The Sovereign AI Opportunity for African Governments: Beyond the Frontier Model Race

The race that matters is larger than frontier-model training

The frontier is extremely concentrated. Stanford's 2026 AI Index reports that industry produced more than 90% of notable AI models in 2025. It also estimates global AI compute capacity at 17.1 million H100-equivalent accelerators, after roughly 3.3x annual growth since 2022. The United States alone is reported to host 5,427 data centres, more than ten times any other country.¹

That concentration matters because it makes the economics of frontier training fundamentally different from the economics of useful deployment. Stanford's 2025 AI Index reports that the price of querying a model at roughly GPT-3.5-level MMLU performance fell from about $20 per million tokens in November 2022 to $0.07 by October 2024, a period of about 23 months.² That is an API-price comparison, not the total cost of self-hosting. A sovereign deployment still has to pay for accelerators, power, cooling, networking, storage, staff, security, redundancy and operations.

The World Bank's 2025 work on AI foundations makes a similar practical distinction. It frames national readiness around four foundations: connectivity, compute, context and competency. As of June 2025, high-income countries hosted 77% of global co-location data-centre capacity, upper-middle-income countries 18%, lower-middle-income countries 5%, and low-income countries less than 0.1%. The same work argues that open technologies and locally adapted "small AI" can create value without reproducing the entire frontier stack.³

This matters for Africa because the capital constraint is real. UN Trade and Development reported that Africa attracted only 3% of global data-centre investment in 2024, while core ICT infrastructure investment in developing countries remained well below estimated need.⁴ If the technical strategy assumes every useful AI system must begin with hyperscale pretraining, it starts by choosing the most capital-intensive layer of the stack.

The target does not have to be an African ChatGPT competitor

A country does not need one giant national chatbot trying to answer every question. In many government workloads, a much smaller model with a narrow mandate can be more useful, cheaper to operate and easier to evaluate. One model can classify incoming correspondence. Another can extract entities from regulatory filings. Another can translate and summarise local-language submissions. Another can help a procurement team compare tender documents against published rules. Another can help an authorised investigator search a controlled case archive. Another can assist a civil servant in turning verified records into a first draft of a brief.

These can be specialised services rather than one monolithic model. A small open-weight model can handle extraction, classification, routing, summarisation or constrained question-answering when paired with strong retrieval and deterministic tools. A larger reasoning model can be reserved for the smaller percentage of tasks that genuinely need it. The platform can route each request to the smallest approved model that meets the quality and security threshold.

This smaller-model approach is not merely theoretical. NITDA Director-General Kashifu Inuwa argued in a 2025 TechCabal interview that small language models could offer a practical entry point for Africa because they reduce some of the infrastructure burden and can be built around local realities.¹⁴ The World Bank's AI foundations work likewise highlights "small AI" as a path through which developing economies can adopt and adapt AI without recreating the frontier stack.³

We do not need hyperscale infrastructure for every useful government model

The sovereign-AI conversation also becomes more practical when we stop treating every model as if it needs a frontier-scale data centre. A tightly scoped model serving one ministry, regulator or investigative workload can be trained or adapted on data the institution is legally allowed to use, then served on infrastructure the institution or an approved sovereign provider operates. The compute requirement depends on model size, quantisation, concurrency, context length and latency targets, but it can be orders of magnitude below a frontier training cluster.

Nigeria is not starting with nothing. The country already has connectivity, local data-centre operators, universities, a fast-growing developer population and a government-backed sovereign-cloud programme. But the compute baseline should not be overstated. NCAIR's public infrastructure page lists 100 vCPUs, 100 GB of RAM and 100 TB of SSD capacity for pilot AI projects and does not list GPU capacity.¹¹ That is evidence of an initial platform and, equally, of the gap that still has to be closed for serious model training or high-throughput inference. NITDA's cloud framework separately points toward accredited providers, in-country hosting, encryption and key-management controls.²⁹

Land, power, cooling, fibre and water are physical engineering inputs, not reasons to assume the problem is impossible. They still have to be designed responsibly. Water availability does not remove the need for efficient cooling, and gas or solar potential does not remove the need for reliable electricity. The harder constraint is usually the system around the hardware: financing, procurement, power quality, maintenance, data governance, interoperable records, security operations and teams that can run the platform for years.

The question therefore becomes less dramatic and more useful: what is stopping a government agency from owning a small model that understands its approved corpus, runs on servers it can govern, has no public internet dependency for sensitive inference, and is evaluated against the exact work its officers perform? For many workloads, that is a tractable engineering programme.

That idea becomes easier to test when it is attached to a real institutional workload rather than left at the level of theory. Later in this piece I use financial-crime enforcement as one reference case because the public workload is large, document-heavy and permission-sensitive. It is the kind of environment where a small model does not need broad world knowledge to be useful. It needs to understand the institution's approved records, terminology, workflow and evidence boundaries extremely well.

There is another path: adopt strong models where appropriate, adapt them to institutional work, and advance local capability where it creates a defensible public value. The World Bank's 2026 World Development Report uses a similar "adopt, adapt, advance" framing for developing economies.⁵

What sovereign AI means in a government environment

A useful sovereign AI system is better understood as an institutional computing layer than as a chatbot. The base model is only one component. The system around it determines whether a response is authorised, grounded, reproducible and safe enough to use in real work.

For a ministry, regulator, court, revenue authority, police service, health agency or financial-crime institution, I would break sovereignty into seven engineering boundaries.

This architecture is consistent with the direction already visible in continental policy. The African Union's Continental AI Strategy, endorsed in July 2024, calls for coordinated national approaches, responsible AI and Africa-centred development. The AU Data Policy Framework separately sets out a vision for trusted data governance and a common African data space while protecting rights and security.⁶⁷

Nigeria is not starting from zero

Nigeria publicly unveiled its National Artificial Intelligence Strategy in April 2025, while the current strategy document hosted by NCAIR is dated September 2025.³¹⁸ The September document is organised around five pillars: foundational AI infrastructure, a sustainable AI ecosystem, sector adoption, responsible and ethical AI, and AI governance. It calls for localised compute, high-performance computing, stronger public-sector data availability, better data standards, workforce development and sector-specific adoption plans.

The infrastructure section is especially relevant. It identifies national HPC resources, AI-specific hardware and software, data-centre investment and AI-ready infrastructure as foundational requirements. The data section also recognises a harder problem: public data can be fragmented, inconsistent or incomplete. That matters because an LLM attached to poor records does not fix the underlying state of the records. It can simply make the inconsistency easier to query.

Nigeria's position has also moved since that strategy was published. In August 2026, NITDA and the Budget Office inaugurated a joint technical committee for the National Sovereign Cloud Initiative. NITDA describes the initiative as a coordinated approach to cloud infrastructure, procurement, investment, cybersecurity and data governance. Punch has also reported on the wider attempt to expand local cloud capacity and anchor more critical digital workloads in-country.⁹¹⁰

NCAIR also presents N-ATLaS as a Nigerian multilingual model initiative. The published model card is more specific: the released LLM is a fine-tune of Meta's Llama-3 8B, trained on roughly 392 million multilingual instruction tokens, with support claims for English, Hausa, Igbo and Yoruba and an 8,092-token context length.³² That is useful local adaptation, but it is not a Nigerian foundation model trained from scratch. The model card also does not give me enough independent, task-specific evidence to claim that it is already strong enough for sensitive government work in those languages. Its context window is another reason long case files should be handled through retrieval and document pipelines rather than dumped wholesale into the model.

There is a talent base to build on. GitHub's 2024 Octoverse counted more than 1.1 million developers in Nigeria, growing 28% year over year. It counted more than 990,000 in Egypt, more than 664,000 in South Africa, more than 556,000 in Morocco and more than 393,000 in Kenya.¹² That does not mean every developer is an AI engineer, but it does matter for the wider question of who can build integrations, data platforms, security controls, developer tooling and operational software around models.

Nigeria also co-chairs the World Bank's AI Working Group for GovTech and Public Sector Innovation with Estonia. That is useful because the most valuable knowledge exchange here is implementation knowledge: how governments evaluate AI systems, integrate them with legacy infrastructure, govern procurement, measure outcomes and keep humans accountable for the final decision.¹³

One reported constraint should remain front and centre. In a 2025 TechCabal interview, NITDA Director-General Kashifu Inuwa argued that Africa should pay more attention to smaller language models and local infrastructure rather than treating the frontier-model race as the only path. A separate TechCabal report on Anambra's SmartGov work said that less than 10% of Nigerian government operations had been digitised, citing Inuwa. If that baseline is broadly representative, the first AI problem in many agencies is still digitisation, structured data and interoperable systems.¹⁴¹⁵

Government AI is already becoming an operating capability elsewhere

The most useful international examples are not countries claiming to have "won AI." They are governments turning model capability into repeatable public infrastructure.

Singapore: shared AI infrastructure across agencies

Singapore has moved well beyond Pair's early pilot numbers. In November 2025, the Ministry of Digital Development and Information said about 80% of the country's 150,000 public officers had used Pair Chat and that officers had created more than 20,000 AIBots for tasks including HR, budget and procurement guidance. Pair's current service is available on government-issued devices and is cleared for Restricted / Sensitive Normal data, with the service stating that LLM providers do not log that data.¹⁶¹⁷

The pattern is more important than the product name. Each ministry does not build a full AI platform from scratch. Government builds reusable capability, then agencies contextualise it.

United Kingdom: models wrapped in task-specific public-sector tools

The UK government has been experimenting with AI inside specific workflows through the Humphrey suite and Microsoft Copilot trials. The cross-government Microsoft 365 Copilot experiment ran from 30 September to 31 December 2024 and involved 20,000 employees, reporting average self-reported savings of around 26 minutes per day. HMRC's Phase III trial ran over the same September-to-December 2024 period, with 3,000 licences randomly allocated across business groups; its adjusted estimate was around 60 minutes saved per week. HMRC says its early results also informed the wider cross-government report, so these are overlapping evaluations with different designs rather than a simple earlier-versus-later sequence.¹⁸¹⁹

The Consult tool has also been tested on consultation analysis. UK government reporting says its evaluation produced F1 scores of 0.79 and 0.82 against human-reviewed themes, versus 0.74 agreement between human reviewers in that evaluation. The important part is the evaluation discipline: the tool is measured against human-labelled work rather than being trusted because the output sounds plausible.²⁰

Estonia: citizen assistance and secure public-sector agents

Estonia's Information System Authority operates Bürokratt, a citizen-facing virtual assistant, and in 2026 launched the Aruait "Reason Reserve" project to develop legal and technical foundations for secure AI agents across the public sector. The project includes a machine-identity framework, a trust registry, interoperability standards and at least one end-to-end agentic public-service pilot.²¹

South Africa: a phased, rights-aware policy direction

South Africa's Cabinet approved publication of a draft national AI policy in 2026 that explicitly calls for phased adoption because risk profiles differ by sector, and places human-centred deployment, responsible governance and ethical AI among its core pillars.³⁴ That is closer to the governance problem African states will actually face than a simple race for model size.

India: smaller, multilingual public-service models in production

India's AIKosh catalogue provides a useful developing-market comparator. Its government-backed VANI framework supports multilingual public-service chatbots, human hand-off, logging and monitoring, and reports more than 14 crore interactions in FY2024-25 across services including transport and legal awareness.³⁵ The point is not that Africa should copy India. It is that public-sector AI can be assembled from narrower language, retrieval and workflow components instead of one universal assistant.

These examples are not templates to copy blindly. They show that the public-sector problem can be decomposed into identity, shared platforms, task-specific assistants, institutional knowledge, evaluation and governance. The model can change beneath that architecture.

A Nigerian state example: AI before full digitisation

TechCabal reported in June 2025 that Anambra State was building a SmartGov Suite for local-government processes while describing government workflows across the state as still largely manual and paper-based. The tool was being prepared for deployment beginning with local governments, not presented as a mature statewide production system. The report described an example in which the system flagged an education allocation because it could not find corresponding disbursement records. The useful lesson is therefore narrower: AI can help interrogate structured records and surface anomalies, but digitisation, data quality and deployment maturity remain prerequisites for scale.¹⁵

For example: what a small institutional model could look like inside the EFCC

Take Nigeria's Economic and Financial Crimes Commission, the EFCC, as one concrete example. I am not describing an existing EFCC system here, and I do not have visibility into its internal technology. I am asking what the Commission could build if it wanted a narrow sovereign AI capability for investigative casework. The example is useful because financial-crime enforcement combines large document volumes, long case histories, sensitive records, legal consequences and strict need-to-know access.

The public numbers are large enough to make the systems problem real, but they need to be stated by period rather than collapsed into a single total. The ICIR reported, from EFCC operational statistics it obtained, 78,539 petitions, 58,165 investigated cases, 16,115 court filings and 10,935 convictions for 2019-2023.²² A separate report on 2024 said the Commission received 15,724 petitions and secured 4,111 convictions that year.³⁰ I would not merge those figures with a homepage counter and present them as one 2014-2025 series without a reconciled underlying dataset. What they do establish is scale: officers have to find old records, reconstruct timelines, compare entities, trace documents and hand work between teams without losing context.

So the hypothetical first product is deliberately small: the EFCC could build or commission one controlled institutional model for authorised casework, not a public chatbot and not a general-purpose national AI. Give an authorised officer one interface over records that officer is already entitled to access. The system could search petitions, case files, internal reports, evidence indexes, court records and policy material; build a chronology; extract people, companies, accounts and properties; flag referenced-but-missing documents; identify inconsistent identifiers; retrieve similar closed matters; and draft a source-linked case brief.

That does not require a national ChatGPT clone. It requires a good ingestion pipeline, a reliable search and retrieval layer, a modest domain-capable model, access control that is enforced before retrieval, and an audit trail that records the user, the model version, the sources retrieved and the output produced. The model can be small because the knowledge does not have to live entirely inside its weights. The institutional corpus remains in controlled storage and is retrieved when the task requires it.

The output is therefore not "the AI thinks this person is guilty." A useful output is closer to: "these are the records I was allowed to retrieve, these are the entities and dates they contain, these documents are referenced but missing, these prior matters are comparable, and every statement links back to a source."

Once that narrow system is measured and trusted, the same platform components can support other bounded workloads. A tax authority can use the identity, retrieval and audit layers with a different model and corpus. A procurement body can use them to compare submissions with tender rules. A ministry can use them to search circulars and generate reviewed briefs. The reusable national asset is therefore not one enormous model. It is the governed platform underneath a portfolio of smaller institutional models.

A reference architecture for sovereign institutional AI

The architecture below is deliberately model-agnostic. The objective is to make the data, permissions and evaluation layers durable even as foundation models change.

Policy-aware retrieval is not optional

A common RAG implementation retrieves semantically similar chunks and sends them to a model. That is insufficient for sensitive government systems. Retrieval itself must be permission-aware. The policy layer needs to constrain the search before the model sees context.

async function retrieveAuthorisedContext(request) {
  const scope = await policy.issueSearchScope({
    userId: request.userId,
    matterId: request.matterId,
    purpose: "case-analysis"
  });

  if (!scope.allowed) throw new Error("access_denied");

  const hits = await search.hybrid({
    query: request.query,
    authorisationScopeId: scope.id,
    filters: { matterId: request.matterId },
    rerank: true,
    limit: 24
  });

  await audit.append({
    event: "ai_context_retrieved",
    userId: request.userId,
    matterId: request.matterId,
    scopeId: scope.id,
    sourceIds: hits.map(hit => hit.documentId),
    modelRequestId: request.id
  });

  return hits.map(hit => ({
    text: hit.text,
    sourceId: hit.documentId,
    page: hit.page,
    checksum: hit.checksum
  }));
}

The model never gets the chance to decide whether the user is authorised. That decision belongs to deterministic identity and policy infrastructure. The scope is represented server-side instead of materialising a giant list of document IDs in application code, and the retrieval event itself is written to the audit path.

Hybrid retrieval beats a vector database alone

Government records contain identifiers, account numbers, names, dates, legal references and structured relationships. Pure semantic similarity is not enough. A production system should usually combine lexical search, vector retrieval, metadata filters, entity resolution, graph traversal and reranking. Exact identifiers should behave like exact identifiers. Relationships should retain provenance. Access restrictions should remain attached to the data after indexing.

Model routing should be a platform concern

Routine extraction and classification do not need the same model as a complex multi-document legal analysis. A model gateway can route work by sensitivity, complexity, latency and cost. Some tasks can run on a small local model. Others may require a larger approved model. Highly sensitive records may be restricted to an on-premise or sovereign-cloud inference tier. The application should know the policy, not the user.

Knowledge graphs are for relationships, not decoration

Where the institution works with recurring entities, a graph can connect people, companies, accounts, properties, cases and documents while preserving provenance on every edge. The graph should not silently infer guilt or relationship strength. It should record what source asserted a connection, when it was observed and how confident the extraction process was.

Zero Trust has to include the AI path

Putting the model on a private network is not enough. Every retrieval, tool call and export should be evaluated against identity, device posture where available, purpose, case access, classification and least privilege. The AI tier should assume malicious documents, prompt injection, compromised endpoints and insider misuse rather than trusting traffic because it originated inside a government network.

AI governance is a release process

Governance should show up in engineering artefacts: a model registry, owner, intended-use statement, evaluation set, risk classification, security review, approval record, rollback target and change history. A new model or prompt should not enter production because it performed well in a demo. It should enter because the measured version passed the institution's defined gates.

Training without frontier-model vanity

"Train our own AI" can mean several very different things. Conflating them creates bad budgets and bad architecture.

For most government agencies, the first four layers deliver value much sooner than full pretraining. That is not an argument against African foundation models. It is an argument for matching the training method to the problem.

Continuous learning should also not mean a model rewriting itself after every conversation. A high-assurance system updates its knowledge index continuously, captures officer corrections as evaluation data, and promotes model or prompt changes only after controlled tests.

function canPromote(candidate, baseline) {
  return (
    candidate.retrievalRecall >= baseline.retrievalRecall &&
    candidate.citationAccuracy >= 0.98 &&
    candidate.criticalPermissionLeakageFindings === 0 &&
    candidate.promptInjectionPassRate >= 0.99 &&
    candidate.taskQuality > baseline.taskQuality &&
    candidate.hallucinationRate <= baseline.hallucinationRate
  );
}

// "Zero findings" means zero observed in the defined test suite.
// It is a release gate, not proof that leakage is impossible.
// A failed security or permission test blocks release.

The benchmark itself should be local. It should contain the document formats, languages, workflows, failure modes and access boundaries that the institution actually encounters.

Keeping sensitive data on African soil is useful, but residency alone is not sovereignty

Nigeria's current sovereign-cloud work makes this issue timely. Recent reporting by Punch and Tribune describes a government effort to increase local cloud capacity, reduce dependence on offshore infrastructure and coordinate technical standards. NITDA's own implementation committee includes institutions responsible for finance, procurement, connectivity, power, cybersecurity and data governance.⁹¹⁰

The Guardian Nigeria reported in June 2026 on new Nigerian data-centre capacity and the broader push for in-country hosting, while BusinessDay has covered AI-ready facilities and local cloud investment. These are industry reports and some of the market-size claims inside them come from operators, so they should be read as market evidence rather than audited national statistics.²³²⁴

From an engineering perspective, residency is only one control. A system can be physically hosted in Lagos and still be operationally dependent on foreign administrators, foreign encryption keys, proprietary identity systems, opaque model APIs and contracts that make exit expensive. Conversely, a government can use selected global cloud services while still enforcing strong cryptographic, contractual and architectural controls. The right answer depends on data classification and threat model.

I would classify workloads rather than make one rule for everything:

The Nigeria Data Protection Act 2023 already requires appropriate technical and organisational measures for personal-data security. AI systems do not sit outside that responsibility simply because a model is doing the processing.²⁵

The infrastructure problem is compute plus power plus connectivity plus operations

AI infrastructure is power-dense. Stanford's 2026 AI Index estimates global AI data-centre power capacity at 29.6 GW in 2025. A September 2026 Reuters analysis of Europe's AI infrastructure race also highlighted electricity price, grid capacity and permitting as major constraints, despite Europe having far deeper infrastructure than most African markets.¹²⁶

The compute market is also geopolitical. Advanced accelerators sit inside global semiconductor supply chains and export-control rules that can change over time. Current U.S. Bureau of Industry and Security rules impose licensing and end-use controls on categories of advanced-computing hardware in specified circumstances.³³ The architectural lesson is not that Nigeria is categorically blocked from GPUs. It is that a national plan should not assume unlimited, frictionless access to any specific accelerator generation.

That comparison is useful because it keeps the debate honest. Power is not an African-only AI problem. What changes is the starting point. Where grid reliability, fibre reach and capital are weaker, the cost of high-density compute is harder to absorb.

At the same time, Africa is not digitally empty. The ITU estimates that 36% of Africa's population was online in 2025 and 66% owned a mobile phone. GSMA reports that mobile technologies contributed $240 billion to Africa's economy in 2025, equal to 7.8% of GDP, while operators are expected to invest more than $76 billion in network infrastructure between 2024 and 2030.²⁷²⁸

The policy and engineering implication is not "build every GPU locally." It is to identify which compute needs to be local, which can be regional, which can be burst to approved global providers, and how sensitive workloads can be isolated. Regional compute pools may make more economic sense for some states than duplicating every layer nationally.

It is also worth separating training capacity from inference capacity. Training a frontier model can consume a very large cluster for weeks or months. Serving a smaller institutional model to a few thousand officers is a different workload. A government can design for its actual concurrency, latency and security requirements instead of buying infrastructure sized for a competition it is not entering.

A credible cost model has more rows than GPU rental

For an institutional pilot, total cost of ownership should include records digitisation and OCR quality assurance, data cleaning, integration work, storage, search and vector infrastructure, model inference, network and security tooling, backup and disaster recovery, evaluation, licensing where applicable, support and staff. In a paper-heavy agency, scanning, indexing, classification, redaction and manual quality control can dominate the first phase before the model becomes the expensive part.

The minimum team is also multidisciplinary. Someone must own the workflow and domain policy. Data and records engineers have to make the corpus usable. Backend and platform engineers own identity, APIs and audit. ML engineers own model serving and evaluation. Security engineers own threat modelling, secrets, monitoring and incident response. Legal, privacy and records officers define what may be processed, retained and disclosed. SRE or infrastructure staff keep it available. A pilot that budgets for a model endpoint but not those functions is not a sovereign system.

From a useful pilot to a durable public capability

The next question is what happens after the thesis is accepted. A credible programme does not begin with a national procurement for one giant model. It begins with a bounded institutional problem, proves the security and economics, and then turns the reusable parts into shared infrastructure. The sequence below is one technically plausible path, not the only policy option.

What success should actually measure

"Number of prompts sent" is not a useful public-sector KPI. Better measures include median time to find an authorised record, percentage of answers with complete source provenance, report-assembly time, correction rate, permission-leak incidents, user satisfaction, model cost per completed task, percentage of queries handled by smaller models and performance against human-labelled benchmarks.

The UK trial is a good reminder that measured gains can vary. A broad cross-government trial reported 26 minutes per day of time savings, while HMRC's more conservative controlled evaluation found around 60 minutes per week. Both are useful data. Neither should be converted into a universal promise.

The strongest case for sovereign AI still has serious limits

There are at least nine failure modes that can turn a promising government AI programme into expensive theatre or, in the worst case, a rights problem.

1. Digitising a bad process without redesigning it

If the underlying workflow is fragmented, contradictory or legally unclear, adding a model can automate confusion. Process mapping and data ownership come before agents.

2. Treating local hosting as a complete security strategy

Local servers do not automatically provide strong identity, patching, key management, segregation of duties or incident response. Sovereignty without operational maturity can create a false sense of control.

3. Building a bespoke foundation model for every agency

This fragments scarce talent and compute. Most agencies need shared infrastructure with agency-specific knowledge, permissions and evaluations.

4. Letting generated text outrun evidence

Fluent prose is not proof. High-assurance systems must preserve citations, confidence, source classification and the distinction between evidence, external intelligence and model inference.

5. Vendor lock-in disguised as modernisation

If prompts, embeddings, workflow logic, identity and records are tightly coupled to one proprietary model endpoint, the government may gain short-term convenience at the cost of long-term bargaining power.

6. Measuring demos instead of operations

A twelve-minute executive demo can look excellent while the production system fails on scanned documents, poor bandwidth, stale permissions, model drift and incident response. The real benchmark is the boring week after launch.

7. Turning decision support into automated suspicion

Law-enforcement AI creates an obvious mission-creep risk. A system built to search files can gradually become a risk-scoring engine, then a prioritisation engine, then an input into surveillance or arrest decisions. Those transitions should require explicit legal authority, separate evaluation and independent oversight. Public-sector automation has already produced serious harm elsewhere: Amnesty International's analysis of the Dutch childcare-benefits scandal documented discriminatory risk profiling in fraud detection.³⁶

8. Ignoring admissibility, disclosure and provenance

In an investigative environment, a generated summary is not evidence. The system has to preserve the underlying source, hash or immutable reference, access history, extraction method and distinction between officer-authored material, external intelligence and model inference. Legal teams must decide how generated material is disclosed, challenged, retained and, where relevant, excluded from evidentiary use.

9. Treating data protection as a security checkbox

The Nigeria Data Protection Act 2023 requires appropriate safeguards for personal data, but a high-stakes AI deployment also needs purpose limitation, access review, retention rules, data minimisation and a documented basis for each class of processing.²⁵ A technically secure system can still be over-broad, disproportionate or politically misused if governance stops at encryption.

This is why I would define the goal narrowly: not "AI government," but government systems that use AI where it reduces friction, improves access to institutional knowledge and increases operational clarity without weakening accountability.