Introduction
The proliferation of generative AI has transformed Nigeria’s cybercrime landscape, enabling deepfake fraud, automated social engineering, and AI-enhanced phishing at scale. In early 2024, scammers using AI-generated deepfake videos impersonating a company’s CFO defrauded a Hong Kong finance worker of $25.6 million. As similar threats emerge in Nigeria’s fintech sector, this article examines whether the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended 2024) is legally adequate, or whether Nigeria’s evidentiary and accountability frameworks are too weak to support effective prosecution of AI-driven cybercrime
Current Legal Landscape
Nigeria’s primary legal framework on preventing cybercrime is the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended in 2024 to address cryptocurrency transactions, cyberbullying and various forms of digital misconduct. Complementary frameworks include the National Information Technology Development Agency Act 2007, the Nigerian Data Protection Act 2023, and sectoral regulations such as the CBN’s Risk-Based Cybersecurity Framework. However, the majority of these frameworks were issued far before now, and emerging risks like AI-driven threats are not really being addressed. The Act nowhere mentions “artificial intelligence,” “algorithm,” or “autonomous system.” Notably, the National Artificial Intelligence Commission (Establishment) Bill, 2025, is currently pending before the Senate. If passed, it would establish a dedicated commission to coordinate AI strategy, research, and ethical deployment. However, the Bill in its present form focuses primarily on development and innovation promotion, with limited provisions on criminal liability, evidence handling, or enforcement against AI-facilitated cybercrime, leaving the core accountability and evidentiary gaps largely unaddressed.
AI as a Double-Edged Sword
AI paradoxically enables both defence and attack. Nigerian financial institutions deploy AI for real-time fraud detection and pattern recognition. Conversely, cybercriminals exploit generative AI for deepfake creation, automated credential stuffing, and convincing phishing tailored to Nigerian English and Pidgin. The same technology that powers fraud detection systems can be weaponised to evade them. Take justice delivery as an example, the Evidence Act 2011 (as amended 2023) admits computer-generated evidence under Section 84, but remains silent on AI’s capacity to seamlessly generate or alter electronic records, creating “doctored AI-generated evidence”. These and many more issues await Nigeria’s digital space in the coming years.
The Legal Gaps
There are multiple critical gaps that undermine AI governance. For this article, three are considered. First, no framework attributes criminal liability when an autonomous AI commits an offence. The question of whether the developer, user, or owner should bear criminal responsibility for the acts of an autonomous system remains entirely unanswered under Nigerian law, leaving prosecutors without a clear legal theory of culpability.
Second, Section 84 of the Evidence Act 2011 governs computer-generated evidence but does not address AI-generated outputs. The Act’s definition of “computer” excludes AI’s cognitive processing capabilities, creating a statutory blind spot where evidence produced by generative or autonomous systems falls outside the existing admissibility framework.
Third, Nigeria lacks any framework for mandatory AI-generated content labelling, impeding deepfake traceability. Computer-generated evidence under Section 84 of the Evidence Act 2011 remains admissible if unchallenged at trial, a dangerous precedent for AI evidence, as opposing parties may lack the technical capacity to mount any challenge at all.
Comparative Jurisdictions: Rich Laws, Tangible Results
Jurisdictions with advanced AI laws demonstrate clear outcomes. The EU AI Act (Regulation 2024/1689) mandates transparency obligations, requiring synthetic content labelling and informing individuals when interacting with AI systems; non-compliance triggers significant penalties. The US Algorithmic Accountability Act of 2023 is a proposed Act that will require impact assessments for high-risk AI systems in housing, credit, and employment, with FTC enforcement and a public repository. China implemented mandatory measures for the Identification of AI-generated (Synthetic) content. These rules, mandated by the Cyberspace Administration of China (CAC) and others, require explicit (visible labels) and implicit (watermarks/metadata) identification for all AI-generated text, images, audio, video, and virtual scenes to ensure transparency, traceability, and combat disinformation. These laws contribute to measurable results: forensic traceability, expedited prosecution of deepfake fraud, and clear liability chains. Nigeria has none of these.
Hope or Illusion?
Without legislative intervention, AI’s promise against cybercrime remains an illusion. Nigeria requires the following to boost its hope:
Conclusion
AI can help curb cybercrime in Nigeria, but only if legal capacity catches up with technical capability. The Cybercrimes Act 2024 amendments were a step forward, but they did not address AI accountability, algorithmic transparency, or evidentiary credibility. The pending National Artificial Intelligence Commission Bill, 2025, signals legislative awareness, but without substantive provisions on liability, evidence, and enforcement, it cannot fill the existing gaps. The effectiveness of existing frameworks remains a question. An optimistic but cautious path exists, but until Nigeria enacts AI-specific legislation, whether through amending the Cybercrimes Act, revising the Evidence Act, or strengthening the pending Bill, weak laws will remain unable to support strong technology.
Nafisat Damisa is a Legal Research Associate in Olives and Candles – Legal Practitioners. For further information, enquiries, or clarification, please contact Nafisat via: [email protected] or [email protected]