting anomalies in uploaded results, detecting duplicate biometric records, planning logistics, and catching deepfakes. Its governance framework is still being finalised, with no publication date given. Voting is roughly three months away.

Is There Actually an AI Law in Nigeria?

As far as we could find, No. There is no standalone AI statute. What exists is the Nigeria Data Protection Act 2023 (binding, but about data), a National AI Strategy (a policy document, not a law), a draft AI code of practice from NITDA, and several bills in the National Assembly. The biggest, the National Digital Economy and E-Governance Bill, which would give NITDA formal AI powers, has been described as “about to be signed” since late 2025. We could not find confirmation that it has become law. If you know otherwise, please tell us.

Which brings us to NITDA’s call to follow “existing AI policies”. Existing according to whom? If it means each organisation’s own policies, hands up if your organisation has one.

Questions for the FCCPC

Lets imagine a small fashion brand in Aba. It uses a chatbot to draft Instagram captions and a WhatsApp auto-reply to answer “how much?” at midnight.

• Does that auto-reply count as “automated messaging”?
• If a human edits an AI-drafted caption, is it still “AI-generated content” that must be labelled? What does “clearly identified” look like: a hashtag, a footer?
• Who registers: the brand, the freelancer, or the agency?
• What does registration cost, and how long does it take?
• Does the ₦50 million individual penalty reach a young freelancer managing social pages for three clients?
• Why do the first AI marketing rules sit inside Sales Promotion regulations, alongside the rules about actually awarding the raffle prize you promised?

And one about process: the consultation runs three weeks. How many small business owners know it exists?

Questions for NITDA

Lets say - for example - an accounts officer pastes a customer’s complaint, BVN included, into a free chatbot to draft a polite reply. Under NITDA’s own advisory, that could be a personal data breach.

• Has anyone told the accounts officer?
• If it is a breach, who reports it, to whom, and by when?
• Which tools count as “approved”, approved by whom, and against what standard?
• Will NITDA publish a template AI-use policy that a ten-person company can adopt on a Monday morning?

To be fair, the advice itself is sound. The gap is between advice and the means to follow it.

Questions for INEC

None of this suggests bad intent. INEC says the tools come with human oversight, has an AI unit, and has adopted regional guidelines with the ECOWAS electoral network. The questions are about sequence and detail.

• Will the governance framework be published before voting, not after?
• Will it be independently auditable? Some groups have asked for exactly that.
• Imagine an anomaly detector flagging a polling-unit result. Who reviews it, how quickly, by what standard, and what happens to a legitimate result that gets flagged by mistake?
• What data do these systems see, who built them, and where do they run?

One observation, offered with a straight face: businesses are being asked to register their chatbots, while the framework for election AI is still being finalised. Registration, it seems, flows downhill.

What Would Better Look Like?

• Plain definitions. What counts as “AI” in each rule, with examples and non-examples.
• Guidance before fines, with a grace period for small businesses.
• A free template AI-use policy from NITDA for SMEs.
• One lead regulator or one-stop registration, so businesses are not answering to three agencies.
• INEC’s framework and audit method published before polling day.
• Longer consultations, with real outreach beyond the usual stakeholders.

What Should Your Business Do While Everyone Else Figures It Out?

• List your AI tools: what your team uses, who uses it, and for what. You may need it for the FCCPC draft, and it is good hygiene anyway.
• Write a one-page data rule: no BVN, NIN, medical details, customer files, or confidential documents in public tools. Anonymise first, in line with Nigeria’s data protection expectations.
• Label AI-generated marketing, keep a human checking claims, and give customers an opt-out from automated messages.
• Name one person responsible for AI use.
• If the draft affects you, send comments to [email protected] by October 20.

The same discipline applies to proprietary code and data in AI coding tools, and it follows the principle from our earlier piece on AI hype versus real value: use AI where it genuinely helps, and know what you are handing over.

Getting AI regulation right in Nigeria, for now, means writing your own guardrails before someone asks to see them.

At Techvilla, we help businesses adopt AI with the same discipline we apply to everything else: use it where it helps, keep sensitive data under your control, and write the rules down first.

Chat with us on WhatsApp or start a free consultation.

Because the goal is not just to build a website. The goal is to make your business digital, visible, and future-ready.