Nigeria is reviewing its cybersecurity legal guidelines to counter mounting threats as synthetic intelligence (AI) makes fraud, digital deception, and assaults on crucial infrastructure tougher to detect.
AI was linked to 55% of cybercrime incidents recorded throughout Africa final 12 months, whereas deepfake circumstances elevated sevenfold between the second and fourth quarters of 2024. Cybercriminals are utilizing AI to automate scams, create convincing pretend identities, and extra rapidly determine weaknesses in crucial systems. This means attackers are adopting the know-how quicker than establishments can strengthen their defences, leaving current safety systems and legal guidelines struggling to maintain up.
This rising know-how hole is the first driver behind the present legislative overview, because the Nigerian authorities acknowledges that current frameworks fail to offer ample guardrails or align with worldwide finest practices.
Nigeria is additionally contemplating a nationwide cybersecurity structure to determine baseline safety requirements for organisations nationwide. However, until these reforms enhance enforcement, fortify susceptible infrastructure, and foster native technical experience, they threat increasing state surveillance powers with out making Nigeria’s digital economic system any safer.
Nigeria’s cybersecurity reforms are progressing alongside three distinct tracks. The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 was amended in February 2024, whereas a broader coverage overview convened lawmakers, authorities companies, and trade stakeholders in Lagos. The National Cybersecurity Policy and Strategy, first launched in 2014 and revised in 2021, is due for its five-year overview in 2026. Meanwhile, the proposed National Digital Economy and E-Governance Bill 2025, which underwent a public hearing in November 2025, goals to determine a complete authorized framework for digital companies and e-governance.
Together, these initiatives handle cybercrime enforcement, institutional safety, and the governance of Nigeria’s increasing digital economic system.
What is the federal government making an attempt to repair?
The authorities says it has superior work on a draft executive bill designed to strengthen the nation’s authorized protections against cyber threats.
In October 2026, Adedeji Stanley Olajide, Chairman of the House Committee on ICT & Cybersecurity, advised TechCabal on the sidelines of the International Cybersecurity Conference in Abuja that “the timeline is immediately after the election…” as a result of not a lot can occur throughout political marketing campaign season.
The lawmaker, nonetheless, expressed confidence that between January and June 2027, “the cybercrime, cybersecurity, and digital economy bills” would all be enacted into legislation.
He maintained that, as soon as enacted, these legal guidelines would curb cyberbullying and different cyber threats and implement stricter compliance and safety requirements throughout the monetary sector.
The urgency for reform is evident: nine in ten Nigerian children face risks of cyberbullying, harassment, and on-line exploitation.
Financial establishments beneath siege
Nigeria’s monetary sector additionally faces urgent vulnerabilities. In 2025, Nigeria lost ₦25.85 billion ($19.2 million) to electronic payment fraud. In September 2026, the Central Bank of Nigeria (CBN) cautioned banks, fintechs, and cost service suppliers that cyber dangers and AI-driven vulnerabilities pose direct threats to monetary stability.
These warnings align with findings from TC Insights’ report: “The Compliance Reckoning: Regulating Financial Services in the Age of AI.” The examine notes that whereas gross fraud losses decreased in 2025, AI-powered assaults have grown significantly extra refined, with escalating regulatory fines underscoring systemic compliance dangers.
In 2025 additionally, the Nigeria Data Protection Commission (NDPC) fined MultiChoice Nigeria ₦766.24 million ($568,630) for knowledge safety breaches and unauthorised cross-border transfers of non-public knowledge. Also, the Commission launched investigations into 1,369 organisations throughout the banking, insurance coverage, pensions, and gaming sectors
In a separate case, the Economic and Financial Crimes Commission (EFCC) investigated a ₦3 billion ($2.23 million) fraud scheme that focused First City Monument Bank buyer accounts via unauthorised entry.
These incidents exhibit how systemic cyber vulnerabilities go away shoppers uncovered, compromise delicate information, and erode belief in public establishments.
Even the federal government is not secure
Nigeria’s cybersecurity dangers additionally lengthen to public establishments as authorities infrastructure has confirmed susceptible. The AI-generated photo controversy involving the Independent National Electoral Commission’s voter register revealed that suspicious voter information entered the fee’s database via authorised registration terminals operated by its personal officers, quite than through an exterior hack. It uncovered a weak point in how public establishments management entry, monitor workers exercise, and confirm knowledge earlier than including it to their systems.
The Corporate Affairs Commission experienced a major breach exposing over 15 million company paperwork and helpful possession information. Meanwhile, Remita—the central payment gateway for Nigeria’s Treasury Single Account—suffered a data exposure as a consequence of a misconfigured cloud storage bucket that leaked almost three terabytes of monetary knowledge.
Vincent Olatunji, NDPC National Commissioner, at a five-day hands-on cybersecurity coaching for technical personnel in authorities ministries, departments and companies, in June, disclosed that the fee confronted over 2,000 cyberattack makes an attempt on its portal in a single week.
These incidents spotlight the rising threats going through establishments chargeable for defending Nigerians’ private knowledge, at the same time as e-governance expands.
Across Africa, the case is not totally different: detecting intrusions is now tougher as AI transforms routine cybercrime into automated reconnaissance, artificial identification fraud, and credential hijacking.
Findings from Esentry and Darktrace—a cybersecurity intelligence partnership targeted on enterprise threats—reveal that trendy attackers hardly ever power their manner in via software program flaws; they enter through compromised credentials and weaponised inside belief that slip cleanly previous typical safety alerts. According to the report, West Africa misplaced over ₦1 billion ($742,104) in fraudulent transactions that slipped previous legacy safety controls within the first half of 2026 alone.
This dynamic hits Nigeria with disproportionate severity. While South Africa accounted for 45% of Darktrace-observed incidents (20% ransomware), Kenya accounted for six% (33% ransomware), and Nigeria accounted for under 5% of regional quantity. However, ransomware was current in 80% of the investigated Nigerian circumstances, with knowledge exfiltration in 40%—proving that Nigeria’s cyber threat far outstrips its visibility, masking high-impact extortion behind low detection numbers.
Rather than breaching perimeter partitions, menace actors now leverage AI-enabled behavioural evasion to imitate reliable consumer actions and quietly hijack authorised workflows—rendering static authorities firewalls and guide compliance audits out of date.
Breaches of this magnitude undermine public belief in official registries and jeopardise knowledge important for company verification and anti-money laundering enforcement.
These failures spotlight a crucial requirement for brand new cybercrime laws to determine clear accountability and implement correct configuration requirements for crucial knowledge infrastructure.
As legislative frameworks broaden, lawmakers should steadiness state oversight with the safety of privateness and civil liberties. The true efficacy of those reforms will lie in whether or not they yield increased prosecution charges, fewer systemic breaches, and stronger knowledge safety.
Building native capability, not overseas dependence
For Nigeria, significant funding in cybersecurity sovereignty requires constructing inside capabilities to secure crucial infrastructure, safeguard citizen knowledge, examine cybercrimes, and preserve very important digital companies. Crucially, it additionally means curbing reliance on exterior distributors for system upkeep and incident response.
The authorities’s National Digital Cloud Policy makes an attempt to deal with these challenges by granting tax and obligation waivers on servers and knowledge centre infrastructure to draw non-public funding. In return, the coverage directs federal companies emigrate legacy systems to the cloud whereas mandating that delicate nationwide knowledge—together with biometric and healthcare information—stay hosted inside Nigerian borders.
Official stories state that over ₦4.5 trillion ($3.34 billion) was allotted to Nigeria’s data know-how sector between June 2023 and June 2026.
Additionally, Nigeria goals to attract $250 million in private investment within 12 months and $750 million within 24 months. However, capital targets alone don’t assure enhanced safety capability. The final take a look at stays whether or not these capital flows translate into resilient infrastructure, institutional functionality, and expert native expertise.
As Abdul-Hakeem B.D. Ajijola, Chair of the African Union Cyber Security Expert Group, famous on the worldwide cybersecurity convention talked about earlier that the worth of safety investments have to be measured by the capabilities that stay after vendor contracts expire. Procuring third-party software program offers short-term safety, but with out expert native engineers to keep up and defend these systems, Nigeria dangers buying and selling technological vulnerability for vendor lock-in.
AI is shifting from a bonus for attackers to a normal a part of offensive infrastructure. Essentry and Darktrace’s forecasts for the second half of 2026 level to an acceleration in deepfake-driven govt fraud, software program provide chain compromises, and automatic ransomware concentrating on cloud belongings.
Progress should due to this fact be measured by operational outcomes: quicker menace detection, immediate vulnerability patching, obligatory breach disclosure, speedy service restoration, and strict accountability for non-compliance with minimal requirements.
Updating legislative frameworks can make clear company duties and broaden investigative mandates. However, reforms shouldn’t be judged merely by the scope of powers granted to the state, but by whether or not residents’ knowledge is protected, monetary infrastructure stays resilient, and public companies can stand up to refined assaults.
Ultimately, Nigeria’s success won’t rely on passing stricter cybersecurity legal guidelines, but on constructing a digital ecosystem able to defending itself, recovering from safety incidents, and safeguarding the general public.
