When AI Gets It Wrong, Who Answers? Board Accountability For Automated Decisions In Nigeria

Introduction

Artificial intelligence is changing how organisations make decisions. Financial institutions use machine-learning models to assess creditworthiness, insurers rely on predictive analytics to price risk and detect fraud, and employers increasingly use AI-assisted tools to screen applicants. As these systems become embedded in business operations, decisions once made by people are increasingly influenced, or sometimes made, by algorithms. This raises a straightforward governance question: when an automated decision causes harm, who is accountable?

Responsibility cannot simply be passed to the developer or IT team. Where AI affects customers, employees or other individuals, its use creates legal, regulatory and reputational risks for the organisation deploying it. For boards, this brings algorithmic decision-making within the familiar territory of risk management, internal controls and corporate oversight, areas which are governed by the Companies and Allied Matters Act (CAMA) 2020 and the Nigerian Code of Corporate Governance (NCCG) 2018.

Nigeria does not yet have a comprehensive law dedicated to AI, but the regulatory position is developing. The Nigeria Data Protection Act (NDPA) 2023 already regulates certain forms of automated decision-making involving personal data, while the Nigeria Data Protection Commission (NDPC) has announced plans to review the Act to address artificial intelligence, robotics and big data more expressly. Against this background, this article considers how board accountability for algorithmic decision-making may develop in Nigeria and what boards should be doing now to prepare.

Artificial Intelligence Is No Longer an IT Issue

AI increasingly influences decisions about recruitment, credit, insurance, healthcare and access to services. A flawed credit-scoring model may unfairly deny finance, a biased recruitment tool may disadvantage certain candidates, while an inaccurate frauddetection system may restrict a legitimate customer's account. These are not simply technical failures. They create legal, regulatory and reputational risks that belong within an organisation's wider risk framework. Boards do not need to understand the workings of every algorithm, but they should know where AI is used, the decisions it influences, the risks involved and who remains accountable for its outcomes.

Nigeria's Emerging AI Regulatory Landscape

Nigeria does not yet have comprehensive AI legislation, but algorithmic decision-making is not unregulated. The NDPA already applies to AI systems processing personal data through its requirements on lawfulness, fairness, transparency, accuracy, security and accountability. Section 37 of the NDPAspecifically addresses decisions based solely on automated processing, including profiling, where they produce legal or similarly significant effects. In addition, Article 43 of the General Application and Implementation Directive (GAID) addresses AI and other emerging technologies used to process personal data, including documented technical/organisational parameters, DPIAs, and assessment of disparate outcomes.Where the NDPA addresses rights of data subjects, the GAID complements it by addressing various measures which protect personal data; together, these provisions form a solid regulatory shield.

The regulatory framework is also developing. In June 2026, the NDPC announced plans to review the NDPA to address AI, robotics and big data more expressly, with its leadership emphasising the importance of retaining human involvement in AI-assisted decisions. The details of any amendment are yet to be published, but the direction is clear: AI is becoming a more explicit part of Nigeria's data protection framework. For boards, this means that AI accountability is not simply a future regulatory issue. Much of the legal foundation already exists.

Algorithmic Decision-Making Under the NDPA

Section 37 of the NDPA gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects, subject to limited exceptions. Where an exception applies, safeguards include human intervention and an opportunity for the individual to express a view and challenge the decision.

This sits alongside the NDPA's wider principles. Fairness requires organisations to consider whether algorithms produce unjustifiable or discriminatory outcomes. Transparency requires sufficient information for individuals to understand how their data is being used and, where appropriate, challenge significant decisions. Accuracy makes the quality of data feeding AI systems a compliance issue. Accountability requires organisations to demonstrate why AI is being used, the risks considered, safeguards adopted and who is responsible for oversight.

For boards, the central issue is therefore not how an algorithm is programmed, but whether the organisation can demonstrate that its use is lawful, controlled and subject to meaningful human accountability.

A Second Regulator Is Entering the Picture

The proposed National Digital Economy and E-Governance Bill adds another dimension to Nigeria's emerging AI regime. If enacted, NITDA may have a broader role in AI and emerging technology regulation, alongside the NDPC's jurisdiction where AI involves personal data.

This potential overlap matters for boards. Rather than creating separate compliance arrangements for each regulator, organisations should develop an AI governance framework capable of accommodating data protection, technology regulation and applicable sector-specific requirements.

International Developments

While they do not apply directly in Nigeria, international developments offer useful reference points for assessing the direction of AI Governance. Below are some of the marked developments in AI and automated decision-making.

The EU AI Act imposes obligations corresponding to the risks presented by an AI system, while the GDPR regulates certain forms of automated decision-making and profiling of personal data. The NIST AI Risk Management Framework and ISO/IEC 42001 also provide established approaches to AI risk management and governance, emphasising structured risk assessment, clear accountability and ongoing monitoring.

While these frameworks differ, they share a basic principle: organisations should know where AI is used, understand the risks it creates and maintain clear human accountability for its deployment and outcomes. It is therefore clear that Nigeria's direction is consistent with the wider move towards risk-based AI regulation. The practical lesson, however, is not that Nigerian entities need to replicate foreign regimes, but that they should adopt proportionate controls for AI systems that create legal, financial or reputational risk.

Building an AI Governance Framework

Companies need not wait for further legislation. The NDPA and GAID already provide a legal foundation for addressing many AI-related data protection risks.

A practical starting point is to maintain an AI inventory identifying the systems in use, their purpose, the data they process, the decisions they influence and who is responsible for them. Systems should then be classified according to risk. AI used for consequential decisions, such as credit, recruitment or insurance, should be subject to greater scrutiny, including appropriate impact assessments, testing, monitoring and human oversight.

Responsibility should also be clearly allocated across technology, legal, compliance, risk and data protection functions, with material issues capable of escalation to the board. Existing procurement, data protection, risk, and incident management policies should be reviewed to address AI, particularly where third-party systems are used. Suchescalation is not simply good practice. The duties of directors are codified under sections 305 to 309 of CAMA; additionally, the NCCG places responsibility for a company’s risk management framework with the Board. A Company that deploys AI for consequential decisions without adequate oversight is exposed to regulatory risk, among other things.

Companies should also ensure that significant decisions and assessments are documented. AI inventories, DPIAs, risk assessments, vendor reviews, approvals and monitoring records can provide evidence that appropriate oversight has taken place.

Preparing for Future Regulation

The final shape of Nigeria's AI regulatory framework remains unsettled, but its direction is becoming clearer: greater scrutiny of higher-risk AI, stronger human oversight and clearer organisational accountability. Boards should therefore treat AI governance as an existing risk-management responsibility rather than wait for new legislation. Regulation may still be developing, but the decisions being made by algorithms are not waiting for it.

Conclusion

Artificial intelligence is changing the way businesses make decisions, and regulation is still catching up. However, the absence of a specific AI law in Nigeria does not mean that organisations can operate without accountability. The NDPA already provides safeguards around certain solely-automateddecisions involving personal data, while the NDPC's proposed review shows that greater regulatory attention is coming.

For Nigerian boards, the practical responsibility is clear. Directors do not need to understand the technical details of every AI system, but they should know where AI is being used, the risks it creates, and whether proper safeguards and human oversight are in place. As the regulatory framework develops, organisations that put these governance structures in place now will be better prepared. AI may support or even make certain decisions, but responsibility for those decisions must ultimately remain with people.

References

1. Nigerian Data Protection Act 2023

2. General Application and Implementation Directive 2025

3. Nigerian Code of Corporate Governance 2018

4. National Digital Economy and E-Governance Bill 2025

5. Elham Tabassi, National Institute of Standards and Technology AI Risk Management Framework (AI RMF 1.0.) 2023. https://www.nist.gov/publications/artificial-intelligencerisk-management-framework-ai-rmf-10. Accessed 17 August 2026

6. OECD AI Principles. https://www.oecd.org/en/topics/ai-principles.html. Accessed 19 August 2026

7. Oyebanji, O., “Does the Nigeria Data Protection Act (NDPA) Regulate Artificial Intelligence?” (2026).https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6868458. Accessed 19 August 2026

8. Federal Ministry of Communications, Innovation and Digital Economy, National Artificial Intelligence Strategy initiative. National Artificial Intelligence Strategy

9. UK Information Commissioner's Office, Guidance on AI and Data Protection. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificialintelligence/guidance-on-ai-and-data-protection/about-this-guidance. Accessed 18 August 2026

10. UK Information Commissioner's Office, Governance and Accountability in AI. https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-auditframework/toolkits/artificial-intelligence/governance-and-accountability-in-ai. Accessed 19 August 2026

Originally published 24 August 2026.