NITDA Is Right About Public AI Tools. Governance Is Now Overdue.

On Saturday, NITDA said in an official advisory what I have been saying in boardrooms all year: stop putting your company's data into public AI tools. The advisory came through CERRT.NG, its Computer Emergency Readiness and Response Team, and it is direct. Do not enter personal, classified, official-use or confidential information into public AI platforms such as ChatGPT, Gemini, Claude and Copilot. Once that information goes in, it may no longer be under your organisation's control. It can be retained, logged, or used by the provider to train its models. Where personal data is involved, NITDA says the exposure could be a personal data breach under data protection law, with legal consequences for the organisation and disciplinary or legal consequences for the staff member. [Nairametrics has the full report](https://nairametrics.com/2026/10/04/nitda-warns-organisations-staff-against-sharing-sensitive-data-with-public-ai-tools/). I could not agree more. ## What I see every week Ask a leadership team whether they use AI and the answer is a proud yes. Ask how, and the picture changes. Finance pastes management accounts into a free chatbot to tidy a board paper. HR drops a spreadsheet of staff records into whichever tool is fastest. Someone in sales uploads a client proposal to get a sharper summary. Nobody is being careless on purpose. They are trying to get through the day, and the tool is good. I call this BROAI, Bring Your Own AI. It is the Bring Your Own Device problem again, except this time the thing walking out of the building is your data. ## A warning is not a policy NITDA's advice is right, and most of it is practical. Use only organisation-approved AI tools for official work. Remove, anonymise or pseudonymise personal and sensitive information first. Read the privacy and data terms before using a platform. Do not upload internal documents unless you have been authorised to. Every one of those lines assumes something most Nigerian organisations do not yet have. An approved list of tools. Someone with the authority to approve. Rules that say which data can go where. Staff who have been shown how to strip a document before they use it. Without those, the advisory lands on a team that has no approved tool, no rules and no training, and the work still has to be done by Friday. People will go back to the free tool on their phone. A ban on its own pushes AI use out of sight. It does not stop it. ## Why governance is a must This is the part I would underline for every board. AI governance is what lets your people keep using AI without leaking what the business is built on. At minimum it means: 1. **An approved toolset.** Business or enterprise versions with data terms you have read, where your inputs are not used for training, paid for by the company and tied to company accounts. 2. **A simple data rule.** What can never go into any AI tool, what can go into approved tools only, and what is safe anywhere. One page. Written for the person in finance, not the lawyer. 3. **A named owner.** One person accountable for AI use across the organisation, with the authority to say yes as well as no. 4. **Hands-on training.** Fifteen minutes on how to anonymise a document properly is worth more than a memo. 5. **A way to ask.** If someone finds a tool that helps, there should be a route to get it approved in days, not months. The law is moving in the same direction. In June, the Nigeria Data Protection Commission announced plans to review the Nigeria Data Protection Act to deal specifically with artificial intelligence and other emerging technology. Organisations that put governance in place now will be ready for that. The rest will be writing policies in a hurry. ## Where to start this week Find out what your people are already using. Ask them, without blame, and you will learn more in one afternoon than any audit will tell you. Then approve the tools that are working, close the gaps that worry you, and write the one-page rule. NITDA has given every leader in Nigeria the reason to have this conversation. Have it before an incident has it for you. If you want to know how your organisation compares on AI use, policies and risk, my [State of AI in Nigerian Business survey](/ai-in-nigeria) takes five minutes and is confidential. If you want help putting governance in place, [the SWITCH Method](/switch-method) starts with Scan and Score: an honest look at where AI is already used in your business and where it will make a difference. *Stanislaus Martins advises and trains organisations across Sub Saharan Africa on practical AI adoption and governance. AI Governance, Saïd Business School, University of Oxford.*