There is a new governance gap emerging in Nigerian workplaces.
Employees are already using AI to write reports, analyse data, screen CVs, prepare presentations and solve everyday business problems. In many organisations, the policies governing that use have not caught up.
An employee may be using an AI tool the IT team has never approved. A customer’s personal information may be entered into a generative AI platform without anyone considering where that data goes. An AI-generated recommendation may influence a recruitment decision without anyone checking whether the underlying model is biased.
The technology may be new. The governance questions are not.
Who is accountable? What data is being used? What decisions can AI influence? What happens when the system gets it wrong?
These are not simply technology questions. They are questions of ESG (Environmental, Social, and Governance performance). At Teasoo Consulting, we believe responsible AI belongs in the corporate governance conversation, not at the edge of the business as an IT issue.
What Already Governs AI in Nigeria?
Nigeria does not yet have a standalone AI Act, but businesses are not operating in a vacuum. The most important starting point is the Nigeria Data Protection Act (NDPA) 2023.
Most AI systems depend on personal data. The NDPA requires organisations to establish lawful bases for processing that data, conduct Data Protection Impact Assessments for high-risk applications, ensure transparency around automated decision-making, and maintain human oversight where significant decisions are involved.
You cannot simply purchase an AI tool, connect company data to it and assume compliance is someone else’s responsibility.
The Bias Problem
The governance challenge becomes particularly acute when AI influences employment decisions. Nigerian employers are exploring AI for CV screening, candidate ranking, psychometric assessments and performance analysis. But AI systems are not neutral.
If a recruitment model learns from historical hiring data that reflects existing biases (under representation of women in senior roles, or patterns that disadvantage candidates from certain backgrounds), it will replicate those patterns. It does not recognise bias. It recognises patterns and optimises for them.
A minimum standard for AI-assisted recruitment should include auditing training data before deployment, requiring human sign-off on shortlists, and giving candidates a way to request an explanation of any AI-influenced outcome. The Nigerian Constitution protects dignity, fair hearing and freedom from discrimination. Employers should not wait for a landmark case before acting.
The absence of established case law is not the absence of risk.
Cybersecurity, the Environment, and the Boardroom
AI governance connects to two concerns that are often treated separately.
On cybersecurity: employees may unknowingly expose confidential data through public AI tools; poorly governed integrations create new vulnerabilities; and attackers are using AI to craft more convincing phishing campaigns. Digital risk can no longer sit with IT alone. It belongs on the boardroom agenda alongside data protection and AI governance.
On environment: large AI models are energy and water intensive. For organisations with international ESG reporting obligations or supply chain relationships in markets where AI-related environmental disclosure is emerging, this is a present consideration, not a future one.
What Employers Can Do Today
A practical Responsible AI and Acceptable Use Policy is the right starting point. At minimum, employees should understand which tools are approved, what information can and cannot be entered, when AI outputs must be verified, which decisions require human approval, and who to contact when something goes wrong.
Employees should never enter confidential or personal information into non-approved AI systems, including customer data, employee records, contracts or internal strategy documents. An employee who asks a public chatbot to clean up a spreadsheet containing customer data may have created a data-protection problem without realising it.
Organisations can also classify AI use by risk level. Low-risk activities (brainstorming or drafting with public information) need light controls. Medium-risk uses involving internal data require stronger handling and a verification step. High-risk uses (recruitment, performance evaluation, financial decisions) require robust governance, documentation and mandatory human sign-off.
International Standards Can Help
ISO/IEC 42001:2023, the world’s first international standard for AI management systems, asks organisations to inventory their AI tools, assess associated risks, implement proportionate controls and monitor performance on an ongoing basis. It is independently certifiable, which makes it a meaningful signal to regulators, investors and partners. The NIST AI Risk Management Framework provides a complementary structure built around four functions: Govern, Map, Measure and Manage.
Neither requires an organisation to start from scratch. Both provide a foundation for AI governance that is systematic rather than reactive.
The Bigger Picture
The question is no longer whether Nigerian employees are using AI. Most already are. The more important question is whether organisations know how it is being used, what data it is processing, what decisions it is shaping, and who is accountable when something goes wrong.
Responsible AI is becoming part of responsible business.
At Teasoo Consulting, we help organisations navigate emerging governance, regulatory and ESG requirements, translating complex and fast-moving developments into practical frameworks that strengthen accountability and long-term resilience. Responsible AI does not mean putting innovation on hold. It means ensuring that as AI becomes more powerful, governance becomes stronger too.
#ResponsibleAI #AIGovernance #NigeriaBusiness #ESG #TeasooConsulting #YourPartnerF
