The law is coming. The enforcement channel isn't built yet.
This is the sharpest, most current argument behind Afrispan's existence, and it is fully sourced. Every claim below traces to Nigeria's own published strategy documents, an independent policy analysis, or official government reporting.
How Nigeria's AI regulatory landscape has moved
National Artificial Intelligence Strategy published
Published by the Federal Ministry of Communications, Innovation and Digital Economy, with NITDA as principal implementing body. It sets a five-year vision, 2025 to 2029, structured around three goals and five operational pillars, including sector adoption, responsible AI, and governance.
Public hearing on the Digital Economy and E-Governance Bill
Nigeria's National Digital Economy and E-Governance Bill, expected to pass in 2026, would position NITDA as Nigeria's digital technology super-regulator.
Bill expected to pass, with real, binding obligations
Reported provisions include a risk-based framework naming finance, public administration, surveillance, and automated decision-making as high-risk categories, requiring formal licensing and mandatory annual impact assessments detailing risks, mitigation strategies, and system performance. Regulators would gain powers to demand information, issue directives, and block unsafe systems. Reported penalties reach 10 million naira, approximately 7,000 US dollars, or 2 percent of a company's annual gross revenue, whichever is higher.
The honest, verified gap: the oversight body isn't constituted
An independent policy analysis published in April 2026 found that, as of March 2026, NITDA's own Code of Practice for AI (2025) had not been finalised, and the independent AI Governance Regulatory Body the strategy itself calls for under its fifth pillar had not been constituted, with no published timeline, funding mechanism, or defined legal independence.
The same analysis raised a concern worth naming directly and honestly: NITDA's own AI Transformation Roadmap assigns governance functions to NITDA itself, a body that also promotes AI development, a potential conflict of interest the analysis argues should be resolved by constituting the independent oversight body before, not after, the Code of Practice is finalised.
Enterprises know binding obligations are coming, but there is no clear, currently operating government channel to prepare against them. Private-sector assurance, built to the same rigor the eventual regulation will demand, is the practical way to close that gap today, not a workaround, a necessary bridge. For Afrispan, this finding is treated as an opportunity to be transparent about, not exploited quietly. It means the practical, operational channel for an enterprise seeking real AI governance capability in Nigeria today is not yet a government one.
Why this matters for your business, concretely
The mandatory annual impact assessment described in the coming bill is functionally the same deliverable as Afrispan's own Conformity Report and Fundamental Rights and Impact Assessment tooling, already built and demonstrable today, months or years ahead of the obligation becoming mandatory. Enterprises that engage Afrispan now are not buying a speculative future service. They are building the exact evidence artifact the coming law will require, before they are legally compelled to.
The existing legal foundation, and an adjacent licensing path worth pursuing
The Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission (NDPC) it established remain the primary binding legal foundation for data governance obligations that intersect directly with AI deployment today. Nigeria does not yet have a dedicated, binding AI-specific law. AI-related obligations today are drawn from general principles, contract law, data protection, and product liability, applied to AI systems by extension.
Nigeria's data protection framework already recognises Licensed Data Protection Compliance Organisations (DPCOs) as a formal third-party category authorised to support compliance and audit work under the NDPA. Afrispan is evaluating DPCO licensing as a near-term strategic milestone, since it provides an existing, government-recognised credential adjacent to Afrispan's AI-specific work, ahead of any AI-specific licensing regime that may follow the Digital Economy and E-Governance Bill's eventual passage.
A live, sector-specific precedent
The Central Bank of Nigeria's regulatory sandbox, launched in 2023 and expanded through 2024 and 2025, already evaluates AI-powered fintech tools for model explainability, fairness, and consumer transparency before granting approvals, a real, current precedent for exactly the kind of independent evaluation work Afrispan performs, applied specifically to Nigeria's large and fast-growing fintech sector.
See how our service lines map to these obligations
Every service line below exists because of a specific, sourced gap in what Nigeria's coming regulation will require and what is operationally available today.