Nigeria’s AI Law Is Still Waiting: Inside the Digital Economy Bill Delay

In November 2025, Nigeria’s proposed digital-economy legislation appeared to be approaching its final destination. The National Assembly Library Trust Fund reported that the National Digital Economy and E-Governance Bill was expected to be transmitted to President Bola Tinubu for assent that week. The Minister of Communications, Innovation and Digital Economy, Bosun Tijani, was quoted as saying the President was awaiting the bill.

By January 2026, the deadline had shifted. Techpoint Africa reported that lawmakers were working towards passage by the end of March, describing a proposed framework that would introduce risk-based artificial intelligence regulation, compliance obligations and financial penalties.

Then came another forecast. On 9 July, THISDAY reported Senator Shuaib Afolabi Salisu, chairman of the Senate Committee on ICT and Cybersecurity, saying the legislation would become law within weeks. He described a bill that had undergone further amendments, including changes intended to align it with developments relating to the United Nations Convention against Cybercrime.

But the calendar kept moving.

As of 21 October 2026, the available public evidence does not establish that President Tinubu has assented to the National Digital Economy and E-Governance Bill. The National Assembly’s online tracker still lists the proposal as the National Digital Economy and E-Governance Bill, 2025, with its reading stages marked “Not Available”. The Oxford Institute of Technology and Justice’s September 2026 Nigeria profile also describes the bill as unenacted.

A search of publicly available State House announcements and official online records did not identify a presidential-assent announcement or a gazetted Act under this title. That is not proof that no procedural step has occurred outside the records located: Nigeria’s public legislative and gazette records are not necessarily complete or perfectly synchronised. It does mean that the law’s enactment should not be reported as a confirmed fact without a verifiable instrument.

The distinction matters. A proposed AI law can influence business planning, investor expectations and government policy. An enacted law can create binding duties, trigger enforcement powers and alter the legal rights of people affected by automated decisions. Nigeria’s digital economy is waiting for the second, not another prediction of when it might arrive.

Calling the proposal Nigeria’s “AI law” makes for a compelling headline, but understates its reach.

The version published on the National Assembly’s website is a 63-page National Digital Economy and E-Governance Bill, 2025. It brings together several areas of digital regulation that are often handled separately: electronic transactions and records, digital signatures, online consumer protection, digital government services, cybersecurity and AI governance.

Its commercial provisions aim to provide greater legal certainty for electronic contracts, records and signatures. It also addresses electronic transferable records and trust-service providers, and proposes stronger arrangements for digital public services and the exchange of government data.

The e-governance component is consequential in its own right. The draft envisages a national digital-government strategy, institutional ICT capacity, common standards for public-sector systems, digital-readiness assessments and a Nigeria Data Exchange. It would require public institutions to improve how they deliver services electronically, while setting expectations for security, interoperability and data protection.

If implemented effectively, this could help reduce the friction of paper-heavy administration and fragmented public databases. It could also create a more consistent foundation for digital identity, government payments and online services.

But digitisation is not automatically good governance. Moving a poorly designed process online can simply make its failures faster. A national data-exchange system can improve coordination, but it also raises questions about access controls, purpose limitation, security, auditability and the consequences of connecting databases that were previously separated.

The proposed law’s success would therefore depend on more than its passage. It would depend on the standards, institutional capacity, technical safeguards and implementation plans that follow.

The bill’s most closely watched provisions are in Chapter Five, which deals with artificial intelligence and other emerging technologies.

Section 63 sets out principles for AI development and use, including fairness, inclusion, non-discrimination, transparency, explainability, traceability, safety and security. It calls for responsibility for system outcomes to be assigned to an identifiable person or entity. It also provides for contestability, remedies for harm and meaningful human oversight, alongside compliance with existing laws, including the Nigeria Data Protection Act.

Section 64 would place more concrete responsibilities on what the draft calls “artificial intelligence agents”. These include proportionate governance and risk-management measures, information for users about a system’s function and limitations, safeguards against discriminatory outcomes, records sufficient for independent oversight, and disclosure of the provider or operator responsible for a system.

Human intervention would be required where AI use may pose significant risks to people’s rights. The draft also expects AI agents to cooperate with the regulatory agency and the Nigeria Data Protection Commission.

This is a shift away from treating responsible AI as a purely voluntary commitment. Instead, the proposal seeks to make accountability part of the system’s operating requirements.

For a company using AI to support recruitment, lending, customer verification, medical services or other consequential decisions, those principles could have practical implications. Organisations would need to understand not only what a system produces, but how it is deployed, what risks it creates, who is responsible for it and how affected people can challenge harmful outcomes.

The exact requirements, however, would depend on the final enacted text and any subsequent regulations. The published draft should not be treated as a complete compliance manual, or as proof that these duties are already in force.

Section 65 would allow the regulatory agency, with ministerial approval, to classify AI systems according to risk. The draft identifies factors such as the purpose and context of use, the likelihood and severity of harm, whether effects can be reversed, the system’s degree of autonomy, the possibility of human intervention and the vulnerability of affected groups.

That is an important design choice. An AI system recommending films does not present the same risks as one that materially influences access to credit, public services or employment. A proportionate framework can help direct regulatory attention towards applications with greater potential to affect rights and livelihoods without imposing identical burdens on every developer.

Yet the bill leaves key implementation questions to future regulatory action. Its risk classifications would be developed through regulations, and the proposal does not, by itself, provide every operational threshold a company would need to classify its system confidently.

That makes the quality and transparency of future rule-making central to the framework’s credibility.

Businesses will need clear answers to practical questions: Which uses qualify as high risk? What documentation must be retained? When is an impact assessment mandatory? What constitutes adequate human oversight? How should responsibility be divided between a model developer, a system integrator and the organisation deploying the technology? How frequently must a system be reassessed after its data, purpose or operating environment changes?

These questions are not minor technicalities. If the rules are vague, well-resourced companies may be better placed to interpret them, while smaller Nigerian developers face uncertainty and compliance costs without dedicated legal or risk teams.

The challenge is to make the framework precise enough to be enforceable and flexible enough to remain useful as AI systems evolve.

The proposed enforcement regime is one reason the bill has attracted attention.

Under section 68 of the published draft, the regulatory agency could issue enforcement orders following an investigation. Possible measures include requiring an AI agent to remedy a violation, ordering compensation for an affected person, requiring an account of profits derived from the violation, and imposing a financial penalty not exceeding the higher of ₦10 million or 2% of the agent’s annual gross revenue derived from Nigeria in the preceding financial year.

The draft also states that AI agents would be civilly liable for material and moral damages determined by a court arising from the development, implementation or use of AI systems.

That is more than a headline fine. It combines administrative enforcement with a proposed route to compensation and a statement of civil liability. It could make the financial consequences of irresponsible deployment materially greater for firms with significant Nigerian revenue.

But the legal effect of these provisions depends on enactment and implementation. The amount reported in media coverage is not a fine that regulators can impose under this bill today merely because it appears in the draft.

The wording also leaves work for implementation. Regulators would need to explain how penalties are calculated, how violations are assessed, how due process is protected and how overlapping powers under existing laws are handled. Companies need predictable rules; affected people need accessible remedies; and enforcement must be credible enough to deter misconduct without becoming arbitrary.

The draft’s reference to compensation is particularly important because regulatory penalties and individual redress are not the same thing. A fine paid to the state does not necessarily compensate someone who has been wrongly denied a service, subjected to discriminatory treatment or harmed by an unreliable automated decision. The final legal framework should make the route to meaningful redress understandable in practice.

The proposed institutional design puts the National Information Technology Development Agency (NITDA) at the centre of AI oversight. The bill defines NITDA as the “Regulatory Agency” and assigns it responsibilities that include monitoring AI risks, conducting inspections and investigations, accrediting independent AI auditors, imposing sanctions and supporting regulatory sandboxes.

This is why some policy commentary has described the proposal as giving NITDA the role of a digital-sector “super-regulator”. The phrase captures the breadth of the proposed mandate, but should not be mistaken for a new legal status already in force.

The potential advantage is coordination. AI systems rarely sit neatly within a single sector. A lending algorithm may raise questions about technology standards, financial regulation, privacy, consumer protection and discrimination at the same time. A central technical regulator could help develop common standards and reduce gaps between institutions.

The risk is overlap. Nigeria already has a data-protection framework administered by the Nigeria Data Protection Commission (NDPC), while sector-specific regulators oversee areas such as finance and telecommunications. The proposed bill itself expects cooperation between NITDA and the NDPC.

That cooperation must be more than a clause on paper. It requires clear rules for referrals, investigations, information-sharing, audits and the resolution of competing regulatory demands. Without them, organisations could face inconsistent instructions—or assume, incorrectly, that compliance with one authority’s requirements satisfies all others.

NITDA’s effectiveness would also depend on resources. AI supervision requires multidisciplinary expertise: software engineering, cybersecurity, statistics, data governance, law, economics and sector knowledge. Regulators must be able to examine technical claims, evaluate evidence and understand the real-world consequences of automated systems. Formal powers cannot substitute for trained staff, dependable processes and transparent decisions.

The bill’s promise will therefore be measured not only by how much authority it gives NITDA, but by how well that authority is exercised and coordinated.

The bill’s repeated near-term forecasts deserve scrutiny in their own right.

In November 2025, public messaging pointed to presidential assent that week. In January 2026, Techpoint Africa reported a target of passage before the end of March. In June, The Guardian quoted Senator Salisu describing the legislation as being in its final stage and potentially ready in the coming weeks or months. In July, THISDAY reported another assurance that passage would follow within weeks.

These statements are not all identical. They refer to different stages, and the June account allowed for “weeks or months”. But taken together, they illustrate how an imminent legislative milestone can remain unresolved across successive reporting cycles.

The public record does not establish why the timetable slipped. It would be irresponsible to assign the delay to political resistance, bureaucratic disagreement, lobbying or a specific drafting dispute without evidence. What can be said is that the published parliamentary tracker does not provide a sufficiently clear, current account of the bill’s procedural status for readers to reconcile the different public claims.

That is a transparency problem. A bill of this scope affects companies, government agencies, technology professionals and people whose decisions may increasingly be influenced by AI. Stakeholders should not have to piece together its status from a succession of “weeks away” headlines.

The National Assembly could reduce uncertainty by publishing a clear legislative history: the current text, the status of passage in each chamber, any harmonised version, outstanding steps and the date of transmission for assent. If the bill has been passed and sent to the President, that status should be easy to verify. If amendments or procedural steps remain, those should be made clear too.

The Presidency’s public record and the Official Gazette are equally important for confirming the final legal position. The absence of a readily identifiable assent notice is not a substitute for a formal statement of status from the relevant authorities.

Nigeria already has rules that apply to AI

The absence of a dedicated AI statute does not mean Nigeria has no rules relevant to AI systems.

The Nigeria Data Protection Act 2023 already provides a binding framework for personal-data processing. It matters whenever an AI system collects, infers, analyses or uses information about identifiable people. Existing cybersecurity, consumer-protection, financial-services and other laws may also apply, depending on the system and the context in which it is deployed.

Nigeria’s 2024 National Artificial Intelligence Strategy provides a policy direction for AI development, but a strategy is not the same as a dedicated, binding AI statute. The Nigerian Bar Association has also issued guidance on the use of AI in the legal profession. These instruments and existing laws form part of the current landscape, but they do not replace the proposed bill’s broader framework.

The distinction matters for companies that may be tempted to postpone all governance work until a new law is signed. They should not assume that the absence of a comprehensive AI statute creates a legal vacuum. Privacy, confidentiality, consumer rights and other existing obligations may already apply.

For policymakers, the task is to make the new framework complementary rather than duplicative. A dedicated AI law should clarify how existing protections operate when automated systems create new risks, not simply add another layer of compliance paperwork.

Even if presidential assent were announced tomorrow, Nigeria would not instantly have a fully operational AI-governance system.

The bill anticipates follow-on regulations, risk classifications, enforcement procedures and sandbox arrangements. Its proposed sandbox framework is intended to let innovators test AI systems under supervision, with particular attention to responsible innovation and participation by Nigerian startups and smaller enterprises.

That could be valuable. Startups need a way to test products responsibly without facing the same administrative burden as the largest technology companies from day one. Regulators, in turn, need practical experience to understand how rules work across different use cases.

But a sandbox is not a substitute for a clear regulatory baseline. Nor should participation be understood as blanket immunity from other applicable laws. The framework will need transparent eligibility criteria, defined testing conditions, safeguards for participants and affected people, and clear expectations for moving from experimentation to commercial deployment.

There is also a wider capacity question. Effective AI oversight requires technical expertise and the ability to evaluate systems in real contexts. A rule requiring impact assessments has limited value if organisations do not know what an adequate assessment looks like, or if the regulator lacks the capacity to scrutinise the resulting reports.

Nigeria will need practical guidance, proportionate transition periods, accessible compliance support and an enforcement strategy that distinguishes deliberate or serious violations from good-faith efforts to meet newly clarified requirements. Small businesses should not be exempt from protecting people, but they should be able to understand what compliance requires.

The bill’s status should not be confused with a reason to stop preparing. Nor should the proposed rules be represented as already binding. The sensible approach is to build governance practices around existing legal obligations and the direction of the published proposal, while monitoring for the final enacted text.

For businesses deploying AI, that means identifying where AI is used and what decisions it influences; recording who owns each system; checking whether personal data is involved; documenting limitations and foreseeable risks; and ensuring that consequential decisions can be reviewed by a competent person. Organisations should also maintain records of testing, complaints and incidents, and ensure that suppliers can explain the responsibilities they retain and those they pass to customers.

For investors and technology partners, the question is not simply whether a law will arrive, but whether the final framework will be predictable enough to support long-term investment. Clear requirements can increase trust and help responsible firms differentiate themselves. Unclear or overlapping powers can have the opposite effect.

For people affected by AI, the test is more direct: will they be told when a consequential decision relies on AI, be able to challenge an error, and have access to a real remedy when a system causes harm? The final law’s value will depend on how convincingly it answers those questions.

The verdict: the next announcement must be evidence, not another deadline

Nigeria has a serious opportunity to build a more coherent framework for its digital economy. The published bill addresses genuine issues: legal certainty for electronic transactions, public-sector digitisation, risk-based AI oversight, human accountability, regulatory coordination and redress for harm.

Its ambition should not obscure the present problem. Repeated statements that legislation is nearly ready are not equivalent to enactment. A parliamentary draft is not an Act, and a proposed penalty is not an enforceable sanction under a law that has not been verified as in force.

As of 21 October 2026, the most defensible conclusion from the public records located is that the National Digital Economy and E-Governance Bill remains unverified as enacted. Before publication, that status should be checked again directly against an official State House announcement, a final Act published by the National Assembly or an authoritative Official Gazette record.

The question is no longer whether Nigeria needs clearer rules for AI and digital government. It is whether the institutions responsible for delivering those rules can provide a transparent legislative record, a workable regulatory design and a credible path from legal ambition to enforcement.

After so many “weeks away” assurances, the next milestone should be something more concrete than another forecast: the final text, a verifiable assent record, and a clear explanation of when the law takes effect and how it will be implemented.