Scope & regulatory routing

Nigerian nexus

NAGF may require screening where the selected system:

Is deployed or offered in Nigeria.
Has users or affected people in Nigeria.
Produces decisions or outputs used in Nigeria.
Processes data subject to Nigerian requirements.
Is developed, provided or operated by an organisation with relevant Nigerian obligations.
Supports a Nigerian regulated activity, licence or public function.

Use the central routing facts for jurisdictions and roles. NAGF then performs its detailed legal and sector scope analysis. No Nigeria-only fields are added to the generic intake solely for NAGF.

The 19 routes

Route	Key trigger question
NDPA / GAID	Does the system process personal data within the relevant Nigerian data-protection scope?
DCPMI registration / CAR	Does the organisation or processing meet applicable NDPC registration or compliance-audit triggers?
Significant automated decisions	Does the system make or materially support decisions with significant effects?
Children or legally incapable persons	Are children or people requiring special protection affected?
Public authority / procurement	Is a public body procuring or deploying the system?
Digital identity / biometrics	Does it use identity systems, identity data or biometrics?
Employment	Does it affect recruitment, work allocation, monitoring, discipline or termination?
Intellectual property	Are protected works used in training, retrieval, generation or distribution?
Electoral / media	Does it create or distribute election, political or regulated media content?
Critical infrastructure	Does it support critical infrastructure or an essential service?
Financial services	Is a CBN-regulated actor, product or function involved?
Insurance	Is an insurer, intermediary or insurance function involved?
Pensions	Is a pension operator or pension-administration function involved?
Capital markets	Does it support advice, trading, market activity or digital assets?
Telecommunications	Is an NCC licensee or telecoms service involved?
Healthcare	Is it clinical, health-insurance or software-as-medical-device related?
Aviation / RPAS	Does it support civil aviation or remotely piloted aircraft?
Consumer	Does it affect consumer information, fairness, lending, complaints or redress?
Platform / content	Does it operate as an online platform or generate/distribute relevant content?

One system can trigger several routes.

Route decision

For each route:

Determine whether it applies.
State the official source and trigger.
Record the organisation’s role.
Identify affected NAGF items.
Name a decision owner.
Set review conditions.

Unknown facts remain unresolved; they do not become N/A.

Approving the authoritative NAGF scope

The initial route suggestions are not authoritative. The assessor must complete the scope record for the selected system, including:

Nigerian applicability;
decision owner;
reviewer;
next review date;
all legal and regulatory route decisions;
a sufficiently detailed scope rationale.

Use Approve authoritative NAGF scope only after resolving the displayed scope gates. Approval saves the reviewed scope against the selected system and establishes the route basis used by the NAGF assessment. If material system or legal facts change, revisit and approve the scope again before relying on the conclusion.

Scope approval determines which obligations require assessment. It does not mark any item compliant.

Gateway items and atomic items

Some NAGF items are routing gateways. They ask whether the assessor has identified all triggered atomic obligations. A gateway marked compliant does not prove the downstream obligations are met.

For example, a financial-services gateway should lead to the exact credit, AML/CFT, open-banking, payments, identity and consumer items that apply to the function.

Item-level N/A

N/A requires:

Detailed rationale.
Applicability category.
Specific legal, sector, role, technical or operational basis.
Decision owner.
Review date.
Human approval.

An unapproved N/A remains in scope and affects completeness. Missing evidence is not an N/A basis.

Relationship with scoring

Routing controls which obligations are in scope. It does not mark them compliant.

Binding items contribute to current-law conclusions.
Conditional sector items contribute only when their trigger applies.
Policy and proposed-law items contribute to the separate readiness conclusion.
Crosswalk mappings never create compliance automatically.