The short answer
It sets the rules for AI at work: approved tools and adding new ones, what never to enter, who reviews and owns outputs, when to disclose AI use, how to report mistakes. Keep it short, backed by technical controls; bans push use out of sight. Build on the NDPA and the NDPC's GAID 2025, which already cover personal data in AI, then have legal and HR advisers review any template.
Decide three things before you write
Scope
Employees, contractors, volunteers, board; chatbots, built-in AI features, extensions, meeting note-takers and agents.
Stance
Approve a few business tools; bans push people to personal accounts (see shadow AI).
Ownership
One accountable owner, backed by your data protection officer, IT and HR, keeps policy and tools list current.
The sections your policy needs
- Purpose and scope
- Approved tools
- Information never to enter
- Human review and accountability
- Disclosure
- Accuracy and bias
- Intellectual property
- Records and retention
- Security
- Training
- Breaches and reporting
- Review cycle
The checklist below says what each section must contain; four need the most care.
The parts that need the most care
Information never to enter
Credentials never. Personal, client confidential and NDA data only in approved tools, for approved uses.
Human review
The organisation, not an automated system, is accountable. Name reviewers; people decide about individuals.
Extensions and agents
Approve each extension. Agents get least access and approval steps for consequential actions.
Intellectual property
Unsettled law, differing vendor terms: no unlicensed third-party material; check output before claiming it.
More detail and sources
Information never to enter. Credentials: never, in any AI tool. Customer, patient and employee personal data, client confidential data and NDA material: never in unapproved or consumer tools, and in approved tools only for approved uses. Tie it to your data classification; health, financial and other sensitive data need the strictest rules.
Human review and accountability. Accountability for decisions rests with the organisation, not an automated system; the voluntary NIST AI Risk Management Framework, a useful international reference, calls for clear roles and accountability in its govern function. Say who reviews what; keep decisions about individuals with people.
Extensions, plug-ins and agents. Extensions often read whatever is on screen: approve each one. Agents that read email or files and act need least access and approval for anything consequential; the OWASP Top 10 for LLM applications lists prompt injection and excessive agency among the main risks. Choose every tool's vendor carefully.
Intellectual property. Who owns AI output, and when it infringes others' work, is still developing law, and vendor terms differ. Cautious rules: no third-party material you have no right to use; check output before presenting it as your own; ask first before using AI on anything you will register or license. General information, not legal advice.
The Nigerian data protection context
Nigeria has no AI-specific law in force, but existing rules already shape your policy. General information, not legal advice.
| Source | What it means for your policy |
|---|---|
| NDPA 2023, enforced by the NDPC | Applies to personal data in any AI tool: lawful basis, data subject rights, impact assessments for high-risk processing, rules for transfers outside Nigeria (most hosted AI processes prompts abroad) |
| NDPA automated decisions | Right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects; where an exception applies, the right to human intervention, to express a view and to contest it |
| GAID 2025, in effect since 19 September 2025 | Names AI: document safeguards and include them in the annual compliance audit return; test AI in low-risk environments and monitor it continuously; a data privacy impact assessment is mandatory for sensitive data |
| NITDA advice | Mainly for the public sector, but translates well: no personal, classified or confidential data in public AI tools; use organisation-approved tools |
| NITDA National Cloud Technical Guideline 2026 | For public institutions and regulated sectors, effective 1 January 2027: data residency based on classification |
Our guide to AI and the NDPA explains the details.
Rather talk it through? If staff are already using AI and you need workable rules quickly, we can draft a policy with you that matches your tools and controls, ready for your advisers to review. Talk to a Promatics specialist
AI acceptable use policy checklist
- Purpose, scope and the people covered are stated
- AI is defined to include built-in features, extensions and agents
- Approved tools are listed, and work accounts are required
- New tools have a request route with a data protection and security review
- Never-enter list: credentials; personal and client confidential data outside approved uses
- The rules are tied to your data classification
- A named person is accountable for every output used in work
- Outputs affecting people, money or compliance are reviewed before use
- Disclosure rules for clients, colleagues and the public are set
- Facts, figures and citations checked; decisions about people checked for bias
- Intellectual property and copyright cautions are included
- Records rules say whether prompts and outputs are kept, and where
- Browser extensions, plug-ins and add-ins need approval
- Agent access is limited, and consequential actions need approval
- Training is required before access and refreshed when tools change
- Reporting steps, deadlines and contacts for mistakes and breaches are clear
- Owner and review date set; reviewed again when tools or laws change
- Legal counsel, HR adviser and data protection officer have reviewed the draft
Making the policy stick
- Easy approved routePublish the approved tools list where people look.
- Technical controlsBlock unapproved apps and extensions; data loss prevention; logging.
- Practical trainingExamples from people's own work; staff acknowledge the policy.
- Safe reportingWhoever pastes the wrong file and says so quickly is helping.
When to bring in help
With one or two well-known AI tools, a small organisation can draft from this checklist and have advisers review it. Bring in help when nobody knows which AI tools staff use, you handle health, financial or client confidential information, you deploy agents or build AI applications, or a board, insurer, regulator or client asks how you manage AI risk. Our AI governance and security service drafts the policy with you, finds AI tools already in use, sets up enforcing controls and tests AI applications for prompt injection and data leakage. We prepare the policy for your legal and HR advisers; we do not replace them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Information Technology Development Agency, NITDA
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- OWASP Top 10 for LLM Applications (2025), OWASP Gen AI Security Project
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.