Nigeria’s Internet Regulator Moves to Close AI Governance and Cybersecurity Gaps After Survey Exposes Industry Readiness Concerns

By Simpson Global Media News Desk

Nigeria’s telecommunications regulator, the Nigerian Communications Commission (NCC), has established an Internet Governance Working Group after a survey exposed significant gaps in the readiness of telecommunications and internet service licensees to implement the country’s 2026 Internet Code of Practice.

The initiative, announced at the commission’s inaugural Internet Governance Symposium in Lagos on October 15, 2026, is intended to strengthen cooperation across the digital sector and help stakeholders address emerging challenges involving artificial intelligence (AI), cybersecurity, online fraud, privacy and the protection of internet users.

The findings presented at the symposium showed that only two of the 19 licensees assessed were fully prepared to implement the code. Nine reported partial readiness, while five said they were not ready. The published figures do not account for the readiness status of three of the 19 licensees assessed. The NCC said operators needed clearer guidance and practical support to meet the code’s requirements. <Cite refs={["turn144112search4","turn144112search8","turn144112search1"]}/>

The development comes as artificial intelligence becomes increasingly integrated into business operations, customer services, communications infrastructure and digital platforms. It also raises questions about whether companies’ internal policies, technical safeguards and compliance procedures are keeping pace with the speed of technological adoption.

For Nigerian consumers and businesses, the outcome could influence how online platforms handle harmful content, how digital services protect personal information, how internet providers respond to cybersecurity threats and how companies deploy AI-powered systems.

The working group is expected to provide a continuing platform for dialogue beyond the October symposium. However, its establishment does not by itself demonstrate that compliance gaps have been resolved. Its effectiveness will depend on the practical guidance, coordination and follow-through that emerge from its work. <Cite refs={["turn144112search4","turn144112search1"]}/>

Survey Reveals Gaps in Industry Preparedness

The NCC presented the survey findings during its first Internet Governance Symposium in Lagos, where officials and stakeholders examined the state of internet governance and the challenges confronting Nigeria’s communications sector.

According to reports of the findings, the survey received 47 responses from stakeholders across industry, academia and civil society. The respondents included representatives of mobile network operators, internet service providers and academic institutions. The assessment sought to understand the level of preparedness for the Internet Code of Practice 2026 and identify areas where stakeholders required further guidance. <Cite refs={["turn144112search1","turn144112search8"]}/>

The results indicated that preparation was uneven. Two of the 19 licensees assessed were considered fully ready to implement the code, while nine reported partial readiness and five said they were not prepared.

The numbers point to a substantial implementation challenge. Nevertheless, they should be interpreted carefully: the survey results do not establish that every Nigerian telecom operator or internet provider is unprepared, nor do they show that every organisation has failed to protect its customers. They describe the readiness of the licensees assessed, based on the information reported by the commission.

The findings also do not mean that all the organisations assessed have committed violations. Readiness to implement a regulatory code is different from a finding that a company has broken the law or breached an existing obligation.

Instead, the figures highlight the distance between having a regulatory framework and ensuring that the organisations expected to follow it understand its requirements and have the procedures needed to put them into practice.

The NCC’s response is therefore significant because compliance with technology rules often requires more than issuing a policy document. Companies must translate regulatory expectations into internal responsibilities, technical processes, staff training, monitoring systems and clear reporting arrangements.

For example, an organisation may understand that it must improve cybersecurity but still need to determine who is responsible for responding to incidents, how quickly a threat must be escalated, what evidence must be preserved and how regulators should be notified.

Similarly, an operator may be using AI tools without having a sufficiently detailed internal policy explaining how those tools are assessed, monitored and supervised.

The commission’s decision to establish a working group suggests that continued engagement and clearer implementation guidance will be important parts of its response to these challenges. <Cite refs={["turn144112search1","turn144112search4"]}/>

Why the Internet Code of Practice Matters

The Internet Code of Practice provides a framework for responsibilities in Nigeria’s online environment. Its implementation matters because digital services now influence communication, commerce, education, financial transactions, entertainment and access to public information.

Telecommunications operators and internet service providers occupy an important position in this system. Their infrastructure connects users to websites, applications, businesses and public services, while their operational decisions can affect the reliability and safety of digital communications.

The wider internet ecosystem also includes digital platforms, content providers, technology developers, businesses and public institutions. These organisations face different responsibilities depending on their activities, but their actions can have consequences for consumers and the wider public.

A clear and workable code can help establish what regulated organisations are expected to do and how their performance should be assessed. It can also support more consistent approaches to online safety and accountability.

However, a regulatory framework will only be effective if organisations understand the obligations that apply to them and have the resources and systems needed to comply.

The NCC’s survey indicates that the implementation process requires additional attention. The commission’s reported concerns about the complexity of some requirements, particularly those involving cybersecurity and AI, suggest that the regulator and the industry need to resolve questions about how the rules should operate in practice. <Cite refs={["turn144112search4","turn144112search8"]}/>

Clear guidance can help prevent different organisations from interpreting the same requirement in incompatible ways. It can also help smaller providers understand what they must do without having to build expensive compliance systems from scratch.

At the same time, implementation support must not weaken the underlying objectives of online safety, responsible technology use and consumer protection. The challenge is to make requirements understandable and achievable while maintaining meaningful standards.

The coming stages of the process will therefore be important in determining whether the code becomes a practical instrument for improving digital safety or remains a set of obligations that organisations struggle to apply consistently.

Artificial Intelligence Is Advancing Faster Than Governance

One of the central issues raised by the survey is the growing use of artificial intelligence across Nigeria’s communications sector.

AI can support a range of telecommunications functions, including customer-service automation, network monitoring, fraud detection, operational forecasting and the analysis of large volumes of information. Properly designed systems can help organisations identify patterns, respond to customers more quickly and improve the management of complex networks.

However, the same technologies can introduce risks when they are deployed without adequate safeguards.

An automated system may produce inaccurate information, make an inappropriate recommendation or handle personal data in ways that users do not expect. AI-generated material can also be used to create misleading content, while automated tools can be exploited to make scams more convincing or to increase the scale of fraudulent activity.

These concerns are especially important when technology affects decisions about customers, access to services or the handling of sensitive information.

A survey reported by BusinessDay on October 15 said 73 per cent of surveyed communications-sector licensees were using or piloting AI in live operations, while 27 per cent had no governance arrangements for their AI systems. The figures indicate that AI use is already part of operations for many respondents, even as governance structures remain incomplete in some organisations. <Cite refs={["turn993091search4","turn144112search13"]}/>

The findings highlight a distinction between adopting a technology and governing it responsibly.

A company can introduce an AI system to improve efficiency, but it also needs to consider how the system will be tested, what information it can access, who is accountable for its output and what happens when it produces an error.

Effective governance can include documented policies, risk assessments, human oversight, monitoring procedures and a clear process for investigating complaints or incidents. The appropriate controls will depend on the system’s purpose and the potential consequences of its decisions.

For instance, an AI tool used to classify routine customer enquiries may present a different level of risk from a system used to assess identity, detect suspected fraud or make decisions that could restrict a customer’s access to a service.

Organisations therefore need approaches that account for the technology they use rather than treating every AI application as identical.

The NCC’s focus on AI governance reflects a broader challenge for regulators: ensuring that innovation continues while establishing appropriate standards for accountability, transparency and the protection of users.

Cybersecurity Remains a Major Concern

Cybersecurity was another area identified among the difficult requirements for organisations preparing to implement the Internet Code of Practice.

The concern is significant because telecommunications networks and internet services support essential activities across the economy. A serious disruption can affect individuals, companies and public institutions that depend on digital connectivity to operate.

Threats may include unauthorised access to systems, attempts to steal credentials, fraudulent communications, malicious software and attacks intended to disrupt services or expose sensitive information.

The growing use of automated technology can complicate this environment. AI may help security teams detect unusual activity, but automated tools can also be used by malicious actors to generate convincing messages, adapt scams or carry out certain activities at greater scale.

No single technology can eliminate these risks. Effective cybersecurity depends on a combination of technical protections, staff awareness, incident response planning, secure system design and ongoing assessment.

For communications providers, preparation also means knowing how to identify incidents, assign responsibility, preserve relevant records, restore affected services and communicate appropriately with regulators and customers.

The NCC’s survey does not establish that the organisations assessed have all suffered cyberattacks. Rather, it points to preparedness and compliance as areas that require attention. The distinction matters because an assessment of readiness should not be presented as evidence of a specific security breach.

A functioning governance process can help organisations understand their responsibilities before an incident occurs. It can also provide a basis for improving coordination when a threat affects more than one provider or service.

For consumers, stronger cybersecurity practices can contribute to safer digital transactions, better protection of personal information and greater confidence in online services.

For businesses, they can reduce the likelihood that a preventable incident will interrupt operations, damage customer relationships or expose confidential information.

The challenge is to ensure that security measures are not treated as a one-time exercise. Digital threats evolve, systems change and new services introduce new dependencies. Security arrangements must therefore be reviewed and updated as organisations adopt new technologies. <Cite refs={["turn144112search4","turn144112search1"]}/>

NCC Establishes a Continuing Stakeholder Platform

The creation of the Internet Governance Working Group is one of the main outcomes of the October symposium.

According to the NCC’s announcement, the platform is intended to sustain engagement among stakeholders and encourage coordinated action on issues affecting Nigeria’s digital environment. The commission has emphasised collaboration because questions involving online safety, AI, fraud and privacy extend beyond the responsibilities of any single organisation. <Cite refs={["turn144112search4","turn993091search3"]}/>

A continuing working group could help stakeholders discuss recurring problems, clarify expectations and identify where additional guidance is needed. It could also provide a forum for organisations to explain practical obstacles encountered when trying to implement regulatory requirements.

Such engagement can be useful when the regulated sector includes organisations of different sizes and capabilities. A large operator may have dedicated legal, compliance and cybersecurity teams, while a smaller provider may need additional assistance to develop the same processes.

The working group’s value will depend on whether discussions lead to clear outcomes.

These could include practical guidance, agreed priorities, improved communication channels and a process for reviewing progress. Stakeholders would also benefit from knowing which organisations are responsible for particular tasks and how implementation concerns can be raised.

The NCC’s announcement establishes the group’s purpose, but the information available does not confirm a complete schedule of deliverables, a final work programme or measurable targets for closing every gap identified in the survey.

Those details will matter as the initiative develops.

A working group can provide a platform for cooperation, but it cannot replace the responsibilities of individual licensees to understand and meet the rules that apply to their operations.

Similarly, dialogue should complement, rather than substitute for, transparent supervision and proportionate enforcement where obligations are not met.

The key test will be whether the new arrangement helps move the sector from general discussion to practical implementation.

The Need for Clearer Guidance and Reporting

One issue emerging from the survey was the need for clearer implementation guidance and reporting templates.

Regulatory requirements can become difficult to apply when organisations are uncertain about the evidence they must provide, the procedures they should follow or how the regulator will assess compliance.

A reporting template can help standardise the information submitted by different organisations. Clear guidance can explain what information is required, who should provide it and how it will be used.

Consistency is particularly important when a regulator is assessing many different organisations. Without a shared understanding of expectations, submissions may vary in quality and completeness, making it harder to compare readiness or identify recurring weaknesses.

Practical guidance can also help organisations prioritise improvements. If a requirement is unclear, a company may spend time building a process that does not address the regulator’s expectations. More precise instructions can reduce that uncertainty.

However, templates alone will not resolve every implementation problem. Organisations may still need technical expertise, internal training, investment in security systems and clear accountability structures.

The NCC will also need to communicate how the guidance relates to the requirements of the code and any other applicable rules. Organisations need to understand the difference between recommended good practice, specific compliance obligations and measures that may be required in response to a particular risk.

The commission’s reported findings suggest that a combination of clarification and capacity-building could help address the readiness gap. <Cite refs={["turn144112search1","turn144112search2"]}/>

Protecting Privacy and Personal Information

Privacy is another important issue in the changing digital environment.

Online services can process substantial amounts of information about users, including account details, usage patterns and information submitted through digital platforms. AI applications may introduce additional questions about how such information is collected, stored, analysed and used.

Responsible data handling requires organisations to understand what information they need, why they need it and how they will protect it. Access should be appropriately controlled, and information should not be used in ways that are inconsistent with applicable legal requirements or the expectations communicated to users.

AI systems can complicate these responsibilities because data may be used to train, test or operate automated tools. Organisations need to consider whether the information is suitable for the intended purpose and whether appropriate protections are in place.

Privacy concerns are not limited to large technology companies. Telecommunications providers, internet services, financial technology businesses, online retailers and other organisations can all encounter sensitive information through their digital operations.

Users also need clear explanations of how their information is handled and where they can raise concerns.

The NCC’s Internet Governance Working Group has been established in a context that includes privacy and online safety, but its launch should not be interpreted as a finding that any particular organisation has mishandled customer data.

The broader issue is whether governance arrangements keep pace with the technology and the information-processing activities taking place across the sector.

Effective privacy practices can help build confidence in digital services. They can also reduce the likelihood of avoidable exposure, misuse or confusion about how personal information is being handled.

For businesses adopting AI, privacy should be considered from the beginning of a project rather than added only after a system has been deployed.

What the Development Means for Internet Users

For ordinary Nigerians, the significance of internet governance can be difficult to see because many of the relevant decisions take place inside companies and regulatory institutions.

Yet the effects can reach users through the quality of digital services, the handling of complaints, the security of accounts and the response to online abuse or fraud.

Clearer rules and better implementation may help providers understand their responsibilities and establish more consistent processes. Better cybersecurity planning can support service reliability and improve responses to incidents. Appropriate AI oversight can help reduce the risk of automated systems producing harmful or misleading outcomes.

Consumers should not, however, expect the establishment of the working group to produce immediate changes across every service.

The announcement is an institutional step, not evidence that all problems have been resolved. Its effects will depend on the actions taken by the NCC, telecommunications licensees and other relevant stakeholders.

Users can continue to take basic precautions when using online services. These include protecting account credentials, using available security features, checking the authenticity of unexpected requests for money or personal information and reporting suspected fraud through appropriate channels.

Such precautions do not transfer responsibility for cybersecurity from service providers to consumers. Organisations remain responsible for the security measures and legal obligations that apply to their own systems and services.

The regulator’s challenge is to encourage a digital environment in which consumers can access services with greater confidence while companies have a clear understanding of their responsibilities.

Implications for Telecommunications Companies

For telecom operators and internet service providers, the survey findings underline the importance of assessing internal readiness rather than assuming that existing procedures are sufficient.

Companies may need to review their compliance policies, assign clear responsibility for implementation and ensure that staff understand the requirements relevant to their roles.

They may also need to assess whether their AI systems are covered by documented governance arrangements and whether their cybersecurity processes are sufficiently developed to identify and respond to threats.

Where requirements are unclear, providers can seek clarification through the appropriate regulatory channels. They should also ensure that internal compliance teams, technical staff and senior management communicate effectively about the steps required.

A practical readiness review can help an organisation identify which procedures already exist, where gaps remain and what resources are needed to address them.

The findings do not mean that every organisation must adopt identical technology or use the same internal structure. Different services and risk profiles may require different safeguards. The important point is that each organisation should be able to demonstrate that it understands and addresses the obligations applicable to its operations.

The NCC’s working group may help by making discussions more consistent and identifying common implementation challenges. But each provider will still need to translate relevant requirements into its own operations.

For smaller companies, clearer templates and guidance could be particularly useful if they reduce uncertainty about what must be documented and reported.

For larger organisations, the findings reinforce the need to ensure that existing AI and cybersecurity programmes align with the requirements of the code rather than relying solely on general corporate policies.

Balancing Innovation With Accountability

Nigeria’s digital economy depends on the development and adoption of new technologies. AI, digital communications and online services can create opportunities for businesses, improve access to information and support new ways of delivering services.

Regulation is most useful when it helps establish trustworthy conditions for that innovation without imposing unnecessary uncertainty.

Too little oversight can leave users exposed to avoidable risks and make it difficult to determine who is responsible when technology causes harm. Unclear or inconsistently applied rules can also make it harder for responsible businesses to plan investments and introduce new services.

A workable governance framework needs to make expectations understandable, keep accountability clear and allow organisations to address risks proportionately.

AI governance is especially challenging because applications vary widely. Some tools perform routine administrative tasks, while others can influence important decisions or process sensitive information.

A risk-based approach can help organisations determine where stronger testing, human oversight or additional safeguards are necessary. It can also help regulators focus attention on systems and practices that could have more serious consequences for users.

Cybersecurity requires a similar balance between establishing minimum expectations and recognising that threats and technologies evolve. Organisations need sufficient flexibility to improve their defences, while regulators need ways to assess whether the protections are effective.

The NCC’s working group provides an opportunity for stakeholders to discuss these issues in the context of Nigeria’s communications sector. Its long-term value will depend on the quality of the guidance and the degree to which its work supports practical, measurable improvements.

What Happens Next?

The immediate challenge is to turn the survey’s findings into an actionable implementation process.

The NCC has said the working group will provide a continuing platform for stakeholder engagement. Its broader internet governance agenda includes online safety, AI accountability, privacy and cybersecurity, while the survey has highlighted the need for clearer guidance for licensees. <Cite refs={["turn144112search4","turn993091search3"]}/>

Further progress would be easier to assess if the commission and stakeholders establish clear priorities, communicate expectations and explain how readiness will be reviewed.

Useful indicators could include the publication of practical implementation guidance, improved reporting arrangements, greater awareness among licensees and evidence that organisations have addressed identified weaknesses. These are potential measures for assessing progress, not confirmed commitments or deadlines announced by the NCC.

Transparency will also matter. Public updates on the working group’s activities and the challenges it identifies could help businesses and consumers understand whether the initiative is producing results.

The regulator will need to balance openness with appropriate protection for confidential or security-sensitive information. Publishing general progress and guidance can improve accountability without requiring organisations to disclose details that could expose vulnerabilities.

The industry, meanwhile, will need to take responsibility for translating the rules into daily practice. That includes reviewing policies, improving internal controls, training staff and ensuring that new technologies are deployed with appropriate safeguards.

The October survey provides a snapshot of readiness among the licensees assessed. It does not determine how the sector will perform in the months ahead. Further information will be needed to establish whether the gaps are narrowing and which areas continue to require support.

A Critical Test for Nigeria’s Digital Governance

The NCC’s establishment of an Internet Governance Working Group comes at a time when AI and digital communications are becoming increasingly important to the way Nigerians work, communicate and access services.

The survey’s findings show why the adoption of technology must be accompanied by governance arrangements that can address the risks associated with its use. Although many organisations are exploring or using AI, the reported gaps in readiness indicate that implementation support and internal accountability remain important concerns.

The creation of a working group offers a mechanism for sustained engagement, but the announcement is only one stage of a longer process.

The commission will need to turn discussions into clear guidance and meaningful follow-through. Telecommunications and internet service providers will need to examine their own readiness and address any gaps in the requirements that apply to them. Stakeholders will also need to consider how AI, cybersecurity and privacy protections can be maintained as digital services evolve.

For consumers, the intended outcome is a safer and more dependable online environment. For businesses, it is a clearer understanding of their obligations and a more predictable basis for adopting technology responsibly.

Whether the initiative achieves those aims will depend less on the existence of the working group than on the practical changes that follow. The next phase will be measured by how effectively the NCC and the communications sector convert the survey’s warning into stronger governance, better preparedness and greater accountability across Nigeria’s digital ecosystem.