If your board is excited about AI but has not addressed GAID 2025, it is not leading innovation. It is taking on unpriced regulatory and operational risk.
GAID 2025 is not a theoretical “global AI directive”. It is a live regulatory instrument issued by the Nigeria Data Protection Commission under the Nigeria Data Protection Act on 20 March 2025. It replaced NDPR 2019 and directly governs how organisations process personal data, including through AI systems. That distinction matters because this is not guidance to consider later. It is enforceable now.
The directive was introduced in response to disruptive technologies and explicitly covers artificial intelligence, IoT and blockchain. It also widens regulatory scope. Organisations processing data at scale or operating in sectors such as finance, insurance, health and hospitality can be classified as controllers or processors of major importance. For many, that brings formal obligations: annual audit returns due by 31 March, mandatory registration updates within 60 days of material change, and an actively engaged Data Protection Officer producing semi-annual reports.
This is where many boards are getting it wrong. GAID is being treated as a compliance document when it is, in practice, a governance framework.
When AI influences hiring, credit decisions, pricing, fraud detection or customer engagement, it is no longer an IT matter. It is a board-level issue with direct implications for revenue, liability and reputation. GAID makes that explicit. It mandates Data Protection Impact Assessments for profiling, automated decision-making with significant effects, systematic monitoring, innovative technologies, digital financial services and cross-border transfers. It requires privacy by design, human oversight, testing in controlled environments and continuous monitoring for unintended outcomes.
That is not a compliance language. That is governance in operational form.
The risk is not simply moving too slowly on AI. The greater risk is deploying it without control. Ungoverned AI does not fail loudly at first. It accumulates exposure quietly across weak lawful bases, opaque decision-making, fragile cross-border transfers and poor documentation. By the time it surfaces, the issue is rarely contained to one function.
GAID also forces accountability into management rhythm. DPOs must be involved in real decision-making. Reporting obligations are defined. Registration and audit requirements create external scrutiny. If the board does not have visibility into this system, then it is not exercising oversight. It is relying on assumptions.
This sits within a broader global direction. Nigeria’s National AI Strategy emphasises responsible and ethical AI and the need for governance frameworks. Internationally, the direction is consistent. Principles from the OECD, UNESCO’s AI ethics framework, UN resolutions on trustworthy AI, the Council of Europe’s treaty work and the EU AI Act all point to the same outcome: AI must be accountable, explainable and governed. GAID is not an outlier. It is Nigeria’s expression of that shift.
The organisations that will move fastest over the next two years will not be those deploying the most AI. They will be those that can demonstrate how their AI behaves.
That requires discipline. First, visibility. Every AI use case touching personal data must be identified, including its lawful basis, data sources, vendors and geographic exposure. Second, accountability. One executive owner must be clearly responsible, supported by the DPO, CIO, CRO and legal function. Third, evidence. High-risk AI should not go live without a defensible DPIA, vendor assessment, cross-border transfer mechanism, human oversight design and incident response plan.
Three risks should already sit on the board risk register. Shadow AI operating without documented controls. Vendor and offshore exposure without adequate safeguards. And silent governance failure, where organisations are misclassified, unregistered or operating with ineffective DPO oversight.
The response is straightforward but non-negotiable. Map exposure across the business. Make AI governance a standing board agenda item. Ensure DPO reporting reaches the risk committee. And adopt a simple rule: no evidence, no launch.
The timeline is not theoretical. GAID took effect in March 2025, with staged compliance obligations through 2025. By April 2026, enforcement activity is visible through regulatory advisories and investigations. This is already operational.
So the question is simple. If AI is on page one of your board agenda and GAID is absent, what exactly are you governing?
Because at that point, you are not scaling innovation. You are scaling exposure.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
The leaders who never left