Laws/Regulations directly regulating AI (the “AI Regulations”)
There is currently no specific law or regulation that directly regulates AI in Nigeria.
However, the National Information Technology Development Agency (NITDA) announced in 2022 that it was seeking the contributions of stakeholders to enable the development of the National Artificial Intelligence Policy (NAIP). In March 2023, the NITDA announced that it had completed the first draft of the NAIP.
In August 2023, the Federal Ministry of Communications, Innovation and Digital Economy (FMCIDE) released a white paper announcing steps1 to expand on the draft NAIP by developing a comprehensive National Artificial Intelligence Strategy.
Status of the AI Regulations
As noted above, there are currently no specific laws or regulations that directly regulate AI in Nigeria.
Other laws affecting AI
There are various laws that do not directly regulate AI but affect the development or use of AI in Nigeria. A non-exhaustive list of key examples include:
- The Cybercrimes (Prohibition, Prevention, etc.) Act, 20152
- The Nigeria Data Protection Act, 20233
- The Security and Exchange Commission (SEC) Rules on Robo-Advisory Services4
- The Federal Competition and Consumer Protection Act, 20185
- The Copyright Act, 20226
- The Nigerian Communication Commission Act, 20037
Definition of “AI”
As noted above, there are currently no specific laws or regulations in Nigeria that directly regulate AI. However, the Nigerian Communications Commission (NCC), which regulates the telecoms sector, adopted the definition of AI under the American Heritage Science Dictionary and Stanford University8 in its research paper entitled 'Ethical and Societal Impact of Artificial Intelligence'9 ("NCC Research"). In the NCC Research, AI is defined as the ability of a computer or other machine to perform actions thought to require intelligence. The NCC Research goes on to describe AI as the science and a set of computational technologies that are inspired by, but typically operate quite differently from, the ways people use their nervous systems and bodies to sense, learn, reason, and take action.
Territorial scope
As noted above, there are currently no specific laws or regulations in Nigeria that directly regulate AI, but the use of AI may be regulated by other applicable laws, each of which has its own territorial scope. For instance, AI deployed in processing personal data will come within the scope of the Nigeria Data Protection Act, 2023 (NDPA), which has extra-territorial applicability and applies to entities outside Nigeria that process the personal data of Nigerian residents.
Sectoral scope
As noted above, there are currently no specific laws or regulations in Nigeria that directly regulate AI, but the use of AI may be regulated by other applicable laws. For instance, AI deployed in telecommunication services will come under the purview of the Nigerian Communication Commission Act, 2003.
Compliance roles
As noted above, there are currently no specific laws or regulations in Nigeria that directly regulate AI, but the use of AI may be regulated by other applicable laws. For instance, section 37 of the NDPA provides that a data subject shall not be subject to a decision based solely on automated processing of personal data, including profiling which produces legal or similar effect except where there is human intervention and the logic of the decision made is capable of being contested.
Section 29 of the NDPA requires entities to implement technical and organizational measures to protect personal information – This may involve making use of AI tools to protect personal data.
In summary, both the AI developer and entities or persons using AI to process personal data must ensure that they comply with the NDPA and other applicable laws in developing and using AI.
Core issues that the AI Regulations seek to address
The SEC Rules on Robo Advisory Services require a 'Robo Adviser' (i.e., a person who provides digital advisory services) to implement measures that will effectively mitigate against fault and bias in algorithms. In addition, the NDPA always requires human intervention when deploying an AI system and the opportunity for individuals to question the logic of the AI-based decision. Consequently, both laws seek to address bias and advance transparency in AI systems.
Risk categorization
As noted above, there are currently no specific laws or regulations in Nigeria that directly regulate AI, but the use of AI may be regulated by other applicable laws. In particular, the NDPA takes a risk-based approach towards processing personal data, and that risk-based approach applies where AI systems are used to process personal data.
Key compliance requirements
Based on the NDPA, the NDPA subsidiary legislation and the SEC Rules on Robo Advisory Services,10 AI providers and deployers are expected to comply with the following:
- Conduct a 'Data Protection Impact Assessment'
- Implement privacy by design and default
- Maintain a governance framework and record of processing activities
- Uphold transparency in processing personal data
- Register as a data controller or processor of major importance in line with section 44 of the NDPA
- Robo Advisers are required to disclose the following, in writing, to their clients: (i) assumptions, limitations, and risks of the algorithms; (ii) circumstances under which the Robo Adviser may override the algorithms or temporarily halt the Robo Advisory Service; and (iii) any material adjustments to the algorithms
- Robo Advisers are required to put in place adequate governance and supervisory arrangements to effectively mitigate against fault or bias in the algorithms
- Robo Advisers are required to develop client-facing tools with a robust algorithm methodology, having proper mechanisms to identify and resolve inconsistent client responses and perform sufficient monitoring and testing, prior to the launch of the tool and when changes are made to the tool, to detect any error or bias in the algorithms
- Robo Advisers are required to apply the Guidelines on Technology Risk Management (TRM) and file quarterly reports to the SEC on its compliance
- Robo Advisers are also required to implement internal policies and procedures to address technology risks
Regulators
AI systems are primarily regulated by the National Information and Technology Development Agency through the National Centre for Artificial Intelligence and Robotics.11 Other relevant regulatory bodies include Nigeria Data Protection Commission, Nigeria Communication Commission and Federal Competition and Consumer Protection Commission.
Enforcement powers and penalties
Although there is no specific law against the offensive use of AI, certain laws, such as those mentioned in Section 3 above, may be applicable depending on the offence committed and the nature of the AI.
1 https://fmcide.gov.ng/initiative/nais/
2 https://www.nfiu.gov.ng/images/Downloads/downloads/cybercrime.pdf
3 https://ndpc.gov.ng/Files/Nigeria_Data_Protection_Act_2023.pdf
4 https://sec.gov.ng/wp-content/uploads/2023/04/Rules-on-Robo-Advisory-Services_Executed-30-August-2021.pdf
5 https://fccpc.gov.ng/wp-content/uploads/2022/07/FCCPA-2018.pdf
6 https://copyright.gov.ng/wp-content/uploads/2023/04/CopyrightAct2023FinalPublication1.pdf
7 https://ncc.gov.ng/accessible/documents/128-nigerian-communications-act-2003/file
8 https://ai100.stanford.edu/2016-report/executive-summary
9 https://www.ncc.gov.ng/docman-main/research-development/919-ethical-and-societal-impact-of-artificial-intelligence-ai/file
10 https://sec.gov.ng/wp-content/uploads/2023/04/Rules-on-Robo-Advisory-Services_Executed-30-August-2021.pdf
11 https://nitda.gov.ng/ncair/
Jeffrey Shin (Trainee Solicitor, White & Case, London) and Cameron Lee (Trainee Solicitor, White & Case, London) contributed to this publication.
Udo Udoma & Belo-Osagie Contributors - Jumoke Lambo, Chisom Okolie, and Samuel Ngwu.
