NCC Launches Internet Governance Working Group as Survey Reveals Gaps in AI Oversight, Online Safety

 By Simpson Global Media News Desk

The Nigerian Communications Commission (NCC) has launched an Internet Governance Working Group to strengthen online safety, improve artificial intelligence accountability and address gaps in the readiness of telecommunications licensees to implement Nigeria’s Internet Code of Practice 2026.

The initiative follows a survey presented at the commission’s inaugural Internet Governance Symposium in Lagos, which found that only two of 19 assessed licensees were fully ready to implement the code. Nine reported partial readiness, while five said they were not ready. The reported categories account for 16 of the 19 licensees assessed, leaving three whose readiness status was not specified in the published findings. The Guardian.

The survey also identified shortcomings in organisational artificial intelligence governance. About 73 per cent of respondents said their organisations were using or piloting AI, but only 39 per cent had an approved AI policy, while 34 per cent reported applying human oversight. The findings point to a growing gap between the adoption of emerging technologies and the formal procedures organisations use to manage their risks. The Guardian.

The new working group is intended to provide a continuing platform for cooperation among stakeholders beyond the symposium. The NCC says the initiative will help identify practical priorities and encourage coordinated action on online fraud, data privacy, cybersecurity, harmful content, child protection and responsible AI use. NCC.

The development comes as digital services become increasingly important to Nigerians conducting business, accessing financial services, communicating, learning and obtaining information. It also raises questions about how regulators, technology companies, internet service providers and other institutions can protect users while supporting innovation.

For the commission, the central challenge will be turning discussions and policy frameworks into measurable improvements in the way digital services operate. The launch of a working group establishes a platform for engagement, but the extent of its impact will depend on implementation, accountability and the participation of the organisations expected to follow the relevant standards.

What the NCC working group is expected to do

The Internet Governance Working Group was formally launched during the NCC’s first Internet Governance Symposium, held in Lagos on Thursday, October 15, 2026.

At the event, Abraham Oshadami, the commission’s Executive Commissioner for Technical Services, delivered the opening address on behalf of NCC Executive Vice Chairman and Chief Executive Officer Aminu Maida. Oshadami stressed that decisions about the internet affect more than connectivity and technical infrastructure.

The commission said internet governance decisions influence economic opportunities, trust, security and the rights of users. It also argued that emerging issues cannot be addressed effectively by one institution acting alone. NCC.

The working group is designed to provide an ongoing forum for stakeholders to discuss internet governance concerns, identify areas requiring attention and coordinate practical responses. Its role is therefore broader than organising a single conference or issuing a one-time statement.

Internet governance covers the rules, practices, technical arrangements and institutional responsibilities that shape how the internet operates and how people use it. It includes questions about cybersecurity, data protection, domain names, online conduct, platform responsibilities and the appropriate use of emerging technologies.

In Nigeria, those questions involve a range of stakeholders. Telecommunications regulators oversee aspects of the communications industry, while service providers operate networks and digital platforms. Government agencies, civil society groups, academics, technical experts and consumer representatives also have interests in how digital services are managed.

A working group can help bring those perspectives together, particularly where problems cross institutional boundaries. Online fraud, for example, may involve telecommunications networks, digital platforms, payment services, law enforcement and consumer-protection systems. Effective responses may require information sharing and clearly defined responsibilities.

The NCC has not, in its published announcement, set out a complete public timetable for the working group’s activities or announced specific deadlines for every proposed action. Its practical contribution will need to be assessed through subsequent announcements, implementation guidance, stakeholder participation and evidence of changes in compliance.

Survey exposes readiness gaps among licensees

One of the most striking findings from the symposium was the limited readiness reported among the 19 licensees assessed for implementation of the Internet Code of Practice 2026.

According to The Guardian, only two licensees were fully ready, nine reported partial readiness and five said they were not ready. The figures highlight the implementation challenge facing the regulator as it seeks to strengthen online safety and accountability across the communications sector. The Guardian.

The findings should be interpreted carefully. They do not establish that every telecommunications company in Nigeria is unprepared, nor do they mean that every service offered by the assessed organisations is unsafe. The published account refers to the readiness of a defined group of 19 licensees in relation to the code.

The survey covered 47 respondents from industry, academia and civil society. These included seven mobile network operators, five internet service providers and 12 academic institutions, alongside other participants. The total number of respondents and the number of licensees assessed are different measures and should not be confused. The Guardian.

The findings suggest that some organisations may need clearer guidance on what compliance requires, how to document their procedures and how to demonstrate that safeguards are operating effectively.

Dr Ibiso Kingsley-George, the NCC’s Head of Governance Unit, said licensees needed clearer implementation guidelines, reporting templates and additional guidance on the code’s requirements. Cybersecurity obligations and provisions relating to artificial intelligence were among the most difficult requirements for licensees to meet, according to the report. The Guardian.

That observation is important because regulatory requirements must be understood before organisations can consistently implement them. If companies interpret obligations differently, compliance can become uneven and enforcement more complicated.

Clear guidelines can explain what organisations must do, which records they should maintain and how they should demonstrate that their systems meet the required standards. Reporting templates can also help regulators compare compliance information more consistently.

However, guidance alone may not be enough. Organisations need staff with the right expertise, adequate resources, management support and procedures for identifying and responding to risks. Some may also need to change internal processes or invest in technical systems to meet their responsibilities.

The NCC’s challenge will be to determine where confusion is the main barrier and where organisations require more substantial changes to their operations.

AI adoption is moving faster than formal governance

The survey’s findings on artificial intelligence reveal another challenge for Nigeria’s digital ecosystem.

About 73 per cent of respondents said their organisations were already using or piloting AI. Yet only 39 per cent had an approved AI policy, while 34 per cent reported applying human oversight. The figures were reported by The Guardian following the NCC symposium. The Guardian.

AI tools can support a wide range of activities, including customer service, data analysis, content production, fraud detection and the automation of routine tasks. Organisations may adopt such systems to improve efficiency, reduce workloads or provide services more quickly.

But the use of AI also introduces questions about accountability, reliability, privacy and the handling of sensitive information. A system can produce inaccurate information, reflect weaknesses in its training data or make recommendations that require human review. Organisations need to determine how these risks will be identified and managed.

An approved AI policy can establish who is authorised to use AI tools, what information may be entered into them, which tasks require human review and how problems should be reported. It can also define responsibility when AI-generated material is used in a business decision or customer-facing service.

Human oversight is another important safeguard. It can help ensure that automated outputs are reviewed where mistakes could cause significant harm, such as in decisions involving access to services, financial transactions or sensitive personal information.

The survey figures do not establish that every organisation using AI without a formal policy has experienced a problem. Nor do they demonstrate that a written policy, by itself, guarantees safe use. They indicate that adoption and formal governance are not advancing at the same pace among the respondents.

That gap matters as AI tools become more accessible. An organisation may begin using a new service through individual staff members before management has established rules for data handling, accuracy checks or accountability.

A structured governance approach can help organisations decide which uses are appropriate, which require additional safeguards and which should not be permitted. It can also provide a way to review systems as they change.

The NCC has identified AI governance as one of the priority areas for discussion and coordinated action. Whether the new working group can help close the gap will depend on how it translates the survey’s findings into guidance that organisations can use.

Consumers want to know when they are interacting with AI

The survey also examined attitudes towards transparency when AI is used in consumer-facing services.

According to The Guardian, 94 per cent of respondents said consumers should be informed when interacting with AI. At the same time, 40 per cent preferred periodic reporting to notification before deployment. The findings suggest broad support for transparency but less uniform agreement about when and how organisations should disclose their use of AI. The Guardian.

The distinction is important. Telling customers that an AI system is being used can help them understand how a service operates, but the timing and detail of disclosure may differ according to the context.

A customer interacting with an automated support assistant, for example, may benefit from knowing that the responses are generated by AI and how to reach a human representative. In a different setting, an organisation may use AI internally to sort documents or identify patterns, without the technology directly interacting with customers.

The appropriate disclosure approach depends on the function of the system, the consequences of its output and the information available to users. The survey figures describe respondents’ views; they do not, by themselves, establish a binding rule that every AI system must be announced in the same way.

Clear standards could help organisations distinguish between routine uses, high-impact decisions and situations where users need specific information before proceeding. The standards could also address how customers can challenge an outcome or seek human assistance.

Transparency is not simply a matter of displaying a message that AI is involved. Users may also need to understand what the system can and cannot do, how their information is handled and whether a person can review a disputed decision.

For regulators, the challenge is to encourage meaningful disclosure without creating requirements so vague that organisations cannot implement them consistently. The NCC’s working group could help stakeholders discuss these questions and identify practical approaches.

Internet Code of Practice 2026 at the centre of the initiative

The NCC has identified the Internet Code of Practice 2026, known as ICOP 2026, as a framework for promoting a safer and more responsible online environment.

At the symposium, Oshadami said the code’s effectiveness would depend on clear expectations, meaningful stakeholder engagement and consistent implementation. The commission also said it planned to publish implementation guidelines and frequently asked questions, alongside workshops for licensees that were not ready to comply. NCC; The Guardian.

These planned measures are intended to help organisations understand their obligations and identify what they must do to meet them.

Implementation guidance can explain regulatory requirements in practical terms. Frequently asked questions can address recurring uncertainties, while workshops can give organisations an opportunity to discuss specific challenges with regulators and other stakeholders.

The commission’s approach recognises that a policy framework is only effective if the organisations expected to follow it understand what is required and can demonstrate compliance.

At the same time, implementation must not be reduced to paperwork. A company may have policies and reporting documents but still struggle to protect users if the procedures are not followed in practice.

Effective compliance therefore requires more than a document signed by management. Organisations need systems for detecting incidents, responding to complaints, training staff and reviewing whether safeguards remain effective as their services change.

The regulator will also need reliable ways to assess progress. Clear reporting requirements and consistent evaluation can help distinguish organisations that have completed formal documentation from those that have embedded the necessary practices into their operations.

The NCC has not publicly detailed every future compliance milestone in the announcement reviewed. Further information on deadlines, monitoring arrangements and enforcement would help licensees and consumers understand what to expect next.

Cybersecurity remains a major concern

Cybersecurity was identified as one of the difficult areas for licensees and a priority for internet governance discussions in 2026 and 2027.

Digital services depend on interconnected systems that store information, process transactions and enable communication. Weaknesses in one part of that environment can affect customers, businesses and other organisations that rely on the service.

Cybersecurity involves measures designed to prevent unauthorised access, protect systems and data, identify suspicious activity and respond to incidents. It includes technical safeguards, staff training, risk assessments and procedures for restoring services after disruption.

For communications companies, these responsibilities extend beyond protecting office computers. Their networks and supporting systems are part of the infrastructure on which other digital services depend.

The NCC has also highlighted the Cyber Resilience Framework for the Nigeria Communication Sector, known as CRF-NCS. The commission says the framework is intended to strengthen the security and resilience of infrastructure supporting digital services. NCC.

Resilience is important because no technical system can be assumed to be immune from every threat. Organisations need to prepare for incidents, identify weaknesses and establish procedures for responding when safeguards fail.

A comprehensive approach includes prevention, detection, response and recovery. It also requires clear responsibilities so that staff know who should be contacted when a threat is discovered and how an incident should be escalated.

The working group could help stakeholders identify recurring challenges and discuss areas where common guidance or cooperation would be useful. However, the published announcement does not establish that the group has already resolved any cybersecurity weaknesses.

The practical test will be whether organisations improve their ability to protect systems, communicate responsibly about incidents and restore services when disruptions occur.

Online fraud and harmful content require coordinated action

The NCC has also identified online fraud and harmful content as concerns that require greater cooperation.

Online fraud can take different forms, including impersonation, deceptive messages, fraudulent offers and attempts to persuade users to disclose sensitive information. Such activity may involve several services or channels, making it difficult for one institution to address every part of the problem independently.

A telecommunications provider may control a network connection, while a digital platform hosts content and a financial institution processes a payment. Investigating a fraudulent transaction may also require law enforcement or other competent authorities.

This complexity makes coordination important. Organisations need appropriate ways to receive complaints, preserve relevant information and refer cases to the bodies responsible for investigating or resolving them.

The need for cooperation does not remove the importance of legal safeguards. Information sharing should be conducted through appropriate channels, with due regard for privacy, security and the rights of affected individuals.

Harmful content presents a different but related challenge. The internet allows people to share information widely and quickly, but it can also be used to distribute material that endangers users or targets vulnerable groups.

The NCC has highlighted the protection of children and other vulnerable internet users as part of its broader governance concerns. The commission says these issues require collaboration across the communications sector and beyond. NCC.

Measures intended to improve safety must be clearly defined and applied responsibly. Broad or unclear rules can create uncertainty for users and service providers, while weak safeguards may leave people exposed to abuse.

A continuing forum for stakeholders could help clarify how online safety responsibilities should be shared and how complaints should be handled. It could also help identify areas where public education and clearer guidance would reduce avoidable risks.

The working group’s success will depend on whether it produces practical recommendations and whether the relevant institutions act on them.

Data privacy and cross-border information flows

Data protection is another priority identified by the survey.

Digital services routinely collect and process information about users, including account details, contact information and records of their interactions with a service. Some organisations also use information to analyse behaviour, personalise products or train and operate automated systems.

The collection and use of data can support useful services, but it also creates responsibilities. Organisations need to understand what information they collect, why they collect it, how long they retain it and who can access it.

Weak data governance can increase the risk of unauthorised disclosure, inappropriate use or accidental exposure. When personal information is shared with third parties, organisations must understand the responsibilities and safeguards that apply to the arrangement.

Cross-border data flows add another layer of complexity. Information may be stored or processed in a different country from the one where it was collected, depending on how a service is designed and operated.

Such arrangements can support international business and cloud-based services, but they raise questions about applicable legal requirements, accountability and the protection available to individuals.

The NCC’s symposium identified data protection and cross-border data flows among the key internet governance priorities for 2026 and 2027. The Guardian.

The working group could provide an opportunity for stakeholders to discuss practical challenges and identify where clearer guidance is needed. However, the launch does not mean existing privacy responsibilities have been replaced or that every data-related issue will fall exclusively under the NCC.

Different authorities may have responsibilities under relevant laws and regulatory frameworks. Effective coordination should clarify those roles rather than create confusion about which institution is responsible for a particular matter.

For businesses and service providers, the wider message is that data governance needs to be treated as part of the design and operation of digital services, not as an afterthought.

Internet governance participation remains limited

The survey also found gaps in stakeholder participation in internet governance activities.

About 53 per cent of respondents had participated in the Nigeria Internet Governance Forum, while 40 per cent had not attended any internet governance event. Five organisations reported no engagement at all. Approximately 34 per cent were unfamiliar with the permanent mandate of the Internet Governance Forum, according to The Guardian. The Guardian.

Respondents cited low awareness, the absence of an internal mandate and the belief that internet governance was irrelevant to their businesses as reasons for limited participation.

These findings suggest that some organisations may not yet see internet governance as a routine part of their responsibilities. Yet decisions about online safety, technical standards and data use can affect businesses even when they do not participate directly in policy discussions.

Participation can help organisations understand changes in expectations, explain operational challenges and contribute practical knowledge to policy development.

It can also help regulators understand how rules are likely to work in real-world settings. A requirement that appears straightforward in a policy document may create implementation challenges for organisations with different technical capabilities or business models.

Broader participation can improve the quality of discussion by bringing in views from different parts of the digital ecosystem. Consumer representatives, academic researchers and civil society organisations may identify concerns that are not immediately visible to network operators or technology companies.

However, participation needs to be meaningful. Attendance at meetings alone does not demonstrate that an organisation has changed its practices or improved its compliance. The value of engagement depends on whether discussions lead to clear responsibilities and follow-through.

The new working group provides a platform for more sustained involvement. Its effectiveness will depend on whether stakeholders participate consistently and whether their contributions lead to decisions that can be implemented.

Domain names and the technical foundations of the internet

The NCC symposium also addressed the .ng domain, domain name system security and domain abuse. These topics concern the technical systems that help users find websites and access online services.

A domain name provides a human-readable address for an online destination. The domain name system, commonly known as DNS, helps translate that address into the technical information needed to connect a device to the relevant service.

Because DNS supports access to online destinations, its reliability and security are important to the functioning of the internet. Problems involving domain names can disrupt access or create opportunities for deception when users are directed to misleading destinations.

Domain abuse can involve the misuse of domain registrations or related systems for activities such as impersonation and fraud. Addressing it can require cooperation among registrars, technical operators, service providers, regulators and law enforcement, depending on the circumstances.

Discussion of the .ng domain is relevant to Nigeria’s digital ecosystem because local domain infrastructure forms part of the country’s online identity and technical environment. The symposium’s inclusion of these issues shows that internet governance extends beyond content moderation and consumer-facing AI tools.

The NCC has not announced that the working group has already adopted new domain-related rules or resolved specific cases of domain abuse. The published account identifies these topics as part of the symposium’s discussions. The Guardian.

Future work in this area could focus on clarifying responsibilities, encouraging security-conscious practices and improving coordination where abuse crosses organisational boundaries.

As with other aspects of internet governance, the objective should be to strengthen reliability and trust while ensuring that actions are based on clear rules and appropriate evidence.

ISO/IEC 42001 and AI management systems

Another subject discussed at the symposium was ISO/IEC 42001, an international standard for AI management systems.

Management-system standards provide structured approaches that organisations can use to establish responsibilities, assess risks, document procedures and review performance. In the context of AI, such a framework can help organisations develop a more systematic approach to how they select, deploy and monitor AI technologies.

An AI management system can support decisions about acceptable uses, oversight arrangements, documentation and the handling of problems. It can also help organisations consider how AI-related risks change over time as systems are updated or applied to new tasks.

The reference to ISO/IEC 42001 at the NCC symposium indicates that international approaches to AI management formed part of the discussion. It does not mean that every Nigerian organisation is already required to obtain certification under the standard.

Any mandatory requirement would need to be established through the relevant regulatory or legal instrument. The NCC’s published statement does not announce a universal certification mandate.

For organisations that use AI, the wider lesson is that responsible deployment involves more than selecting a tool and measuring its speed or cost. Businesses need to consider reliability, accountability, data protection and the potential consequences of errors.

A formal management framework may help organise those responsibilities, but it cannot replace careful implementation or meaningful human judgement where the stakes require it.

The NCC working group could help stakeholders discuss how international standards relate to Nigeria’s regulatory environment and what practical guidance would be useful for local organisations.

Balancing innovation with users’ rights

The expansion of digital services creates opportunities for businesses, public institutions and individuals. AI and other technologies can support productivity, improve access to information and make certain services easier to use.

At the same time, innovation can introduce risks when systems are deployed without adequate safeguards or when users have limited information about how decisions are made.

The NCC has framed internet governance as a matter involving opportunity, trust, security and users’ rights. Its approach emphasises the need for collaboration rather than relying on a single institution to resolve every challenge. NCC.

A balanced approach must recognise that safety and innovation are not necessarily competing goals. Clear expectations can help responsible organisations understand what is required, while consistent enforcement can discourage practices that expose users to avoidable harm.

However, rules need to be sufficiently clear to be implemented and sufficiently adaptable to address emerging technologies. Requirements that are vague or applied inconsistently can create uncertainty for businesses and users alike.

The working group could provide a forum for discussing these trade-offs and identifying areas where additional clarity is needed. It could also help stakeholders distinguish between risks that require technical safeguards, those that require changes in organisational practice and those that need broader public education.

The commission has not presented the working group’s launch as the completion of Nigeria’s internet governance reforms. Rather, its announcement calls for sustained cooperation and practical action.

What consumers and businesses should watch for

For consumers, the immediate significance of the development is that the regulator has placed online safety, privacy and AI accountability among its stated priorities.

The launch does not automatically change how every digital service operates, and users should not assume that all risks have been eliminated. The announced initiative is a platform for continued work, while implementation measures and organisational changes will take time to assess.

Users can continue to take basic precautions when interacting with digital services, including verifying unexpected requests for money or sensitive information, using available account-security features and checking whether a communication genuinely comes from the organisation it claims to represent.

People should also be cautious about sharing personal information with unfamiliar services or entering sensitive information into AI tools without understanding how it may be processed.

For businesses, the survey highlights the importance of reviewing internal policies, staff responsibilities and safeguards for AI and cybersecurity. Organisations that use AI may need to establish clear rules for acceptable use, human review and the handling of sensitive information.

Telecommunications licensees should pay attention to the NCC’s forthcoming implementation guidance, frequently asked questions and workshops, as reported by The Guardian. Those resources are intended to clarify compliance expectations and support organisations that are not yet ready to implement ICOP 2026. The Guardian.

Businesses should distinguish between general recommendations and binding regulatory requirements. Where obligations are unclear, they should seek appropriate professional or regulatory guidance rather than assume that participation in a working group removes existing responsibilities.

For consumers and businesses alike, the main issue to watch is whether the initiative leads to clearer standards, better handling of complaints, improved transparency and stronger protection of digital systems.

The next test is implementation

The NCC’s launch of the Internet Governance Working Group marks a new step in its effort to address emerging digital risks and improve coordination across Nigeria’s internet ecosystem.

The survey presented at the symposium identified gaps in licensees’ readiness to implement ICOP 2026, alongside concerns about AI governance and stakeholder participation. The figures provide a starting point for identifying areas where guidance, training and stronger organisational processes may be needed. The Guardian.

The commission has outlined some next steps, including implementation guidelines, frequently asked questions and workshops for licensees requiring support. It has also pointed to the Cyber Resilience Framework for the Nigeria Communication Sector as part of its broader approach to strengthening digital infrastructure. NCC.

What remains to be demonstrated is the practical impact of those measures. Future progress can be assessed by whether more organisations become ready to implement the code, whether AI policies and oversight arrangements improve, and whether consumers receive clearer information and stronger protection.

The working group will also need sustained participation from the institutions whose decisions shape the online environment. Without engagement and follow-through, the platform risks becoming another forum for discussion without sufficiently measurable outcomes.

Nigeria’s digital economy depends on people and businesses being able to use online services with confidence. That confidence requires reliable infrastructure, responsible handling of data, effective responses to fraud and clear accountability when automated systems are used.

The NCC has now established a forum intended to support that work. Its next responsibility is to help turn the concerns raised at the symposium into clear priorities, practical guidance and demonstrable improvements.

For Nigerians who rely on digital services every day, the ultimate measure of success will not be the launch announcement itself. It will be whether online services become safer, organisations become more accountable and users’ rights receive stronger protection as technology continues to evolve.