The short answer
An AI acceptable use policy sets the rules for using AI at work: which tools are approved and how new ones get approved, what information must never be entered, who reviews outputs and who is accountable, when to disclose AI use, and how to report a mistake. Good policies are short, plain and backed by technical controls, because staff are already using AI and a ban mostly pushes that use out of sight.
In Nigeria, build the policy on the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive (GAID) 2025, which already apply to personal data used in AI. Treat any template, including the checklist below, as a starting point that your legal and HR advisers must review before you publish.
Decide three things before you write
- Scope. Who the policy covers (employees, contractors, volunteers, board members) and what counts as AI: chatbots, AI features inside existing software, browser extensions, meeting note-takers and agents that act on someone's behalf.
- Stance. Approve a small set of business tools rather than banning AI. Bans push people to personal accounts, the problem our shadow AI guide describes.
- Ownership. One accountable owner, supported by your data protection officer, IT and HR, who keeps the policy and the approved tools list current.
The sections your policy needs
| Section | What it should say |
|---|---|
| Purpose and scope | Why the policy exists, who it covers and which tools and uses it applies to |
| Approved tools | The current list, work accounts only, and how to request a new tool (with a security and data protection review) |
| Information never to enter | Credentials in any tool; personal data and client confidential data in any tool or use not approved for it |
| Human review and accountability | The person who uses an output owns it; outputs affecting people, money or compliance are checked first |
| Disclosure | When to tell clients, colleagues or the public that AI helped produce something |
| Accuracy and bias | Verify facts, figures and citations; watch for unfairness in anything about people |
| Intellectual property | Caution with copyrighted material in prompts and with presenting AI output as original work |
| Records and retention | Whether prompts and outputs are business records, and where they are kept |
| Security | No AI browser extensions, plug-ins or add-ins without approval; limits on what agents can access and do |
| Training | Required before access, refreshed when tools change |
| Breaches and reporting | What to do, and how quickly, if restricted information goes into the wrong tool |
| Review cycle | An owner and a review date, plus a review whenever a major tool or law changes |
The parts that need the most care
Information never to enter. Be concrete. Passwords, API keys and other credentials never go into any AI tool. Customer, patient and employee personal data, client confidential data and anything under a non-disclosure agreement never go into unapproved or consumer tools, and go into approved tools only for approved uses. Tie the rules to your data classification. Health, financial and other sensitive data need the strictest rules: the GAID makes a data privacy impact assessment mandatory for processing sensitive data (NDPC).
Human review and accountability. Accountability for decisions rests with the organisation, not with an automated system, and the voluntary NIST AI Risk Management Framework, a useful international reference, calls for clear roles and accountability in its govern function (NIST). Say who reviews what, and keep decisions about individuals with people. The NDPA gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects; where an exception applies, they keep the right to human intervention, to express a view and to contest the decision.
Extensions, plug-ins and agents. An extension can often read whatever is on screen, so each one needs approval. Agents that read email or files and take actions need the least access possible and approval steps for anything consequential: the OWASP Top 10 for LLM applications lists prompt injection and excessive agency among the main risks (OWASP). The GAID also expects organisations that deploy AI to test it in low-risk environments and monitor it continuously, and every tool should come from a vendor you have selected carefully.
Intellectual property and copyright. The law on who owns AI output, and when output infringes someone else's work, is still developing, and vendor terms differ. A cautious policy says: do not paste in third-party material you have no right to use, check output before publishing it as your own, and ask first before using AI for anything you plan to register or license. This is general information, not legal advice.
The Nigerian data protection context
Nigeria has no AI-specific law in force, but the NDPA, enforced by the Nigeria Data Protection Commission (NDPC), applies to personal data used in any AI tool (NDPC). Its requirements map neatly onto an AI policy: a lawful basis for processing, data subject rights, impact assessments for high-risk processing and rules for transfers outside Nigeria, which matter because most hosted AI services process prompts abroad. The GAID 2025, in effect since 19 September 2025, names AI directly: organisations that deploy it must document their safeguards and include them in their annual compliance audit return. Our guide to AI and the NDPA explains the details.
For a model of plain rules, NITDA has advised against putting personal, classified or confidential data into public AI tools and recommends using organisation-approved tools instead (NITDA). Public institutions and regulated sectors should also note NITDA's National Cloud Technical Guideline 2026, effective 1 January 2027, which bases data residency on classification. The advice is aimed mainly at the public sector, but the rules translate well.
Rather talk it through? If staff are already using AI and you need workable rules quickly, we can draft a policy with you that matches your tools and controls, ready for your advisers to review. Talk to a Promatics specialist
AI acceptable use policy checklist
- Purpose, scope and the people covered are stated
- AI is defined to include built-in features, extensions and agents
- Approved tools are listed, and work accounts are required
- New tools have a request route with a data protection and security review
- Information never to enter is listed: credentials anywhere, personal and client confidential data outside approved uses
- The rules are tied to your data classification
- A named person is accountable for every output used in work
- Outputs affecting people, money or compliance are reviewed before use
- Disclosure rules for clients, colleagues and the public are set
- Facts, figures, citations and decisions about people are checked for accuracy and bias
- Intellectual property and copyright cautions are included
- Records and retention rules cover prompts and outputs
- Browser extensions, plug-ins and add-ins need approval
- Agent access is limited, and consequential actions need approval
- Training is required before access
- Reporting steps and contacts for mistakes and breaches are clear
- An owner and a review date are set
- Your legal counsel, HR adviser and data protection officer have reviewed the draft
Making the policy stick
A policy works only if the approved route is easier than the unapproved one. Publish the approved tools list where people will find it, back the rules with technical controls (blocking unapproved apps and extensions, data loss prevention, logging) and train people with examples from their own work. Ask staff to acknowledge the policy, and make reporting a mistake safe: someone who pastes the wrong file and says so quickly is helping you.
When to bring in help
A small organisation using one or two well-known AI tools can draft a sensible policy from this checklist and have its advisers review it.
Bring in help when staff use many AI tools and nobody knows which, when you handle health, financial or client confidential information, when you are deploying agents or building AI applications, or when a board, insurer, regulator or client asks how you manage AI risk. Our AI governance and security service drafts the policy with you, discovers the AI tools already in use, sets up the controls that enforce it and tests AI applications for prompt injection and data leakage. We prepare the policy for your legal and HR advisers; we do not replace them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Information Technology Development Agency, NITDA
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- OWASP Top 10 for LLM Applications (2025), OWASP Gen AI Security Project
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.