Nigeria Defers Some Digital Rules During Harmonisation

What the directive actually says

On July 7, 2026, Nigeria's Federal Ministry of Communications, Innovation and Digital Economy put out a directive with a plain aim. It directed the agencies to defer recently issued provisions only where they concern areas undergoing policy harmonisation. The directive is signed by Dr. Bosun Tijani, the Honourable Minister, and it is titled Federal Ministry Directs Harmonised Approach to the Regulation of Internet Platforms and Online Intermediaries.

The core instruction is a pause. In the Ministry's own words, Relevant agencies are to defer the implementation or enforcement of any recently issued regulation, code, guideline, framework, directive or administrative requirement relating to Internet platforms, online intermediaries or other cross-cutting digital economy matters. The following qualifier limits this deferral to provisions concerning areas undergoing policy harmonisation.

The three agencies in scope are the Nigerian Communications Commission, which handles telecommunications, the National Information Technology Development Agency, which drives IT and AI policy, and the Nigeria Data Protection Commission, which handles data protection and automated-decision guidance. Between them they cover most of what a platform or a digital-economy firm touches in Nigeria.

The reason the Ministry gives for acting is convergence. The directive states that the convergence of telecommunications, digital platforms, artificial intelligence, online safety and data governance requires a coordinated whole-of-government approach. Artificial intelligence is named there, but read the sentence honestly. It sits in a list of five converging domains, and the whole point is coordination across all of them, not a move aimed at AI on its own.

To run that coordination, the Ministry is setting up a new body. It says it shall establish a Joint Technical Coordination Committee comprising representatives of the three agencies under the leadership of the Office of the Honourable Minister. So the freeze is not open-ended in structure. There is a committee meant to produce the harmonised framework that the pause is holding space for.

Why this is AI-adjacent, not AI-specific

The directive coordinates the work of federal digital regulators.

The Ministry deferred recently issued provisions only to the extent they concern areas undergoing policy harmonisation. That is the subject of the directive. AI enters the picture in two indirect ways. First, it appears once in the Ministry's list of converging domains, as a reason to coordinate. Second, and more concretely, two of the three agencies caught by the freeze are the ones closest to AI. NITDA is the body driving Nigeria's national AI strategy and its emerging AI rules, and NDPC governs data protection and the automated-decision guidance that sits underneath a lot of AI deployment.

So the accurate framing is an AI-adjacent regulatory freeze. It does not repeal any AI rule. It does not single AI out. Whether a particular AI-related provision falls within the deferral depends on that scope.

Added 21 August 2026: the NCC code with an actual AI duty in it

The original version of this article described the freeze in the abstract, because the directive itself names no specific rule. We have since read one of the codes that sits in that space, and it is worth setting out, because it turns an abstraction into something a compliance team can act on.

The NCC Internet Code of Practice 2026 is dated 13 February 2026 and signed by Dr. Aminu Maida, the Commission's Executive Vice Chairman and Chief Executive. Its chapter 5.4 is headed Deployment of Artificial Intelligence and Emerging Technologies, and it is not vague.

Clause 5.4.1 provides that an Internet Access Service Provider shall notify the Commission before deploying artificial intelligence tools, applications and solutions that relate to its network management and customer engagement processes. The notification has to state which services are covered or affected, which existing services may be replaced or supplanted, what upgrades or changes are anticipated, and the implementation timelines, lifespans and sunsetting principles that apply. The same notification is required for any emerging technological tool.

Clause 5.4.2 adds five requirements. The provider must notify the subscribers and consumers who will be affected, and the Code singles out non-human interfaces on consumer complaint or redress platforms. The deployment must not affect its network integrity or interconnection with other providers. The tool must not breach the Commission's Cyber Security Framework or access consumer data without consent or regulatory approval. It must maintain a capability to withdraw the tool where a regulatory determination requires immediate removal or cessation. And the Commission reserves the right to issue further compliance guidance or directives.

Read plainly, that is a pre-deployment notification regime for AI in telecoms customer service, with a kill switch attached. The disclosure duty for chatbots handling complaints is the part most likely to catch a firm by surprise, because it attaches to exactly the deployment most operators treat as routine.

Updated 22 August 2026: the freeze is narrower than it first appears

We have now read the 7 July directive in full on the Ministry's own site, and it is bounded in two ways that matter.

First, the deferral is conditional. Agencies are to defer implementation or enforcement of a recently issued regulation, code, guideline, framework or directive, in the Ministry's words, to the extent that such provisions concern areas currently undergoing policy harmonisation under the Ministry's coordination. It is not a deferral of everything the agencies have recently issued.

Second, there is an express saving. The direction is stated to be without prejudice to the statutory responsibilities of the institutions, and all other provisions of existing regulations, guidelines, codes and directives that fall squarely within the express mandates of the agencies under extant laws are stated to remain fully operational and enforceable, provided they are consistent with the Minister's policy direction.

So the question for chapter 5.4 is not whether the Code is recent. It is whether the AI notification duty concerns an area currently under harmonisation, or whether it sits squarely inside the NCC's express statutory mandate. We do not answer that here, because the directive names no specific code and the Ministry has not published the list of areas under harmonisation. What we can now say is that a blanket reading of the freeze is wrong on the directive's own terms.

What this means for US platforms and AI firms

US platforms and AI firms need to identify which provisions apply to their Nigerian operations. The directive limits deferral to areas undergoing policy harmonisation and preserves provisions within the agencies' express statutory mandates.

The directive gives no fixed end date for the harmonisation exercise. It does not identify every affected provision or settle whether the NCC Code's AI notification duty falls within the deferral.

If you hold a Nigerian internet access licence, the chapter 5.4 notification duty is the specific thing to put on the list. The directive does not establish that this duty is suspended.

What to do now

Identify the provisions governing your Nigerian activity and whether they concern an area undergoing policy harmonisation. A recently issued agency rule is not automatically deferred.

If you are a licensed internet access provider, inventory any AI already deployed in network management or customer engagement and check it against clause 5.4.1, including whether you could actually withdraw a tool at short notice if the Commission required it.

Hold, do not scrap, your existing compliance controls, because a deferral can be reversed and the rules can return in changed form. Track the Joint Technical Coordination Committee, since the harmonised framework it is meant to produce is where your next set of duties will come from.

And resist the urge to describe this internally as Nigeria repealing or deregulating AI. Its deferral may affect AI-related provisions only to the extent they concern areas undergoing policy harmonisation.

What we did not verify

We have now read the 7 July 2026 FMCIDE directive in full, published on the Ministry's own site and signed by the Honourable Minister. Every description of it above is taken from that text. An earlier version of this article was written before we had read it and said so.

We still do not say whether the directive reaches the NCC Internet Code of Practice 2026. The directive names no specific code, and the Ministry has not published the list of areas currently undergoing harmonisation, so the question cannot be answered from the published record.

We did read the Code itself in full, all thirty-one pages, and chapter 5.4 is quoted from that text.

The Code carries no separate commencement clause for chapter 5.4. It is dated 13 February 2026 and its only transition provision says measures taken under the 2019 Code are construed as taken under this one. We therefore state no date on which chapter 5.4 began to bind, and readers should not infer one.

One date that circulates in connection with this Code is 13 August 2026. That is not an AI commencement date. It is six months from issuance, and it is the deadline in clauses 6.2.1 and 6.3.1 for Digital Service Providers and Application Service Providers to submit their Community Rules or Guidelines to the Commission. It has nothing to do with chapter 5.4.

We did not confirm whether the Commission has received or acted on any chapter 5.4 notification, and we did not contact the NCC.

Related briefings

• Nigeria's national AI strategy and code of practice
• The NDPC audit of AI imagery under the GAID
• Nigeria's CBN on automated AML and AI model validation
• The FCCPC probe into generative AI and news content
• AI Regulation News hub