- within Corporate/Commercial Law, Criminal Law and Insolvency/Bankruptcy/Re-Structuring topic(s)
Artificial intelligence is no longer just a technology decision; it is a boardroom responsibility.”
Executive Summary
Artificial Intelligence (AI) has evolved from an emerging technology into a strategic business imperative. Organisations are increasingly leveraging AI to improve efficiency, enhance customer experiences, strengthen decision-making and accelerate innovation. However, as AI adoption grows, so too does the need for effective governance. AI is no longer solely the responsibility of technology teams; responsibility for its governance sits where it has always sat in law: with the board. Directors bear fiduciary duties of care, skill and diligence under the Companies and Allied Matters Act 2020, and because the law is moving more slowly than the technology, boards must fill the space between them: creating and continually revising the policies that keep AI within the ambit of the law, protective of fundamental human rights, and clear of conduct the law would count as a crime. Boards must ensure that AI is deployed responsibly, ethically and in a manner that protects the organisation’s assets, reputation and long-term objectives.
Introduction
Artificial Intelligence has emerged as among the most consequential technologies ever introduced to any generation. What began as a tool for automating repetitive tasks has rapidly transformed into a business capability that is reshaping how organisations operate, compete and create value. Within the technology sector in particular, AI is no longer viewed as an experimental innovation; it has become embedded in everyday business operations.
From software developers using AI to accelerate coding, to customer service teams deploying intelligent chatbots and executives relying on AI-driven insights for strategic planning, organisations are embracing AI at an unprecedented pace. The benefits are undeniable. AI is helping businesses improve productivity, reduce operational costs, identify new opportunities and respond more quickly to market demands.
Yet, amid the excitement surrounding AI adoption, an important question often goes unanswered: Who is governing the use of AI?
For many organisations, discussions still focus on which AI tools to adopt or how AI can improve efficiency. While these conversations are important, they are no longer enough. Boards must begin asking a different question: Are we governing AI as effectively as we are adopting it?
AI is far more than another technology investment. It has implications for corporate governance, regulatory compliance, cybersecurity, data protection, intellectual property, enterprise risk management and stakeholder trust. These are all areas that fall squarely within the oversight responsibilities of the board. More importantly, each is a space the law already governs, and into which AI is now treading.
The Law, the Lacuna and the Board’s Duty
Responsibility for governing AI has not migrated to the board; it has always resided there. Technology teams think in terms of technology something newer, faster, more efficient. Governance is not their vocation. Boards, by contrast, bear fiduciary responsibility for the organisation and for the policies that drive it, a responsibility codified in the Companies and Allied Matters Act 2020, which requires directors to act in the best interests of the company and to exercise the care, skill and diligence of a reasonably prudent director (sections 305 and 308). Two teams, two roles: one exists to create and innovate, and it innovates faster than the laws that govern it; the other must remember that what an organisation may do is determined not by what technology makes possible, but by what the law permits.
Technology and law move at different speeds. Law is, by design, responsive: it follows situations rather than anticipating them. Technology, and AI above all, races ahead of it. The result is what lawyers call a lacuna — a space where nothing yet stands. Where life moves faster than the laws that govern conduct, the board’s duty is to ensure that neither the organisation nor the people who benefit from its products and services are harmed by a technology outpacing the rules meant to contain it. That duty obliges boards to pause and to legislate internally: to create, within their own sphere of responsibility, the rules the law has not yet supplied.
Jurisdictions are responding at different speeds. In parts of the West, legislation is moving almost as quickly as the technology. Common law countries hold an additional advantage: the law can develop through the decisions of the courts, and not only through enactmentand Nigeria is one of the places where the courts, too, can respond to the situation. The guidance offered here therefore rests on legal principles rather than enacted AI law, because there is little enacted AI law to rest on. As at the date of writing, no dedicated artificial intelligence statute has completed its passage through the National Assembly and been enacted, although several AI bills were consolidated for second reading in December 2024. The most significant of these, the National Digital Economy and E-Governance Bill, is presently under review before the National Assembly and, as at the date of writing, has not been passed into law. Its provisions nonetheless mark the direction of travel: risk-based classification of AI systems under the National Information Technology Development Agency, mandatory licensing or registration before AI is deployed in the Nigerian market including AI developed abroad — enhanced scrutiny and annual audits for AI used in finance, public administration, automated decision-making and surveillance, a duty to explain automated decisions to the persons they affect, and penalties of up to ten million naira or two per cent of annual revenue. Once enacted, much of what this article urges boards to adopt voluntarily will become compulsory. What Nigeria has enacted is the law surrounding AI: the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025, which imposes mandatory requirements before artificial intelligence may be deployed on personal data; freedom of information legislation; and the laws governing what may and may not be said online, including the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024.
Even then, enactment will not be the last word. A statute means, in operation, what the courts determine it to mean. Any provision that imputes responsibility to a deployer or a prompter will pass through the filter of judicial interpretation: the presumption that penal and quasi-penal provisions are construed strictly, the settled presumption that mens rea is required unless the legislature has excluded it in the clearest terms, and the argument counsel will inevitably make that the promulgators cannot have intended to fix liability on a person who bore no responsibility, because liability has worked in a particular way for as long as the common law has existed. Nigeria has already watched enacted digital law narrowed through precisely this process: section 24 of the Cybercrimes Act 2015 did not survive judicial and legislative scrutiny in its original form. Whatever the coming statute says on paper, its operative meaning will be written in the law reports afterward.
Nor will legislation close the lacuna so much as chase it. A statute codifies AI as it existed when the draftsman sat down; by the time of assent, the technology has moved on. The lacuna does not close, it regenerates at the frontier of the technology. That is the deepest justification for the argument this article makes: internal governance is the only instrument that adapts at the speed of the technology. Statute cannot; precedent takes years; a board policy can change the week an issue arises.
That last category matters more than it first appears. Nigeria, unlike much of the West, retains criminal liability for defamation. At the same time, generative AI does not always tell the truth. Technology calls these failures hallucinations; the law would call them false statements and a false statement about a third party, published, is how a defamation claim begins. The untested question is obvious: what happens when the AI, and not the human, composed the falsehood, and the human relied on it as technology has always been relied upon? What can be said with confidence is where the risk of adoption lands. The professional who carries AI output into a sworn statement or a court filing owns it: courts in several jurisdictions have already sanctioned lawyers who filed authorities their AI had invented. What technology celebrates as a blip, the law may count as a liability and boards must manage the difference.
AI Governance: More Than a Technology Issue
One of the greatest misconceptions surrounding AI is that it belongs exclusively to the technology department. While engineers may build AI systems and developers may deploy them, responsibility for governing AI extends far beyond the IT function. Boards have a duty to ensure that AI aligns with the organisation’s strategic objectives, legal obligations, ethical values and overall risk appetite.
For technology companies, this responsibility is particularly significant. Their competitive advantage often lies in proprietary software, confidential business information, customer data and intellectual property. Without appropriate governance, AI can inadvertently expose these valuable assets to legal, operational and reputational risks.
Consider a simple but increasingly common scenario. An employee working on a confidential board paper, acquisition proposal or software architecture document uploads the document to a public generative AI platform to summarise or improve the content. Within minutes, the work is completed, saving valuable time. However, the organisation may have unknowingly exposed sensitive corporate information to an external platform. The consequences are legal, not merely reputational: information protected as a trade secret can lose that protection once disclosed outside the organisation’s control, documents subject to legal professional privilege may compromise that privilege when shared with a third-party platform, and personal data transmitted offshore may breach the cross-border transfer requirements of the Nigeria Data Protection Act.
In many cases, there is no malicious intent. Employees are simply seeking to work more efficiently. The real problem is that they may not understand the governance implications of the tools they are using. This explains why several multinational organisations have introduced internal restrictions on the use of public AI platforms after employees inadvertently uploaded confidential source code, proprietary business information and commercially sensitive documents.
These incidents demonstrate that AI risks do not always arise from sophisticated cyberattacks or system failures. More often, they result from everyday business activities carried out without appropriate governance. For organisations operating within the technology sector, this is as much a governance issue as it is a cybersecurity concern.
Boards must therefore ensure that employees clearly understand which AI platforms are approved for business use, what information may be shared with AI systems and what information should never leave the organisation’s secure environment. Effective AI governance should be viewed as an extension of existing corporate governance, cybersecurity and information management practices rather than as a standalone technology initiative.
At the same time, boards should recognise that AI represents one of the greatest opportunities for sustainable business growth. When governed responsibly, AI enables organisations to automate repetitive tasks, improve software development, strengthen cybersecurity, generate meaningful business insights and deliver better customer experiences. The objective is therefore not to slow innovation but to ensure that innovation occurs within a framework of accountability, transparency and responsible decision-making.
Another important governance challenge is the growing tendency to overestimate AI’s capabilities. Generative AI systems are remarkably powerful, but they are not infallible.As noted earlier, their failures are not merely technical; they are potential legal events. This reinforces an important governance principle: AI should enhance human judgment, not replace it. Decisions involving legal advice, regulatory compliance, financial reporting, cybersecurity or strategic investments should always remain subject to meaningful human oversight. That principle is no longer merely prudential: section 37 of the Nigeria Data Protection Act 2023 prohibits decisions based solely on automated processing, including profiling, where they produce legal or similarly significant effects, except where there is human intervention.
Ultimately, boards should regularly ask themselves whether their governance frameworks are evolving alongside AI adoption. Do existing policies adequately address AI use? Is confidential information sufficiently protected? Who is accountable for AI-related risks? How are emerging regulatory developments being monitored? These are no longer operational questions, they are governance questions that deserve ongoing board attention.
Agency Without Accountability: The Question of Liability
What distinguishes AI from every technology before it is not speed but agency. Earlier technologies required human involvement at each material step; AI does not. It carries an element of intelligence: from a single prompt, and by virtue of the intelligence framework built around it, it can take steps beyond the prompt itself. It has been granted the powers and authority of a human agent while possessing neither the ethics nor the legal accountability of a human person. For boards, this is the heart of the governance problem.
The law is built on responsibility, and responsibility presumes an actor with intent. Most criminal offences, and a considerable body of civil wrongs, require that the person intended the act the law prohibits. AI erodes that element. Ask an AI system whether any criminal matter exists against a named individual, and suppose it reaches information the law places behind a court order who has flouted the law? Deploy AI to automate or strengthen a system, and suppose the system it builds overshoots the boundaries the law imposes — who overshot them? The person who issued the prompt intended nothing unlawful; the developer intended nothing unlawful; the organisation intended efficiency.
Until the courts or the legislature say otherwise, the working assumption of the legal world will be a simple one: the person who prompts the system controls it. Through the ordinary chain of causation in civil claims, the prompter — or the organisation on whose authority the prompt was issued stands to be found liable for the final act, unless intention can be negatived. And where the law has already spoken, it has spoken against the organisation: under the data protection regime, liability attaches to the data controller regardless of the tool used, and many of the regimes most likely to be engaged anti-money-laundering, data protection, anti-discrimination, impose administrative or strict liability, so that sanction follows whether or not intent can ever be established.
Yet the presumption that the prompt controls the output rests on a factual premise the technology does not bear out. The output of a generative AI system is co-authored: the prompt supplies the request, but the developer’s programming the embedded rules, the steering toward commonly accepted viewpoints, the areas the system has been built to avoid shapes what actually emerges, and can do so against the express direction of the prompt. Experienced users encounter this constantly: instructions the system declines, reframes or answers around because its own rules override the instruction given. Where the unlawful element of an output originates in the developer’s rules rather than the user’s instruction, the chain of causation from prompter to harm is broken, or at the least shared — and this, too, is an argument the courts have yet to hear. Legislation drafted on the assumption that the prompt alone determines the action is legislating for a technology that does not work that way.
The compliance context sharpens the problem further. An organisation that has set up its processes to comply, and deploys AI to assist that compliance, may still fail through the instrument itself. A computer that breaks down and loses records has decided nothing; the law knows how to treat equipment failure. But an AI that wrongly concludes that anti-money-laundering checks are unnecessary for a particular company, or profiles a customer wrongly, or records the wrong information, has done something that looks like a decision and no human made it. The organisation complied by design and failed in execution. Who, then, has failed to comply? That question has scarcely been asked in a courtroom, and outside the data protection regime it remains unanswered.
This is why boards cannot wait for the courts, and why, in the absence of settled law, the organisation’s own governance must substitute for it. The measure the courts will eventually apply is reasonableness — the same standard that governs negligence and the assessment of damages. An organisation may well argue that it could not reasonably have expected an AI system to act as it did on a given prompt. That argument survives exactly once. The moment harm is brought to the organisation’s attention and nothing changes, no reasonable person could claim surprise at its recurrence: awareness creates responsibility. Two things therefore belong in every AI policy, and for now they are probably an organisation’s best legal defences. The first is responsiveness: respond to complaints, respond to the person who says this harmed me or I want this stopped, and respond immediately — a discipline the regulator has already institutionalised through the Standard Notice to Address Grievance, which entitles individuals to demand remedial action from AI deployers before escalating to the Nigeria Data Protection Commission. The second is revision: change the policy, the process and the board’s governance rules to reflect each issue that arises, so that the same harm cannot recur. There must be flagging systems that ensure the organisation knows immediately, because from the moment it knows, every step to correct must follow.
Building an Effective AI Governance Framework
Effective governance should never discourage innovation. Instead, it should provide organisations with the confidence to embrace AI responsibly while protecting long-term business value.
In practical terms, no AI should be implemented in any system without the board first reviewing what the exposures are. The starting question is deceptively simple: what is AI being used to do? The legal team must then advise what the law permits and reserves in that space as at that date; the compliance team must permutate the issues that could potentially arise; and policy must be directed at precisely those permutations. In every space where AI is adopted — anti-money-laundering and know-your-customer obligations, international financial transfer rules, data protection, cybersecurity — the position of the law must be checked and the AI kept constantly governed by it. Internal policies should be embedded in the prompts themselves, so that the system is reminded of the organisation’s rules each time it acts; those rules must be organisation-wide; and staff must be trained so that the organisation is not exposed unnecessarily to suit.
An effective AI governance framework begins with clear organisational policies that define acceptable AI use, identify approved platforms and establish boundaries around the handling of confidential information. Equally important is robust data governance, ensuring that sensitive information is appropriately classified and protected before interacting with AI systems.
Boards should also ensure that AI-related risks are incorporated into existing enterprise risk management frameworks. Regular reporting on AI adoption, regulatory developments, cybersecurity implications and emerging risks should become part of routine board oversight. Employee awareness is equally critical. Policies alone cannot create responsible AI use; employees must understand both the opportunities AI presents and the responsibilities that accompany its use.
As organisations continue to integrate AI into their operations, governance will become a key differentiator. Organisations that establish clear governance structures are more likely to earn stakeholder trust, protect valuable intellectual property, comply with evolving regulatory expectations and strengthen their competitive position in an increasingly digital economy.
Trust remains one of the most valuable assets any organisation can possess. Customers expect responsible handling of their information, investors increasingly assess technology governance as part of their investment decisions, regulators expect accountability and employees require clear guidance on the responsible use of emerging technologies. Boards therefore play a central role in ensuring that AI adoption strengthens and not undermines that trust.
Conclusion
Artificial Intelligence is reshaping the technology sector at an unprecedented pace, creating opportunities to improve efficiency, accelerate innovation and transform business operations. However, every opportunity introduced by AI also creates new governance responsibilities. It also raises questions of responsibility that the law has not yet resolved — and until it does, the quality of an organisation’s internal governance is its best legal defence.
The organisations that will succeed in the years ahead will not necessarily be those that adopt AI first, but those that govern it best. Effective AI governance is no longer simply a matter of technology management; it is an essential component of corporate governance and strategic leadership.
The question for today’s boards is therefore no longer whether AI should be adopted. That question has largely been answered. The more important question is whether the organisation has established the governance structures necessary to ensure AI is used responsibly, ethically and in a manner that protects its people, its information and its long-term strategic interests.
In the age of Artificial Intelligence, sustainable innovation will not be defined solely by technological capability. It will be defined by the quality of governance that guides it.
References
National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce.
Organisation for Economic Co-operation and Development. (2019). OECD Principles on Artificial Intelligence.
International Organization for Standardization. (2023). ISO/IEC 42001:2023 – Artificial Intelligence Management System.
International Organization for Standardization. (2021). ISO/IEC 38507: Governance Implications of the Use of Artificial Intelligence by Organizations.
World Economic Forum. (2024). AI Governance Alliance: Presidio Recommendations on Responsible Generative AI.
Companies and Allied Matters Act 2020 (Nigeria), sections 305 and 308.
Nigeria Data Protection Act 2023, section 37.
Nigeria Data Protection Commission. (2025). General Application and Implementation Directive (GAID) 2025.
Federal Ministry of Communications, Innovation and Digital Economy. (2025). National Artificial Intelligence Strategy.
Financial Reporting Council of Nigeria. (2018). Nigerian Code of Corporate Governance.
Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria), as amended 2024.
https://www.linkedin.com/company/gresyndale-legal/
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
