Skip to main content

    AI by country · West Africa

    AI in Nigeria: the rules, the readiness and where to start

    Last checked: 26 October 2026

    What should a company in Nigeria know before starting with AI?

    Nigeria has no standalone AI law as of 26 October 2026. The rules that apply today come from the Nigeria Data Protection Act 2023 and the NDPC's 2025 General Application and Implementation Directive (GAID), which has an article on AI. Plan for impact assessments, human review of automated decisions and careful handling of data sent abroad before you build or buy anything.

    At a glance

    Nigeria at a glance

    Key facts about Nigeria
    Data protection lawNigeria Data Protection Act 2023, in force; GAID 2025 effective 19 September 2025
    RegulatorNigeria Data Protection Commission (NDPC)
    AI policyNational AI Strategy 2025 to 2029 (published September 2025, non-binding). No dedicated AI law as of 26 October 2026
    Time zoneWAT, UTC+1 (India is 4.5 hours ahead)
    CurrencyNGN (naira)
    Business languageEnglish, with Hausa, Yoruba and Igbo widely spoken

    Why now

    Why Nigeria is worth watching

    Each point links to the document it comes from.

    • The Federal Ministry of Communications, Innovation and Digital Economy published the National AI Strategy 2025 to 2029 in September 2025, with five pillars from AI infrastructure to governance.[3]

    • The strategy aims to give at least 70% of Nigerians aged 16 to 35 AI-related skills, and it points to the Three Million Technical Talent programme for training.[3]

    • The NDPC's General Application and Implementation Directive (GAID) became fully effective on 19 September 2025, so its rules on AI and other new technologies now apply.[6]

    • The Central Bank of Nigeria issued baseline standards for automated anti-money laundering systems on 10 March 2026 and encourages the use of AI and machine learning in them.[7]

    • On 22 October 2026 the NDPC took part in a consultation on frontier AI and spoke of an upcoming AI regulatory sandbox, which is still only planned.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Nigeria Data Protection Act, 2023

    In force2023People have a right not to be subject to a decision based solely on automated processing with legal or similarly significant effects. A breach likely to risk people's rights must be reported to the NDPC within 72 hours (section 40(2), as quoted in the GAID). Transfers abroad need adequate protection or another legal basis. KPMG's summary mentions fines tied to 2% of annual gross revenue and N10 million; we could not read the Act's penalty section, so confirm the exact tiers.[8]

    NDPC General Application and Implementation Directive (GAID) 2025

    In force2025Anyone using AI on personal data must set out safeguards, file them with the NDPC in the annual Compliance Audit Return, and run a data privacy impact assessment (Article 43). A DPIA is also mandatory for automated decisions with significant effects, profiling, financial services, health care, e-commerce and cross-border transfers (Article 28). Consent is needed before a solely automated decision with significant effects, and before transfer to a country without an NDPC adequacy decision (Article 18).[1]

    Pending AI bills in the National Assembly

    Draft2024 to 2025Several AI bills have been introduced, including one for a National AI Commission. None had been enacted as of a report covering July 2026, and we found no later confirmation. Treat them as proposals.[5]

    Where AI fits first

    Where AI fits first

    Banking, payments and fintech

    Transaction monitoring and fraud detection, and document checks for customer onboarding.

    CBN Circular BSD/DIR/PUB/LAB/019/002 of 10 March 2026 sets baseline standards for automated anti-money laundering systems. Banks have 18 months and other institutions 24 months, with roadmaps due in three months. The circular encourages AI. Under the GAID, financial services also need a DPIA.[7]

    Health care

    Summarising clinical notes and triage support, with a human clinician deciding.

    The GAID makes a DPIA mandatory for health care services that process personal data. A Digital Health Services Bill covering AI in health care is pending.[1]

    E-commerce and retail

    Customer support in English and local languages, and product recommendations.

    The GAID lists e-commerce services among the cases where a DPIA is mandatory, and direct marketing needs consent.[1]

    Agriculture

    Crop advice and yield or disease prediction for farmers.

    The national AI strategy names agriculture as a priority sector for AI adoption. We found no sector-specific AI rule for agriculture.[4]

    Government and public procurement

    Service portals and document handling for public bodies.

    A February 2025 guideline reportedly requires NITDA approval for federal procurement of AI-enabled IT systems worth NGN 10 million or more. This is from a secondary report, so check with NITDA.[5]

    Your first steps

    Your first steps

    1. List where personal data enters your planned AI use, and decide whether any decision about a person is made solely by the system.
    2. Run a data privacy impact assessment before launch if the use touches finance, health, e-commerce, profiling or cross-border transfer, and have a certified data protection officer vet it.
    3. Check whether your organisation counts as a data controller or processor of major importance and needs to register with the NDPC.
    4. Write down your safeguards for the AI tool, since the GAID expects them in the annual Compliance Audit Return.
    5. Find out where vendors store and process your data, and confirm a legal basis for any transfer abroad.
    6. Set up a way to report a breach to the NDPC within 72 hours.
    7. If you are a bank or payments firm, read the CBN's March 2026 anti-money laundering standards and plan your roadmap.

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Nigeria is on UTC+1 and India on UTC+5:30, a 4.5 hour gap. Taking a 9:00 to 17:00 day in Nigeria and 9:30 to 18:30 in India, the overlap is about 5 hours, from 09:00 to 14:00 Nigerian time.

    Questions

    Common questions about AI in Nigeria

    Does Nigeria have an AI law?

    Not as of 26 October 2026. The National AI Strategy is a policy, not a law. Several AI bills are before the National Assembly, but none had been enacted in the latest report we found.

    Do I need a privacy impact assessment before using AI on customer data?

    Often yes. The GAID requires one for automated decisions with significant effects, profiling, financial services, health care and e-commerce, and Article 43 requires one for AI that processes personal data.

    Can I send Nigerian customer data to a foreign AI service?

    Only with a legal basis. The Act requires adequate protection for transfers abroad, and the GAID requires consent before a transfer to a country without an NDPC adequacy decision. Ask the vendor where data is processed and stored.

    How fast must a data breach be reported?

    The GAID quotes section 40(2) of the Act: report to the NDPC within 72 hours of becoming aware of a breach likely to risk people's rights.

    Is the NDPC's AI sandbox open?

    We could not confirm that. NDPC officials described it as upcoming on 22 October 2026, and no opening date was given.

    Free tools

    Try these first

    Three free tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 26 October 2026. Numbers in square brackets above match this list.
    1. [1] Nigeria Data Protection Commission, 2025-03-20. NDP Act General Application and Implementation Directive (GAID) 2025, r…(ndpc.gov.ng)
      Full title and what we used it for

      NDP Act General Application and Implementation Directive (GAID) 2025, ref. NDPC/NDP ACT-GAID/01/2025. Primary. Read in full text. Used for Articles 18, 28, 43, 45, the 72-hour breach quote of section 40(2) and the major-importance registration criteria. The date is taken from the file name and document reference; the PDF itself does not state its effective date.

    2. [2] Nigeria Data Protection Commission, 2026-10-22. Governing Frontier AI: NDPC Mandates Algorithmic Transparency and Priva…(ndpc.gov.ng)
      Full title and what we used it for

      Governing Frontier AI: NDPC Mandates Algorithmic Transparency and Privacy-by-Design at NITHUB Consultation. Primary news item. Used only for the consultation and the upcoming AI sandbox. The headline says 'mandates' but the text describes proposals, so we treated them as non-binding.

    3. [3] Federal Ministry of Communication, Innovation and Digital Economy, 2025-09-19. National Artificial Intelligence Strategy (September 2025)(api.oecd.ai)
      Full title and what we used it for

      National Artificial Intelligence Strategy (September 2025). Primary document, read in full text via the OECD.AI-hosted copy. Used for the 70% skills target, the pillars and the Three Million Technical Talent mention.

    4. [4] OECD.AI Policy Navigator, 2026-10-26. National Artificial Intelligence Strategy (NAIS), Nigeria(oecd.ai)
      Full title and what we used it for

      National Artificial Intelligence Strategy (NAIS), Nigeria. Secondary summary, accessed on this date (publication date not shown). Used for the 2025 to 2029 period, active status and the sector adoption pillar naming agriculture.

    5. [5] Digital Policy Alert and AI Safety Nigeria, 2026-08-05. Nigeria's AI governance approach(digitalpolicyalert.org)
      Full title and what we used it for

      Nigeria's AI governance approach. Secondary. Used for the absence of a standalone AI law, the list of pending bills and the NITDA procurement guideline. Reflects information as of July 2026.

    6. [6] Aluko & Oyebode, 2026-10-26. NDPC GAID takes effect on 19 September: is your organisation prepared?(aluko-oyebode.com)
      Full title and what we used it for

      NDPC GAID takes effect on 19 September: is your organisation prepared?. Law-firm article, accessed on this date (publication date not shown). Used only to confirm the 19 September 2025 effective date, which the GAID text does not state.

    7. [7] Olajide Oyewole LLP (DLA Piper Africa), 2026-04-29. Regulatory Update: Banking Sector, April 2026(dlapiperafrica.com)
      Full title and what we used it for

      Regulatory Update: Banking Sector, April 2026. Law-firm summary of the CBN circular of 10 March 2026. Used for scope, deadlines and the encouragement of AI. The CBN's own page was not opened; TechCabal returned 403 and was not relied on.

    8. [8] KPMG Nigeria, 2026-10-26. President signs the Nigerian Data Protection Bill 2023 into law(kpmg.com)
      Full title and what we used it for

      President signs the Nigerian Data Protection Bill 2023 into law. Law-firm summary. Used for the automated-decision right, transfer rules and the penalty ceilings. The official Act PDF on a hosting site was a scanned image with no readable text, and KPMG's PDF copy returned errors, so the Act's own wording was not read. Publication date not shown, so the access date is given; sources differ between 12 and 14 June 2023.

    This is general information, not legal advice. Laws and drafts change, and some facts here come from law-firm or press summaries because primary texts could not be read. Check with a qualified Nigerian lawyer before you act. Facts checked on 26 October 2026.

    Other country guides

    Starting with AI in Nigeria?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score