Workshop · 30 minutes
AI Governance for Nigerian SMEs
NDPA 2023 plus the EU AI Act, turned into controls you can run on Monday
Anthony Chisom
AI security and governance · anthonychisom.dev
For founders, operations leads and tech teams
Why now
Your team already uses AI. The question is whether anyone is watching.
Shadow AI
Staff paste customer chats, invoices and statements into free chatbots to save time.
Data leaves Nigeria
Most AI models run abroad. Every prompt with a BVN, NIN or phone number is a cross-border transfer.
Customers notice
One wrong AI answer to a customer, or one leaked record, costs more trust than the time it saved.
AI Governance for Nigerian SMEs · 2
The rules
Three rulebooks, one of them already enforced
In force since June 2023
Nigeria Data Protection Act
Covers any personal data you collect, including what goes into AI tools. Enforced by the NDPC.
Applies if you serve the EU
EU AI Act
Reaches Nigerian firms whose AI is sold into the EU or whose AI output is used there.
Coming
Nigeria AI bills
Several AI bills are before the National Assembly, guided by the 2024 National AI Strategy. Not yet law.
AI Governance for Nigerian SMEs · 3
NDPA 2023
What the NDPA means when AI touches personal data
Requirement
What it means for your AI use
Lawful basis
A clear legal reason before data enters an AI tool
Data minimisation
Send only what the task needs; strip IDs first
Impact assessment
A DPIA before high-risk uses, like scoring people
Automated decisions
People can object to fully automated major decisions
Cross-border transfer
Foreign AI servers need adequacy or safeguards
Fines: up to ₦10m or 2% of annual gross revenue, whichever is greater
Source: Nigeria Data Protection Act 2023; NDPC General Application and Implementation Directive (GAID) 2025 · 4
EU AI Act
The EU timeline, after the 2026 AI Omnibus
Feb 2025
Banned practices, such as social scoring, apply
Aug 2025
Rules for general-purpose AI models apply
Aug 2026
Transparency: tell people they face AI or AI content
Dec 2027
High-risk systems, such as hiring and credit scoring
Aug 2028
High-risk AI built into regulated products
Why a Lagos firm should care: the Act reaches providers outside the EU when their AI, or its output, is used inside the EU.
Source: Regulation (EU) 2024/1689; AI Omnibus formally adopted 2026 · 5
Risk tiers
Where common SME uses of AI land
Banned
Social scoring, manipulative systems that exploit vulnerable people
High risk
CV screening, loan and credit scoring, exam grading
Transparency
Customer chatbots, AI-generated images, voice and video
Minimal
Marketing copy, spam filters, internal summaries
Most SME tools sit in the bottom two rows. The NDPA still applies to all four.
AI Governance for Nigerian SMEs · 6
Risk 1 of 3 · Data leakage
Keep personal data out of the prompt
Staff types
“Draft a reply to Ada Obi, BVN 22…, about her failed transfer”
Privacy gateway
Finds names, BVN, NIN, phone and card numbers; swaps each for a token
AI model sees
“Draft a reply to [NAME_1], BVN [ID_1], about her failed transfer”
The real values are restored in the reply on your side. The foreign model never holds them.
Case study: PII Swapping Gateway, mapped to GDPR and the NDPA · 7
Risk 2 of 3 · AI agents with tools
An agent that can act can be tricked into acting
The attack
An agent connected to email, payments or your files reads a poisoned tool description or document. Hidden text tells it to forward data or move money. It obeys.
The controls
- Allow only approved tools, and block any that change after approval
- Check every action against rules, such as approved email domains
- Require a human “yes” for payments and outgoing messages
- Keep a log, with personal data masked
Case study: MCP Tool Poisoning Shield, 26 automated tests on a simulated bank · 8
Risk 3 of 3 · Wrong answers
Let AI publish only what it can prove
AI finds it
Scans official sources every 3 to 6 hours for new events
Proof quoted
Publishes automatically only when the evidence is quoted from the source
Not sure
Goes to a human review queue with a confidence label
Plus a daily cap on AI spend, rate limits and a takedown route for anyone who disputes a listing.
Case study: Ecclesia Nigeria, a live national platform across 37 states · 9
Your 90 day starter plan
Five steps, in this order
Days 1–15
Inventory
List every AI tool staff use and what data goes in
Days 15–30
Classify
Mark each use by risk tier and personal data
Days 30–45
Policy
Publish a one page AI use policy and brief staff
Days 45–75
Controls
Mask IDs, gate agent actions, add human review
Days 75–90
Review
Check the log, fix gaps, set a quarterly review
Green steps cost nothing but time. Amber steps may need a tool or a developer.
AI Governance for Nigerian SMEs · 10
Exercise · 5 minutes in pairs
Classify each case: which rule, which tier, which control?
A
A Lagos fintech uses AI to approve loans for Nigerians living in Germany
B
A fashion store’s WhatsApp bot answers customers when the owner is away
C
A support agent pastes a customer’s BVN into a free chatbot to draft a reply
D
A restaurant uses AI to write Instagram captions
AI Governance for Nigerian SMEs · 11
Take-home
A one page AI use policy
1. Approved tools. Use only the AI tools on our list, on business accounts.
5. Customer-facing AI. Tell customers when they are dealing with AI.
2. No IDs in prompts. Never enter BVN, NIN, card numbers or full customer records.
6. Agents. No AI sends money or messages without a person approving.
3. Check before sending. A person reviews AI output before it reaches a customer.
7. Report problems. Flag any AI mistake or data slip to [owner] the same day.
4. No AI-only decisions. Hiring, credit or refunds always get a human decision.
8. Review. We revisit this policy every quarter.
Adapt the wording to your business · 12
Three things to remember
The NDPA already applies to your AI use.
Know every tool before you buy a new one.
Keep a person between AI and anything that matters.
Questions?
Anthony Chisom · anthonychisom.dev
A practical summary, not legal advice