AI and Cybersecurity in Nigeria: Mapping Policy and Threats

Background: Nigeria's rapid economic digitisation, projected to reach $27 billion by 2030, has precipitated a parallel surge in sophisticated cyber threats. As Artificial Intelligence (AI) becomes ubiquitous, it offers dualistic capabilities: serving as an essential mechanism for national defence, while simultaneously accelerating cybercrime through deepfakes, automated phishing, and adversarial attacks. Consequently, Nigeria's legislative frameworks do not match-up.

Objectives: This review maps existing literature and policy documents on AI governance and cybersecurity in Nigeria, identifies critical regulatory gaps, examines the evolution of AI-enabled threats, and benchmarks national strategies against global best practices.

Methods: Following JBI methodology and PRISMA-ScR guidelines, a systematic search was conducted across academic databases and grey literature from government portals. Inclusion criteria iincluded peer-reviewed articles, policy documents, legislative texts, and reports (2015–2025) addressing Nigerian AI governance. Data were extracted using a standardised form and analysed through thematic analysis.

Results: The review identified 282 sources. Analysis showed Nigeria has foundational policies, including the Cybercrimes Act (2015), Data Protection Act (2023), and Draft National AI Strategy but the static nature of these laws lags behind dynamic AI-driven threats. Significant gaps exist regarding algorithmic manipulation, deepfake fraud, decentralised finance vulnerabilities, and autonomous agent crimes. Findings highlight five themes: (1) the evolution to AI-enhanced attacks; (2) efficacy of current legal frameworks; (3) pillars of the National AI Strategy; (4) global comparative analyses; and (5) strategic recommendations for resilience.

Conclusions: AI governance is a foundational element of Nigeria's cybersecurity posture. Effective governance requires amending the Cybercrimes Act to criminalise AI-specific offenses, operationalising the National AI Risk Management Framework with mandatory high-risk audits, establishing a Cybersecurity Task Force, and investing in sovereign cloud infrastructure to ensure data sovereignty.