Your Staff Are Already Using AI: Why Nigerian Businesses Need an AI Usage Policy Now

Two pieces of news landed in the same week, and they belong together.

On 14 October, the Institute for Security Studies published an analysis on Polity warning that Africa needs to prepare for AI-powered cyber threats at scale. It cites an Interpol warning that 55 percent of all reported cybercrimes across Africa were AI-enabled. A week earlier, Zoho Nigeria's country head, Kehinde Ogundare, told businesses at the GrowthX event to look past regulatory compliance and ask harder questions about where their data is stored, who can access it, and whether it could be used to train AI models, as reported by Techeconomy.

What the threat picture looks like

The ISS piece draws on a threat intelligence report from Anthropic, an AI developer, describing how criminals and influence operators have used AI agents. The point it makes is that AI is mostly a scaling tool, not a magic weapon. It helps attackers scan networks for weaknesses, pick phishing targets, and produce huge volumes of content or malicious code faster than defenders can keep up.

One case it describes involved reconnaissance and infrastructure-building against a North African government technology authority, which exposed more than 300,000 national identity records and data from over 500,000 companies. The report notes that most intrusions still involve some human involvement and that fully automated attacks have not arrived yet, but security practitioners quoted in the piece expect that to change.

The quieter risk is inside your own team

The ISS analysis makes a second point that gets less attention. Employees experimenting with public AI tools can paste sensitive information into them without thinking twice, and in doing so expose their organisations to further intrusion. Alpha Group's chief information officer, quoted in the piece, argues for strict rules on which AI models staff may use and tighter limits on what data those tools can touch.

This is not a theoretical concern. A staff member summarising a customer complaint, cleaning up a spreadsheet of client records, or drafting an HR letter with a free chatbot has just moved personal data to a third party. If your business has no rule about that, you probably have it happening already.

Why the NDPA makes this your problem

The Nigeria Data Protection Act does not mention AI usage policies by name, but it does require what such a policy delivers. Organisations must put technical and organisational measures in place to protect personal data, appoint a Data Protection Officer, and register as a data controller or processor of major importance where applicable. Those obligations were the exact items the NDPC demanded proof of when it opened its probe into 1,369 organisations, as detailed by The Condia.

The penalty for getting it wrong is the greater of 10 million naira or 2 percent of gross revenue from the previous year, and regulators can also order compensation to affected individuals. If client data leaves your control because someone used an unapproved AI tool, "we had no policy" is a weak answer.

Regulators are also moving on AI itself. This week, the National Universities Commission said it is developing a national AI roadmap and policy framework for universities. At the opening of the NUC retreat, the Minister of State for Education warned that AI use must come with safeguards for academic integrity, ethics and data protection, according to Tori.ng. Expect similar expectations to spread to other sectors.

What Nigerian businesses say they are doing

A study by Arion Research for Zoho, titled The AI Privacy Equation, found that 93 percent of surveyed Nigerian organisations had begun adopting AI, and 84 percent said they had strengthened data protection measures as part of that process. Around 57 percent reported regular privacy audits of AI systems, another 57 percent practised data minimisation in AI training, and 52 percent required explainability for AI decisions, according to Nairametrics.

Treat those numbers with some care. The research was commissioned by a software vendor, it relies on self-reporting, and it was released in 2025. It still suggests that responsible AI adoption is becoming a normal expectation, which means a business with no policy is falling behind its peers rather than keeping pace with them.

What a workable AI usage policy covers

The following is practical guidance rather than a legal template, so have your Data Protection Officer or counsel review it before adoption.

An approved tools list. Name the AI tools staff may use for work and say plainly that everything else is off limits for company data. Business or enterprise accounts usually offer stronger data handling terms than free personal ones.

A clear line on data. Spell out what must never be entered into an external AI tool: customer personal data, financial records, health information, credentials, unpublished contracts, and anything covered by a client confidentiality agreement.

Vendor checks before approval. Ask each provider where data is stored, how long it is kept, who can access it, whether your inputs are used to train models, and whether you can sign a data processing agreement. These are the same questions Ogundare urged businesses to ask.

Human review of outputs. Anything AI produces that reaches a customer, a regulator, or a financial decision should be checked by a person who is accountable for it.

Reporting without blame. Staff need a simple way to say "I pasted something I should not have." A fast report lets you contain the problem and, if needed, meet your breach notification duty within the 72-hour window.

Training and review. A policy nobody has read does nothing. Run a short session for every team, and revisit the document every six months, because the tools and the rules are both changing quickly.

The bottom line

AI-enabled crime is growing across the continent, and the NDPC has shown it will investigate and fine organisations that cannot demonstrate basic safeguards. An AI usage policy is a small, inexpensive document that answers both pressures at once. Write it before an incident forces you to, because the first time you need it will not be a convenient moment.