The AI Clause

The AI Clause: What Nigerian businesses should negotiate before signing technology contracts.

Nigerian businesses are buying artificial intelligence at speed. Banks are deploying credit-scoring and fraud-detection models. Hospitals are piloting diagnostic support. Law firms, agencies and logistics companies are licensing tools that draft, design, forecast and route. Almost all of it arrives on the vendor’s paper, and almost all of that paper was drafted in California or London for a buyer who is not Nigerian.

There is no Nigerian statute governing artificial intelligence. Policy work is under way — a draft National AI Policy and, since August 2024, a draft National AI Strategy — but neither is law.[1] That absence is often read as meaning there is nothing to comply with. The opposite is true. It means the entire risk allocation sits in the contract, and whatever the contract does not say, the general law will decide on terms the parties never considered.

These notes set out the seven provisions that most often determine whether an AI procurement turns out well, and what a Nigerian buyer should be asking for in each.

1. OWNERSHIP AND LICENSING OF OUTPUTS.

Begin with the question most vendor agreements answer badly: who owns what the system produces?

Most standard terms now say that, as between the parties, the customer owns the output. That sounds generous until one reads the qualifications. Ownership is usually expressed only as between vendor and customer — it says nothing about third-party rights in the material the model was trained on. It is commonly disclaimed where the output incorporates the vendor’s own licensed content. And it is almost always accompanied by an acknowledgement that other customers may receive substantially similar outputs, which is fatal to any assumption of exclusivity.

For a Nigerian buyer there is a further problem the vendor’s paper rarely addresses. Under section 28(1) of the Copyright Act 2022 copyright vests initially in the author of a work.[2] Where a work has no human author, it is doubtful that copyright subsists in it at all. A purely machine-generated logo, slogan or marketing image may well be unprotectable — which means the buyer cannot stop a competitor from using it either. A contractual promise that the customer “owns” the output cannot create a right that the statute does not recognise.

What to negotiate:

1. An express assignment of whatever rights the vendor does hold in the output, in writing, since section 30 requires writing for an assignment or exclusive licence to be effective.[3]
2. A warranty that the vendor has the right to grant what it is granting.
3. Clarity on exclusivity — and if the vendor will not give it, an internal decision that machine-generated material will not be used where exclusivity matters, such as a logo or a core brand asset.
4. Where human creative input will be added to an output, a record of that input. It is what will support any claim to copyright in the final work.

2. USE OF CLIENT DATA TO TRAIN AI MODELS.

This is the clause that most often costs a Nigerian business something it did not know it was giving away.

Vendor terms frequently reserve a right to use customer inputs to improve, develop or train the provider’s services. Sometimes it is explicit; more often it is buried in a definitions section or made to depend on an account setting that defaults to permissive. The effect is that the buyer’s customer lists, transaction histories, draft documents, formulations and internal know-how flow into a system that serves the vendor’s other customers — including competitors.

Two distinct harms follow. The first is confidentiality: trade secrets and commercially sensitive material lose their secrecy the moment they are disclosed without restriction. The second is data protection: where the material contains personal data, the buyer remains the data controller and remains answerable for a disclosure it may never have authorised in any meaningful sense.

English authority on the scope of permissions is instructive. In Robin Ray v Classic FM Plc the court held that where permission is implied rather than written, it extends only to the use the parties contemplated at the time of the engagement.[4] In MGN Ltd v Grisbrook the Court of Appeal held that an implied licence covering a newspaper and its physical archive did not extend to publication on a website, that being a different method of exploitation reaching a far wider audience.[5] Neither decision binds a Nigerian court, but both are persuasive, and both suggest that a permission granted for the delivery of a service does not silently extend to the training of a commercial model.

What to negotiate:

1. A flat prohibition on using customer data, inputs, prompts or outputs for training, fine-tuning, model improvement or product development, in each case stated expressly rather than left to a setting.
2. Where the vendor insists on some use, a narrow and defined exception: aggregated and irreversibly anonymised data only, with no re-identification, and no use of the buyer’s confidential information or personal data in any form.
3. A warranty that the prohibition is passed down to every sub-processor and model provider in the vendor’s supply chain. The vendor is frequently not the model developer, and a contractual promise that stops at the vendor’s own door is of limited value.
4. A contractual right to require that the setting be configured in the restrictive position, rather than a mere ability to configure it.

3. CONFIDENTIALITY AND DATA SECURITY.

A general mutual confidentiality clause is not sufficient for an AI procurement, because the ordinary confidentiality architecture assumes a human recipient who can be instructed to forget. A model cannot be instructed to forget, and information absorbed into weights cannot be extracted on request.

The statutory floor is firm. Section 29(1) of the Nigeria Data Protection Act 2023 requires a controller or processor engaging another processor to ensure that processor complies with the Act, assists with data subject rights, applies security measures and discloses any further sub-processor it engages; section 29(2) requires the arrangement to be governed by a written agreement.[6][7] Article 34 of the General Application and Implementation Directive 2025 goes further and prescribes what the data processing agreement must contain, including purpose, processing location, lawful basis, technical measures, risk assessment, confidentiality, tenure, indemnity, insurance and dispute resolution.[8] Article 7(r) obliges controllers to update existing third-party agreements to bring them into conformity.[9] A business running an AI tool on an unamended 2021 vendor agreement is already non-compliant.

On security, section 39 requires appropriate technical and organisational measures, with pseudonymisation, encryption, resilience, timely restoration and regular testing named as examples.[10] Breach notification to the Commission is required within 72 hours of awareness, a deadline repeated in article 33(1) of the Directive, and a processor must notify its engaging controller on becoming aware.[11][12]

Cross-border transfer deserves separate attention, because almost every AI tool a Nigerian business licenses will process data outside Nigeria. Section 41(1) prohibits transfer abroad unless the recipient is subject to adequate protection — by law, binding corporate rules, contractual clauses, a code of conduct or certification — or one of the section 43 conditions applies, and section 42 defines adequacy as protection substantially similar to the Act’s own.[13] The Directive reinforces the point, and article 18(1)(e) requires consent before transfer to a country without an adequacy determination.[14] The buyer must therefore know, and be able to evidence, where processing occurs and on what transfer basis. “The cloud” is not an answer a regulator will accept.

What to negotiate:

1. A data processing agreement that actually tracks article 34, rather than a generic schedule imported from another jurisdiction.
2. A contractual notification deadline shorter than 72 hours — commonly 24 — because the buyer’s own 72-hour clock to the Commission starts when the buyer becomes aware, and a vendor that takes three days to tell you has consumed your entire regulatory window.
3. An express statement that customer confidential information will not be retained in model weights, embeddings, vector stores, caches or logs beyond a defined and short period.
4. Named sub-processors, with notice and a right to object before any addition.
5. A schedule of processing locations and the transfer mechanism relied on for each, with an obligation to notify before any change.

4. INDEMNITIES FOR INTELLECTUAL PROPERTY INFRINGEMENT.

The risk here is specific. A generative system trained on scraped material may produce an output that reproduces a substantial part of somebody’s protected work. Under section 36(2) of the Copyright Act 2022, infringement extends to an act done in relation to the whole or a substantial part of a work in its original form or in a recognisably derived form.[15] An output need not be identical to infringe. If the buyer publishes it, the buyer is the one who published it.

Major vendors now offer copyright indemnities, and their existence is often treated as the end of the enquiry. It should be the beginning. Market indemnities are typically strongest in relation to the vendor’s own training data and weakest in relation to anything the customer contributes or changes. Common carve-outs exclude customer inputs, prompts and fine-tuning material; outputs the customer has modified; use in combination with third-party products; applications the customer builds on the model; and the actions of autonomous agents. The exclusions frequently reach precisely the activities that make deployment useful.

The Getty litigation is a sobering reference point. In Getty Images (US) Inc v Stability AI Ltd the English High Court delivered judgment on 4 November 2025.[16] Getty abandoned its primary copyright claim because the training had occurred outside the jurisdiction, and its secondary claim failed on the footing that model weights do not store copies of the works and are therefore not an infringing copy. It succeeded only on a narrow trade mark point. A buyer should not assume that a rights-holder’s claim against the model developer will resolve the buyer’s own exposure.

What to negotiate:

1. An indemnity that survives ordinary deployment — read the carve-outs against your actual intended architecture before accepting them.
2. Defence of claims, not merely reimbursement of damages, and no cap on the IP indemnity, or a cap materially higher than the general liability cap.
3. Clarity on who controls settlement, since a vendor settling on terms that require the buyer to stop using the output may leave the buyer worse off than a fight.
4. A written record of what the vendor’s content filters do, since the indemnity frequently depends on their remaining enabled.

5. ALLOCATION OF LIABILITY FOR AI ERRORS.

The orthodox vendor position is that outputs are provided without warranty as to accuracy, completeness or reliability, that the customer is responsible for reviewing them, and that liability is capped at fees paid in the preceding twelve months. For a tool producing marketing copy, that may be tolerable. For a tool scoring loan applications, triaging patients or pricing insurance, it is a transfer of the entire operational risk to the buyer for a cap measured in subscription fees.

Nigerian law supplies obligations that the cap cannot displace. Section 37(1) of the Nigeria Data Protection Act 2023 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.[17] Where such processing is permitted, section 37(3) requires safeguards: human intervention, an opportunity to express a view and a right to contest the decision.[18] A data protection impact assessment is mandatory for profiling, scoring and automated decision-making with significant effects.[19] These duties fall on the controller — the buyer — not the vendor, and no contractual cap moves them.

Regulatory exposure is similarly immovable. Penalties under section 48 reach the greater of N10,000,000 or two per cent of the preceding year’s gross revenue for a data controller of major importance.[20] Section 53(2) makes controllers and processors vicariously liable for the acts and omissions of their agents and employees in the course of business.[21] Consumer protection liability under the Federal Competition and Consumer Protection Act 2018 and criminal exposure under the Cybercrimes Act operate independently of whatever the vendor agreement says.[22][23]

What to negotiate:

1. A liability cap proportionate to the decision the tool is making, not to the fee. Where the tool informs regulated decisions, a multiple of annual fees is the minimum sensible starting point.
2. Carve-outs from the cap for breach of confidentiality, data protection breach, IP infringement and wilful misconduct.
3. Documented accuracy or performance thresholds, with service credits or termination rights if they are not met. A system with no stated performance standard cannot fail one.
4. Vendor cooperation obligations in any regulatory investigation, including provision of the information the buyer will need to answer the Commission.
5. A documented human review step wherever the output feeds a decision with legal or similarly significant effect — a contractual commitment the vendor’s design must support, not merely an internal policy.

6. AUDIT AND MONITORING RIGHTS.

Audit rights are the clause most readily conceded in negotiation and most needed afterwards, because every other protection in the agreement depends on the buyer’s ability to verify compliance. A prohibition on training that cannot be checked is an expression of hope.

The Directive assumes verification. Article 10 provides for risk-based compliance audits and audit returns.[24] A buyer that has contracted away its ability to inspect cannot discharge an obligation the regulator imposes on it.

What to negotiate:

1. An annual audit right, exercisable on reasonable notice, extending to sub-processors.
2. Where a full audit is refused — and for large vendors it usually will be — delivery of a recognised third-party assurance report, together with a right to put written questions and receive substantive answers within a defined period.
3. Access to logs sufficient to establish what data was submitted, when, by whom and how it was handled.
4. Notification of material changes to the underlying model. A model that is silently replaced is a different product, and validation performed on the old one may no longer hold.

7. TERMINATION AND DATA DELETION.

Termination clauses in AI agreements are frequently drafted as though the subject matter were a software licence that can simply be switched off. It cannot. Data has been transferred, processed, embedded and cached, and the question at termination is what happens to all of it.

Section 34(1)(d) and (2) of the Nigeria Data Protection Act 2023 give data subjects a right to erasure and require controllers to erase personal data without undue delay where it is no longer necessary.[25] Article 38(4) of the Directive requires a controller to ensure that third parties it has engaged also erase the data when erasure is requested.[26] A buyer that cannot compel its vendor to delete cannot comply with a request it is obliged to honour.

What to negotiate:

1. Deletion of all customer data, including derived data, embeddings and backups, within a defined period after termination, with written certification of deletion.
2. Export of customer data in a usable, documented format before deletion, and a transition assistance period.
3. Survival of the confidentiality and data protection obligations after termination.
4. Where deletion from backups is genuinely impracticable within the period, a defined backup expiry cycle and a continuing obligation of protection until it completes — not an open-ended exception.

A NIGERIAN POINT THAT IS ROUTINELY MISSED.

One further matter belongs on every checklist, and it is absent from almost all AI contracting commentary because it is peculiar to this jurisdiction.

Where an AI product or service is acquired from a foreign supplier, the agreement may be a technology transfer agreement requiring registration with the National Office for Technology Acquisition and Promotion. Software licences, technical service agreements and know-how arrangements fall within the registrable categories. The consequence of non-registration is set out in section 7 of the NOTAP Act: no payment may be made in Nigeria to the credit of a person outside Nigeria under an unregistered agreement.[27]

The Court of Appeal has confirmed that non-registration does not render the agreement void or unenforceable — the sanction is directed at payment, not validity.[28] But that is cold comfort to a business which has deployed a system across its operations and then discovers it cannot lawfully remit the subscription fee through official channels. Registration should be addressed before signature, not after the first invoice.

THE PRACTICAL POSTURE.

Three habits separate buyers who negotiate well from those who do not.

The first is to treat the vendor’s standard terms as an opening position rather than a fixed condition of sale. Enterprise AI agreements are negotiated far more often than buyers assume, and the Nigerian market’s regulatory particularities — the Directive’s prescribed data processing agreement contents, the NOTAP position — give a buyer legitimate, specific and non-negotiable reasons to seek amendment. Vendors respond better to “our regulator requires this” than to “we would prefer this”.

The second is to match contractual protection to the decision the tool actually makes. The same clause set is not appropriate for a drafting assistant and a credit model. Classify the deployment first, then negotiate proportionately, and accept that some tools will not be worth the residual risk at any price the vendor will offer.

The third is to write the agreement so that it still works when the technology changes, because it will. A clause drafted around a particular model version, a particular feature set or a particular architecture will be obsolete within the contract term. Draft around obligations and outcomes — what may be done with our data, what standard the output must meet, what we are entitled to verify — rather than around the mechanics of a product that will not look the same in eighteen months.

The absence of an AI statute in Nigeria is not a gap in protection. It is a transfer of responsibility. In the absence of legislation, the contract is the regulation, and whatever the parties fail to write down will be supplied by general law, by the vendor’s standard terms, or by a regulator applying the Nigeria Data Protection Act to a set of facts the buyer never intended to create.

Original content of AEO Law Practice. © 2026 AEO Law Practice. Published for general information; it is not legal advice and creates no solicitor-client relationship. Readers should obtain advice on their own circumstances.

---

[1]Nigeria has no AI-specific statute. The principal policy instruments are the draft National Artificial Intelligence Policy (NITDA 2023) and the draft National Artificial Intelligence Strategy released by the Federal Ministry of Communications, Innovation and Digital Economy in August 2024.

[2]Copyright Act 2022, s 28(1).

[3]ibid s 30.

[4]Robin Ray v Classic FM Plc [1998] FSR 622 (Ch).

[5]MGN Ltd v Grisbrook [2010] EWCA Civ 1399.

[6]Nigeria Data Protection Act 2023, s 29(1).

[7]ibid s 29(2).

[8]Nigeria Data Protection Act General Application and Implementation Directive 2025 (NDPC/NDP ACT-GAID/01/2025), art 34.

[9]ibid art 7(r).

[10]Nigeria Data Protection Act 2023, s 39(1)-(2).

[11]ibid s 40(2); GAID 2025, art 33(1).

[12]Nigeria Data Protection Act 2023, s 40(1).

[13]ibid ss 41(1), 42(1) and 43(1).

[14]GAID 2025, art 45; see also art 18(1)(e).

[15]Copyright Act 2022, s 36(2).

[16]Getty Images (US) Inc v Stability AI Ltd [2025] EWHC 2863 (Ch).

[17]Nigeria Data Protection Act 2023, s 37(1).

[18]ibid s 37(3).

[19]GAID 2025, art 28(3)(a)-(b).

[20]Nigeria Data Protection Act 2023, s 48(3)-(5).

[21]ibid s 53(2).

[22]Federal Competition and Consumer Protection Act 2018, ss 124-130.

[23]Cybercrimes (Prohibition, Prevention, etc) Act 2015 (as amended).

[24]GAID 2025, art 10.

[25]Nigeria Data Protection Act 2023, s 34(1)(d) and (2).

[26]GAID 2025, art 38(4).

[27]National Office for Technology Acquisition and Promotion Act, Cap N62, Laws of the Federation of Nigeria 2004, s 7.

[28]Stanbic IBTC Bank plc v Financial Reporting Council of Nigeria (2018) LPELR-46507 (CA); see earlier Essdee Food Products (Nig) Ltd v Beecham Group Ltd (1985) 3 NWLR (Pt 11) 112.6507 (CA); see earlier Essdee Food Products (Nig) Ltd v Beecham Group Ltd (1985) 3 NWLR (Pt 11) 112.