Cybersecurity services
Practical cybersecurity: assessments, endpoint protection, email security, training, incident readiness and 24/7 monitoring for managed-service clients.
AI Solutions
AI governance, risk and security
AI tools now touch your documents, email, customer data and business systems, often without anyone having approved them. We help you see where AI is used, set sensible rules, assess the risks of each use and test the AI applications you build or buy, so you can say yes to AI with controls you can explain to a board, an auditor, a regulator or a client.
Who this service is for
A good fit if
- Staff use AI tools and you do not know which ones, or what information goes into them.
- You are rolling out Microsoft 365 Copilot or building AI assistants and need the controls right.
- A client, insurer, funder, regulator or auditor has asked how you manage AI risk.
- You build AI features into products or portals and need them tested for misuse.
- You want to align with a recognised framework such as the NIST AI Risk Management Framework or ISO/IEC 42001.
Another approach may suit you better if
- You need a legal opinion on AI regulation. We work alongside your lawyers and data protection advisers, but we do not give legal advice.
- You want a certificate. We help you prepare for an ISO/IEC 42001 audit, but certification is issued by an accredited certification body.
- You have no AI in use or planned. A short AI readiness assessment is a better first step.
What this service is
AI governance is how your organisation decides which AI to use, for what, under which rules, and how it checks those rules are followed. AI security is how you protect AI tools and applications, and the data they touch, from misuse and attack. We bring the two together in practical, proportionate work that fits your size and sector.
For most organisations the first concern is not exotic AI risk. It is ordinary information escaping through ordinary tools: a contract pasted into a free chatbot, a browser extension reading every page, an assistant that answers from files the user should not see. Governance and security controls make AI safe to use at scale.
What we put in place
- Visibility. We find the AI tools in use, using the security platforms you already have, such as Microsoft Defender for Cloud Apps or your firewall and secure web gateway, alongside a no-blame staff survey. Our guide to shadow AI explains why this matters.
- Rules people can follow. A short AI use policy, an approval path for new tools and a register of approved tools and use cases. Our guide to writing an AI acceptable use policy shows what it covers.
- Risk assessment. A consistent method to assess each new AI use for privacy, security, accuracy, bias and business impact, with stronger review, including a data protection impact assessment where required, when decisions affect people.
- Data protection. Data loss prevention, sensitivity labels and access policies that limit what information reaches AI services, applied through your existing tools where possible.
- Accountability. Named owners, review cycles and reporting that leadership and boards can understand.
Testing AI applications
AI applications and agents introduce new attack paths. We test assistants, chat features and agents for the risks catalogued by the OWASP GenAI Security Project in its Top 10 lists for LLM and agentic applications, such as prompt injection, sensitive information disclosure and excessive agency. Tests use realistic scenarios, such as a malicious instruction hidden in an uploaded document or an attempt to retrieve another user's data. Findings come with evidence, a clear explanation of impact and a retest after fixes. This work complements our broader security assessments.
Frameworks and standards
We use recognised frameworks so your governance holds up to scrutiny. The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) organise AI risk work into four functions: govern, map, measure and manage. ISO/IEC 42001 specifies requirements for an AI management system and can be certified by an accredited body. We help you choose a framework, run a gap assessment and build the documents and controls it calls for. Promatics does not certify compliance.
The Nigerian context
Nigeria has no AI-specific law in force. The National Artificial Intelligence Strategy, published in September 2025 by the Federal Ministry of Communications, Innovation and Digital Economy, is policy rather than law, and the National Digital Economy and E-Governance Bill, which includes AI provisions, is still before the National Assembly. Existing law already applies. The Nigeria Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC), gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, with human intervention and the right to contest where an exception applies, and requires a data protection impact assessment before high-risk processing. The NDPC's General Application and Implementation Directive (GAID) 2025, in effect since 19 September 2025, addresses AI explicitly: organisations that deploy AI must document their safeguards and include them in their annual compliance audit return, and an impact assessment is mandatory for, among other things, profiling, automated decisions with significant effects and transfers outside Nigeria, which most hosted AI services involve. From 1 January 2027, NITDA's National Cloud Technical Guideline sets data residency rules for government and regulated-sector workloads and expects AI providers serving them to align their AI governance with ISO/IEC 42001. The Central Bank of Nigeria (CBN) for banks and payment service providers, and SEC Nigeria, NAICOM and the NCC in their sectors, may add their own expectations. We design governance with these obligations in view and work alongside your legal and data protection advisers. This is general information, not legal advice; see also AI and the NDPA and privacy and compliance readiness.
What is included
The exact list is agreed in writing for each project. These are the usual deliverables and the usual boundaries.
Typical deliverables
- An inventory of AI use, including tools staff use without approval and AI features inside existing software.
- An AI use policy and staff guidance, drafted for your legal and HR advisers to review.
- A register of approved AI tools and use cases, with owners and review dates.
- A risk assessment method for new AI use cases, covering privacy, security, accuracy, bias and business impact, and showing when a data protection impact assessment is needed.
- Vendor due diligence on AI tools, including data use for training, retention and zero data retention options, location, transfers outside Nigeria and security terms.
- Technical controls, such as blocking or limiting unapproved AI services, data loss prevention and access policies, using your existing security platforms where possible.
- Security testing of AI applications and agents for prompt injection, data leakage, excessive permissions and unsafe outputs.
- AI incident response steps added to your existing incident response plan.
- A gap assessment against the NIST AI Risk Management Framework or ISO/IEC 42001, if requested.
- Staff training on safe and effective AI use.
Not included unless agreed separately
- Legal advice and legal opinions on AI, data protection, employment or sector regulation.
- Certification audits, which are carried out by accredited certification bodies.
- Remediation work on systems outside the agreed scope.
- Licences for security or governance tools, which are billed separately.
What we will need from you
Most delays in this kind of work come from access and decisions, not from the technical build. Knowing these early keeps the project predictable.
- An executive sponsor and a named owner for AI governance.
- Access to security tooling, logs and configuration needed to discover AI use.
- Input from your data protection officer, legal, HR and the business owners of AI use cases.
- Test environments and permission to test any AI applications in scope.
Delivery
How the work is delivered
Each stage ends with something you can review before the next one starts.
Discover
Identify AI use across the organisation through security tooling, software inventories, interviews and a short staff survey.
Output: AI use inventory.
Assess
Review policies, data protection, vendor terms and the risks of each significant AI use, and test AI applications in scope.
Output: Risk findings and test results.
Set the rules
Draft the AI use policy, approval process, risk assessment method and register, and agree roles and responsibilities.
Output: Governance documents and register.
Apply controls
Configure technical controls, fix priority findings and add AI scenarios to incident response.
Output: Implemented controls and remediation report.
Train and review
Train staff and owners, then review the register, risks and controls on a regular cycle.
Output: Training records and review schedule.
Testing and handover
- Every approved AI tool and use case has an owner, a risk rating and a review date.
- High-risk findings are fixed or formally accepted by an accountable owner.
- Security test findings include evidence, impact and retest results.
- Policies are written in plain language that staff can follow.
- Governance documents map to the framework you chose, where one was requested.
What affects the cost
We do not publish package prices. Each estimate is based on an agreed scope, in naira, with taxes shown separately. These are the things that move the number most:
- The size of the organisation and the number of AI tools and use cases in scope.
- Whether existing security tooling can discover and control AI use.
- The number and complexity of AI applications to test.
- Framework alignment or certification preparation, if requested.
- Training needs across teams and sites.
Questions buyers usually ask
Should we just ban AI tools?
Bans rarely work. People use personal devices and accounts instead, and you lose visibility. Approving good tools, setting clear rules about information, and blocking only the riskiest services usually reduces risk more.
Which framework should we use?
The NIST AI Risk Management Framework, with its Generative AI Profile, is a practical, freely available starting point. ISO/IEC 42001 sets out requirements for an AI management system that can be certified. Many organisations start with NIST and move to ISO/IEC 42001 when clients or contracts require certification, and NITDA's National Cloud Technical Guideline expects AI providers serving government and regulated-sector workloads to align with ISO/IEC 42001.
Is there an AI law in Nigeria?
There is no AI-specific law in force. The National Artificial Intelligence Strategy, published in September 2025, is policy rather than law, and a bill with AI provisions is still before the National Assembly. The Nigeria Data Protection Act 2023 (NDPA) and the NDPC's GAID 2025 already apply to personal data used in AI systems, and sector regulators such as the CBN, SEC Nigeria, NAICOM and the NCC may have their own expectations. This is general information, not legal advice.
What is prompt injection?
An attack where instructions hidden in a document, email or web page make an AI assistant or agent ignore its rules, reveal information or take unintended actions. It is one of the main risks in OWASP's Top 10 for LLM applications, and we test for it in every AI application we review.
Do you also secure the AI solutions you build?
Yes. The same controls and tests are part of our generative AI development and AI agents work from the start.
Related
Privacy and compliance readiness
Get your privacy and security practices ready for regulators, clients, auditors and insurers, with gaps found and fixed before someone asks.
Shadow AI and how to control it
Why staff use unapproved AI tools, the real risks for Nigerian organisations, and how to find and control shadow AI without banning AI.
Can you show how your organisation manages AI risk?
Tell us how AI is used today and who is asking the questions. We will reply to arrange a conversation and outline a governance and security review that fits your size and sector.