Artificial intelligence agents are no longer theoretical. They are making real decisions inside Nigerian banks, fintech platforms, and insurance companies right now — approving transactions, verifying identities, and handling customer data that is subject to Nigerian law.
But the tools that govern how these AI agents behave were not built with Nigerian law in mind.
This is the governance gap that nobody in the global AI conversation has adequately addressed. And until recently, it was a gap that Nigerian engineers were simply expected to tolerate.
The global AI governance blind spot
Microsoft’s Agent Governance Toolkit is one of the most widely used open-source frameworks for putting compliance guardrails around AI agents. It ships with policy coverage for OWASP’s Agentic AI Top 10, NIST’s AI Risk Management Framework, the EU AI Act, SOC 2, and HIPAA. These are serious, comprehensive governance frameworks trusted by thousands of organisations globally.
For Nigerian and African regulatory frameworks, the toolkit contained zero coverage.
Not because the need is less real here. An AI agent processing a ₦6.5 million refund request in Lagos faces the same governance obligations as one processing a similar request in London or San Francisco. The Central Bank of Nigeria’s transaction thresholds must be enforced. The Nigeria Data Protection Act’s data residency requirements must be respected. BVN and NIN data must be protected from exposure. The Nigerian Financial Intelligence Unit’s anti-money laundering controls must apply.
None of these obligations was represented in the global toolkit.
Filling the gap ourselves
Rather than wait for a global team to notice this absence, I built the missing piece.
I created an open-source community policy pack called agt-policies-nigeria, comprising twelve YAML policy files that extend Microsoft’s Agent Governance Toolkit with coverage for African regulatory frameworks. Each file carries specific regulatory citations — not general references to “African data protection law,” but precise section numbers and guidelines from the actual legal instruments.
The pack covers Nigeria’s NDPA 2023 data residency obligations, CBN tiered KYC transaction limits, POS geo-fencing rules under CBN’s agent banking guidelines, BVN and NIN protection requirements, NFIU anti-money laundering controls including suspicious transaction reporting thresholds, South Africa’s POPIA, Kenya’s Data Protection Act 2019, ECOWAS cross-border transfer rules, and data protection frameworks for Mauritius, Ghana, Tanzania, Ethiopia, Botswana, and Rwanda.
The result is twelve countries and one regional body, covered by policy files that a Nigerian or African fintech can drop into their AI agent infrastructure without writing governance logic from scratch.
What the Microsoft merge means
A few hours ago, a Microsoft collaborator reviewed and merged these policy files into the main branch of microsoft/agent-governance-toolkit via pull request #3077. The reviewer confirmed that all twelve files met the project’s standards, with specific regulatory citations present and consistent schema throughout. 92 of 94 automated checks passed.
The merge means that African regulatory frameworks are now part of the global AI governance standard — maintained in a repository that Microsoft’s own engineering team reviews and that developers globally will encounter when building AI governance infrastructure.
This is not a small milestone. It is the first time that NDPA 2023 controls, CBN agent banking rules, and NFIU anti-money laundering requirements have been represented in a major international AI governance toolkit.
What this reveals about the path forward
Nigeria’s AI regulatory environment is moving quickly. The National Digital Economy and E-Governance Bill, expected to pass later this year, will give NITDA the authority to classify AI systems by risk level and require governance documentation from organisations deploying high-risk AI agents. Companies that cannot demonstrate that their AI systems operate within documented compliance boundaries, with an audit trail, will be exposed when enforcement begins.
The tooling to build that compliance layer for the Nigerian market now exists. It is open source, validated by Microsoft’s own team, and available to any developer today.
But the deeper lesson of this episode is not about the tool. It is about the pattern.
The governance gap that this project addresses existed for years before anyone filled it. It will not be the last such gap. African data protection laws, sector-specific AI governance frameworks, and the regulatory requirements that will emerge from Nigeria’s incoming AI legislation all represent areas where global tooling will lag behind the African context.
The engineers who understand both the regulatory environment and the technical infrastructure are the ones best positioned to close those gaps. Not by waiting for global teams to prioritise Africa on their roadmaps — but by building the missing pieces and contributing them to the global commons.
The bottom line
African AI governance is not a problem that will be solved for us. It is a problem that Nigerian and African engineers are uniquely positioned to solve — and the tools, the platforms, and the open-source processes needed to do so are more accessible today than they have ever been.
The question is not whether the gap exists. The question is who fills it.
Oluwajuwon Steven Omotayo is a software engineer and CTO at Sagegrey Technologies, Lagos. He builds AI infrastructure and compliance tooling for African markets. The agt-policies-nigeria project is available at github.com/kingztech2019/agt-policies-nigeria.