Discuss your project
AI Solutions

AI governance, risk and security

AI tools touch documents, email, customer data and systems, often unapproved. We map AI use, set rules, assess risks and test applications, with controls you can explain to a board, auditor, regulator or client.

Discuss your project How the work is delivered

A good fit if

  • Staff use AI tools, and you do not know which or what goes in.
  • You are deploying Microsoft 365 Copilot or AI assistants and need the right controls.
  • A client, insurer, funder, regulator or auditor has asked how you manage AI risk.
  • You build AI features that need misuse testing, or want framework alignment.

What is included

  • Inventory of AI use, including unapproved tools and embedded features
  • Use policy for legal and HR review, staff guidance, register
  • Risk method: privacy, security, accuracy, bias, impact; when impact assessments apply
  • Vendor checks: training, retention, zero retention, location, transfers abroad, security
  • Controls: AI blocking, data loss prevention, sensitivity labels, access policies
  • Security testing of AI applications and agents

What this service is

Governance decides which AI you use, for what and under which rules, and checks they are followed; security protects AI tools and their data from misuse and attack. We do both, sized to your organisation and sector. The usual risk is ordinary information escaping through ordinary tools:

  • A contract pasted into a free chatbot
  • A browser extension reading every page
  • An assistant answering from files the user should not see

Reviews are stronger where decisions affect people; reporting suits boards. Guides: shadow AI, AI use policy.

Testing AI applications

We test assistants, chat features and agents against the OWASP GenAI Top 10 risks for LLM and agentic applications, using realistic scenarios. It complements our security assessments.

Discovery tools and test scenarios

We find AI use with platforms you already have, such as Microsoft Defender for Cloud Apps, a firewall or secure web gateway, and apply controls through them where possible. Tests cover prompt injection, sensitive information disclosure and excessive agency, with scenarios such as a malicious instruction in an uploaded document or a request for another user's data.

Frameworks and Nigerian rules

We help you choose a framework, run a gap assessment and build what it calls for. Many start with the free NIST AI Risk Management Framework and Generative AI Profile (NIST AI 600-1; govern, map, measure, manage), then adopt ISO/IEC 42001, a certifiable AI management system, when clients or contracts require it. Accredited bodies certify; Promatics does not.

RuleWhat it means for AI
NDPA 2023 (enforced by the NDPC)Right not to be subject to solely automated decisions with significant effects; human intervention and contest where an exception applies; impact assessment before high-risk processing
NDPC GAID 2025, in effect since 19 September 2025AI deployers document safeguards in their annual compliance audit return; impact assessment mandatory for profiling, significant automated decisions and transfers outside Nigeria (most hosted AI)
NITDA National Cloud Technical Guideline, from 1 January 2027Data residency for government and regulated-sector workloads; AI providers serving them align AI governance with ISO/IEC 42001
National AI Strategy (Federal Ministry of Communications, Innovation and Digital Economy)Policy, not law
National Digital Economy and E-Governance BillIncludes AI provisions; before the National Assembly
CBN, SEC Nigeria, NAICOM, NCCBanks and payment service providers, capital markets, insurers and telecoms may add expectations
Not legal advice. We design governance with these obligations in view, alongside your legal and data protection advisers. See AI and the NDPA and privacy and compliance readiness.
Delivery

How the work is delivered

  1. Discover

    Security tooling, software inventories, interviews and a short no-blame staff survey.

    Output: AI use inventory.

  2. Assess

    Policies, data protection, vendor terms and risks of each significant use; AI applications tested.

    Output: Risk findings and test results.

  3. Set the rules

    Policy, approval process, risk method and register; roles and responsibilities agreed.

    Output: Governance documents and register.

  4. Apply controls

    Technical controls, priority fixes, and AI scenarios added to incident response.

    Output: Controls and remediation report.

  5. Train and review

    Train staff and owners in safe, effective AI use; review register, risks and controls regularly.

    Output: Training records, review schedule.

Scope at a glance

Not included unless agreed

  • Legal advice or opinions: AI, data protection, employment, sector rules
  • Certification audits, done by accredited certification bodies
  • Out-of-scope remediation, and governance or security tool licences

What we need from you

  • An executive sponsor and a named owner for AI governance
  • Access to security tooling, logs and configuration to discover AI
  • Data protection officer, legal, HR, owner input; test environments, permission

Before handover

  • Each approved tool and use case: owner, risk rating, review date
  • High-risk findings fixed or formally accepted; test findings show evidence, impact, retest
  • Plain-language policies, mapped to your chosen framework if requested

What affects the cost

  • Organisation size; AI tools and use cases
  • Existing tooling's ability to discover and control AI
  • Number and complexity of AI applications to test
  • Framework or certification preparation; training across teams, sites

No package prices: estimates in naira from an agreed scope, taxes shown separately.

Questions buyers usually ask

Should we just ban AI tools?

Bans rarely work. People switch to personal devices and accounts, and you lose visibility. Approving good tools, clear rules about information and blocking only the riskiest services usually reduce risk more.

Is there an AI law in Nigeria?

No AI-specific law is in force. The National Artificial Intelligence Strategy (September 2025) is policy, not law, and a bill with AI provisions is still before the National Assembly. The NDPA, the GAID 2025 and sector regulators already apply (below). Not legal advice.

What is prompt injection?

Hidden instructions in a document, email or web page that make an AI assistant or agent ignore its rules, reveal information or act unintentionally. A main OWASP Top 10 risk for LLM applications, we test for it in every AI application we review.

Do you also secure the AI solutions you build?

Yes. The same controls and tests are part of our generative AI development and AI agents work from the start.

Service

Cybersecurity services

Assessments, endpoint protection, email security, training, incident readiness, and 24/7 monitoring for managed-service clients.

Can you show how your organisation manages AI risk?

Tell us how AI is used today and who is asking. We will arrange a conversation and outline a review sized to your organisation and sector.

Book an AI governance review