On 15 October 2026 the Nigerian Communications Commission (NCC) launched an Internet Governance Working Group at its first Internet Governance Symposium in Lagos. It also presented a readiness survey on the Internet Code of Practice 2026 (ICOP). Of the 19 licensees surveyed, readiness figures covered 16. Two were fully ready, nine partially ready and five not prepared, according to Vanguard's report. Cybersecurity obligations and AI provisions were the hardest parts. Licensees asked for clearer guidance and reporting templates.
The number is less alarming than it first looks, and the NCC's response is largely the right one.
The case for a demanding code
The regulator has a real problem to solve. The Internet Code of Practice 2026, dated 13 February 2026 and signed by NCC chief Dr. Aminu Maida, is issued as guidelines under Section 70 of the Nigerian Communications Act 2003. It replaces the 2019 code. Section 146(1) of the Act already requires licensees to use their best endeavours to stop their networks being used to commit offences. Section 5.3.5 of the Code adds that providers must comply with the Cybercrimes (Amended) Act 2024.
Nigeria has serious online fraud and abuse, and a regulator that can only watch is not much use to victims. Bundling open-internet rules, data protection, child safety, AI and platform governance into one instrument also gives operators a single reference point. That is arguably better than a patchwork of ad hoc directives.
What licensees are actually being asked to do
The obligations are concrete. Under Section 3.4, a provider must notify affected customers of a breach within 48 hours. If details are incomplete it must send a preliminary notice and a fuller update within 14 days. Under Section 5.3.3, once the NCC decides reported content is unlawful, providers must comply with a takedown notice within 24 hours. Section 5.3.3(d) preserves a right of appeal under Chapter V, Part 10 of the Act.
Section 3.1 requires providers to implement a Cyber Security Framework "issued by the Commission". Section 5.4.1 requires them to notify the NCC before deploying AI tools that touch network management or customer engagement. The notice must cover affected services, services being replaced, planned upgrades, and timelines and sunsetting. Section 5.4.2 adds duties to tell affected subscribers, keep the ability to withdraw an AI tool on regulatory order, and not access consumer data without consent or approval. Section 7.3 requires biannual compliance reports on prescribed templates.
The survey's findings follow from this. The two provisions licensees found hardest both depend on documents or standards still evolving. Section 5.4.2(V) lets the Commission issue further AI requirements "from time to time". Section 5.4.3 promises governance standards developed in consultation with licensees. It is hard to be ready for a standard that has not been fully written.
The AI numbers show a design question
The same survey, reported by Vanguard, found that 73% of respondents used or were piloting AI, but only 39% had an approved AI policy and 34% applied human oversight. That is a real governance gap and supports the NCC's concern. But Vanguard also reports that 40% of respondents preferred periodic reporting to notice before deployment. That is the more useful data point for design.
Section 5.4.1 is a prior-notification regime. Pre-clearance duties for tools such as fraud detection, network optimisation and chatbots can slow adoption of the very tools that help operators cut spam and fraud. A proportionate alternative is risk-tiered notice. High-impact deployments, such as automated decisions that cut off service or access consumer data, would get advance notice. Low-risk operational tools would be covered by the biannual report the Code already requires. The NCC can do this through the compliance guidance it has already reserved the power to issue. No amendment is needed.
The enforcement timeline
A BusinessDay legal analysis from July 2026 describes two 90-day phases. The first, starting 13 February, is a gestation period with no enforcement. The second is a further 90-day period for first renditions and alignment. It also describes a Designated Online Governance Officer (DOGO) as the NCC's central contact for harmful content, with licensees naming a regulatory focal person. The Code itself, at Section 7.3, confirms that requests go through the DOGO.
These phases have gone by, and the survey shows most licensees still were not fully ready. That means enforcement is the risk, not the Code. Section 7.1.1 gives some comfort. When the NCC finds non-compliance it must specify the gaps and the remedial steps, and the entity then has 14 days to report. Penalties follow the Nigerian Communications (Enforcement Processes, etc.) Regulations 2019. That is a notice-and-cure design, and the NCC should use it as written. Leading with sanctions against the 14 licensees that were not fully ready would punish a documentation problem as if it were a safety one.
What the NCC should do next
The regulator says it will publish implementation guidelines and FAQs, hold workshops for unprepared licensees, and use the new working group as a standing forum. Those are the right steps, and the sequence matters.
- Publish the templates first. The Code's Guidance Notes were issued with the Code, yet licensees still asked for clearer reporting templates. Worked examples would help more than more text.
- Publish the Cyber Security Framework with the FAQs. Section 3.1 is open-ended without it.
- Define a risk tier for AI notices so that low-risk tools are not held up.
- Report back on the next survey, so the working group's effect can be measured rather than assumed.
The takedown rules deserve similar discipline. A 24-hour window is workable only if notices are specific and reasoned, and the appeal route in Section 5.3.3(d) is real. An unlawful-content definition tied to "any existing law in Nigeria" is broad, and the Cybercrimes (Amended) Act 2024 has drawn criticism in the past over speech. A regulator with the power to order takedowns should publish aggregate figures on notices issued, contested and reversed.
Bottom line
A 2-in-19 readiness figure is a measure of how clear the instructions are, not of how reluctant licensees are. The NCC has chosen to answer it with guidance, templates and workshops. It should hold to that approach through the first full reporting cycle, and keep its enforcement powers for licensees that ignore clear instructions.