Reporting & legal change

Required report separation

Present at least two clear conclusions:

Current-law conclusion

Include applicable enacted law, binding directives and triggered sector rules. State system, role, routes, evidence, material gaps, accepted risks, limitations and reviewer.

Readiness conclusion

Include policy strategy, responsible-AI practice, best practice and proposed legislation. State what is preparatory rather than legally required.

Never combine the two into a single “Nigeria compliant” percentage.

Report contents

• System and Nigerian nexus.
• Organisation roles.
• Route decisions and official sources.
• Status and effective date.
• Item results and depth.
• Approved exclusions.
• Evidence and tests.
• Findings and treatment.
• Current-law status and narrative.
• Readiness status and narrative.
• Evidence cutoff, next review and reassessment triggers.

Safe conclusion example

For the selected system and the identified Nigerian activities, the current-law assessment covers the listed data-protection and sector routes as verified at the evidence cutoff. The stated gaps prevent an assured-compliant conclusion. Separate readiness work addresses policy and proposed requirements and is not reported as current legal compliance.

Legal-change monitoring

Monitor:

• Legislation and commencement.
• NDPC directives and guidance.
• NITDA instruments and official registers.
• Sector regulator rules, circulars and licence conditions.
• Court decisions and enforcement suspensions.
• National strategy implementation.
• New elections, platform, online-safety and synthetic-content measures.

Use official sources and record verification dates.

Reassessment triggers

Reassess after:

• New or amended law.
• Regulator notice, circular, code or status change.
• Court order affecting enforcement.
• New regulated product, licence or organisation role.
• New Nigerian users, affected people or outputs.
• Material model, data, supplier or purpose change.
• Incident, complaint, rights request or adverse outcome.
• New evidence of language, accessibility or fairness impact.

Portfolio reporting

Show system-level results, route coverage, legal-status lanes, material gaps and overdue reviews. Avoid averaging a critical regulated system with low-impact readiness items.

Publication caution

Protect personal data, security-sensitive evidence, trade secrets and legal privilege. Publish enough to support accountability without disclosing protected information or implying regulator approval.