Risk-Tiered AI Marketing Architecture for Nigeria

REPRESENTATION ON THE DRAFT SALES PROMOTION (AMENDED) REGULATIONS, 2026

Date: 19 October 2026

To: The Executive Vice-Chairman / Chief Executive Officer, Federal Competition and Consumer Protection Commission (FCCPC),
23 Jimmy Carter Street, Asokoro, Abuja

By Email: salespromoregulations2026@fccpc.gov.ng (pursuant to the Commission’s Stakeholder Notice of 30 September 2026)

Subject: Representation on the Draft Sales Promotion (Amended) Regulations, 2026: Proposed Risk-Tiered Architecture for the "Artificial Intelligence and Automated Marketing" Provisions

Respondent: Adetokunbo (Ade) Atobatele, Chief Executive Officer, LegiShield Ltd (73, Oduduwa Crescent, GRA Ikeja, Lagos, Nigeria | Tel: +234 808 651 7281 | Email: info@legishield.com | https://legishield.com/fccpc-ai)

Provisions Addressed:

The Part of the Draft Sales Promotion (Amended) Regulations, 2026 titled "Artificial Intelligence and Automated Marketing" (specifically the clauses governing mandatory registration of AI and automated systems, content identification and labelling, chatbots and virtual influencers, prohibition of manipulation of behavioural tendencies, undertaking accountability, consumer opt-out, and two-year technical record-keeping), read in conjunction with the sibling Parts on Digital and Online Promotions, Influencer and Affiliate Marketing, and Cross-Border Promotions and E-Commerce Transactions;

The administrative penalty and director-liability provisions, specifically Regulations 61.2(a) and 61.2(b), the corporate penalty ceiling of N100,000,000 or 1% of annual turnover, the individual penalty ceiling of N50,000,000, and the N10,000,000 false-statement penalty; and

The Simplified, Fee-Exempt Notification provision (for promotions with total prize value up to N500,000) and related Interpretation clauses.

1. Executive Summary

We strongly support the Commission’s objective to protect Nigerian consumers from synthetic fraud, deepfake endorsements, and algorithmic manipulation. We propose one foundational change of regulatory architecture: regulate the risk and material harm an AI-enabled promotion creates, not the mere fact that software helped produce it.

As currently drafted, any undertaking that deploys, operates, or uses artificial intelligence (AI), machine learning, or automated technology for sales promotions, marketing communications, or consumer engagement "directed at or accessible to" Nigerian consumers must register that use with the Commission. Read literally, this turns routine twenty-first-century business hygiene into a regulated event. It captures an Onitsha or Balogun market trader who translates a price list using a free AI tool, every SME using a WhatsApp Business autoresponder, and foreign websites globally that are merely accessible on a Nigerian smartphone.

When paired with corporate penalties of up to N100 million or 1% of prior-year annual turnover (whichever is greater), individual fines of up to N50 million, and director disqualification of up to five years (Regulations 61.2(a) and 61.2(b)), this blanket trigger creates an inverted enforcement pyramid. It places the heaviest compliance burden on honest micro, small, and medium enterprises (MSMEs) and formal corporates, while flooding the Commission with millions of low-value filings that will starve investigators of the bandwidth needed to prosecute actual bad actors.

Fortunately, the Commission has already embedded the right solution elsewhere in this very same draft: proportionality. Under the Draft Regulations, promotions with a total prize value up to N500,000 may proceed via a simplified, fee-exempt notification route because their risk profile does not justify heavy prior administration. We ask the Commission to apply its own proportionality principle to AI.

The economies that led recent technology waves, including Nigeria itself during the rise of digital payments, succeeded by separating routine adoption from high-risk abuse:

Nigeria’s FinTech and Digital Payments Expansion: When the Central Bank of Nigeria (CBN) introduced the Three-Tiered KYC Framework in 2013 alongside NIBSS instant rails and USSD banking [1], it did not require an informal trader to pass corporate-grade vetting just to open a Tier 1 account. It scaled compliance to transaction risk.

The United States & The United Kingdom: Both held back entry burdens while e-commerce and digital finance formed, reserving heavy enforcement for actual consumer harm and recalibrating rules only once the market matured (Section 4A) [5][6].

To facilitate review by the Commission's Legal Drafting Committee, the full interactive regulatory brief, comparative annexes, and turnkey statutory clauses are published permanently at the LegiShield Intelligence Hub (https://legishield.com/fccpc-ai) [2].

Our Seven Specific Requests to the Commission:

Fix Territorial and Technical Scope: Narrow "directed at or accessible to" to "directed at" consumers in Nigeria (with an anti-evasion hook for cross-border fraud), and define AI so that routine assistive tools (spell-checkers, translation, background removal, scheduling, basic autoresponders) are expressly excluded.

Replace Blanket Registration with Targeted Declaration: Eliminate standalone registration for ordinary AI use. Instead, add a single declaration checkbox inside the existing per-promotion notification form for defined high-risk AI uses, reserving separate registration strictly for designated high-risk categories after stakeholder consultation.

Adopt a Four-Tier Risk Framework (Tiers 0–3): Calibrate obligations by the nature, severity, and reversibility of potential consumer harm, not by company turnover or the mere presence of AI, backed by self-classification, a published safe-harbour list, and a reasoned reclassification power for the Commission.

Anchor Disclosure in Materiality: Require prominent labelling of synthetic or AI-altered content where its omission would mislead a reasonable consumer on a fact material to a transactional decision—rather than plastering warning labels on every spell-checked caption or retouched background, which breeds consumer "label blindness."

Make Record-Keeping Proportionate and Feasible: Match documentation duties to the risk tier, and clarify that Nigerian businesses using third-party tools (such as OpenAI, Google, Meta, or Canva) are not required to retain proprietary model weights or training logs they neither control nor have legal access to.

Calibrate Penalties and Director Liability to Fault and CAMA 2020: Introduce graduated penalty bands, a 14-day cure period for first-time, good-faith technical breaches causing no consumer harm, and fault-based boundaries on Regulations 61.2(a) and 61.2(b), having regard to Sections 280 and 283 of the Companies and Allied Matters Act (CAMA) 2020, so directors are only proceeded against or disqualified where personal consent, connivance, or wilful recklessness is established.

Harmonise with Extant Statutes, NASS Bills, and Sister Regulators: Align the AI Part with the Commission’s own Consumer Protection Regulations and Guidance Notes, 2026, the compliance architecture in the Nigeria Data Protection Commission (NDPC) General Application and Implementation Directive (GAID) 2025 [3], and the risk-based AI bills currently advancing in the 10th National Assembly (specifically HB 143, HB 601, HB 942, and HB 1810, consolidated and passed Second Reading on 3 December 2024, alongside the National Digital Economy and E-Governance Bill at public-hearing stage) [4]; establish a "comply-once" equivalence principle with the NDPC and ARCON; publish a Regulatory Impact Assessment (RIA); and circulate the revised AI Part for a focused 21-day second comment window.

2. About the Respondent

This representation is submitted by Adetokunbo (Ade) Atobatele, Chief Executive Officer of LegiShield Ltd (73, Oduduwa Crescent, GRA Ikeja, Lagos, Nigeria; Tel: +234 808 651 7281; Email: info@legishield.com; https://legishield.com/fccpc-ai) [2], a Lagos-based regulatory intelligence and compliance technology firm.

Over a career spanning nearly five decades across Africa, Europe, and North America, the respondent has helped architect and deploy foundational financial, identity, and regulatory infrastructure in Nigeria—including SMS banking alerts, USSD banking protocols, NIBSS Instant Payments (NIP), the Bank Verification Number (BVN), and the National Identification Number (NIN).

That operational history informs every line of this submission. Those national systems scaled to over a hundred million Nigerians not by treating the underlying technology as suspect, but by designing risk-tiered guardrails: frictionless entry at the base of the pyramid, automated visibility in the middle, and uncompromising enforcement where fraud, impersonation, and consumer loss actually occur. We offer this framework in the same constructive spirit.

3. What the Draft Proposes, and Where It Overreaches

The Draft Regulations amend the Consumer Protection (Sales Promotions) Regulations, 2005 pursuant to sections 17, 18, and 163 of the Federal Competition and Consumer Protection Act (FCCPA), 2018. While the policy intent of the "Artificial Intelligence and Automated Marketing" Part is laudable, its current drafting creates severe operational and legal friction across eight areas:

- Blanket Registration of AI & Automated Tech

Draft Provision: Mandatory registration of any AI, machine learning, or automated technology deployed for promotions, marketing, or engagement "directed at or accessible to" Nigerian consumers.

Operational, Legal & Enforcement Concern: The trigger is the tool, not the harm. "Accessible to" captures any publicly accessible foreign webpage. Lack of a routine-software carve-out means email autoresponders and grammar tools trigger registration. Worse, it risks inflicting administrative overload on the Commission, burying FCCPC staff under millions of trivial MSME filings while duplicating per-promotion notifications.

- Universal Identification of AI Content

Draft Provision: All AI-generated or automated marketing content must be clearly identifiable as such.

Operational, Legal & Enforcement Concern: No materiality threshold. Requiring the same label on an AI-translated Hausa/Yoruba product caption as on a deepfake celebrity endorsement creates "banner blindness." When everything carries a warning label, nothing warns the consumer.

- Chatbot & Virtual Influencer Transparency

Draft Provision: Mandatory transparency for automated agents, chatbots, and virtual influencers.

Operational, Legal & Enforcement Concern: Sound in principle, overbroad in execution. Needs an objective test: disclosure should be mandatory wherever a consumer could reasonably believe they are interacting with a human or viewing a real human experience.

- Ban on Exploiting "Behavioural Tendencies"

Draft Provision: Prohibition on manipulation, misinformation, or exploitation of consumer data or "behavioural tendencies."

Operational, Legal & Enforcement Concern: Vague phrasing. All marketing appeals to human behavioural tendencies (e.g., recommending shoes to someone who bought socks). Without a clear definition tied to coercion, deception, or consumer vulnerability, ordinary e-commerce personalisation becomes an offence.

- Consumer Opt-Out

Draft Provision: Right to opt out of automated or AI-driven marketing communications.

Operational, Legal & Enforcement Concern: Supported, but needs safe carve-outs and NDPA alignment. Must separate promotional messages from critical transactional, security, fraud-alert, and statutory notifications, and align with the absolute right to object to direct marketing under Section 36(3) of the NDPA 2023 [3].

- Strict Accountability for AI Claims

Draft Provision: Undertaking held accountable for claims and representations produced by its AI systems.

Operational, Legal & Enforcement Concern: Supported as to consumer remedies, nuanced as to punitive sanctions. A promoter must stand behind its claims. However, administrative fines and director liability must distinguish between a deliberate scam and a prompt correction of a third-party software hallucination.

- Two-Year Detailed Technical Records

Draft Provision: Mandatory retention of detailed technical records of AI systems for two years.

Operational, Legal & Enforcement Concern: Impossibility of performance for SMEs. A Nigerian retailer using third-party cloud tools does not possess—and cannot legally compel a global vendor to hand over—proprietary model architecture or training data.

- Uncalibrated Penalties & Director Liability (Reg. 61.2)

Draft Provision: Corporate fines up to N100m or 1% of turnover (whichever is greater); N50m for individuals; up to 5-year director disqualification (Reg. 61.2); N10m false statements.

Operational, Legal & Enforcement Concern: Existential exposure for small firms & legal risk. For an SME making N15m a year, the "whichever is greater" N100m ceiling is an existential exposure. Furthermore, purporting to disqualify company directors without proving personal fault (consent, connivance, or wilful recklessness) risks conflict with Sections 280 and 283 of CAMA 2020.

4. Core Principle: Regulate the Risk, Not the Tool

The question that should trigger regulatory intervention is what the promotion represents, who it could harm, and how severely—not whether a human typed the copy or drafted it with a large language model.

The Commission has already embraced this philosophy in the Draft Regulations by allowing promotions with a prize pool up to N500,000 to proceed via a simplified, fee-exempt notification while remaining bound by core honesty rules. Extending that exact design to the AI Part rests on three pillars:

Technology Neutrality: A false claim is unlawful under the FCCPA 2018 whether a copywriter invented it or an algorithm hallucinated it. The International Chamber of Commerce (ICC) Advertising and Marketing Communications Code (2024) takes this exact position: sales-promotion standards apply to the output and conduct regardless of whether algorithms or AI were used [9].

Least Burdensome Effective Measure & Legislative Harmony: Where extant primary statutes—the FCCPA 2018, the Nigeria Data Protection Act (NDPA) 2023 (specifically Sections 36 and 37 on direct marketing and automated decision-making, operationalised where personal data is processed by Article 43 of the NDPC General Application and Implementation Directive [GAID] 2025) [3], the ARCON Act 2022, the Copyright Act 2022, and the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024—already govern algorithmic profiling, advertising vetting, and synthetic impersonation, a subsidiary sales-promotion rule must fill a specific consumer-protection gap rather than duplicate existing mandates. Furthermore, creating a horizontal registry of AI systems via subsidiary regulation would pre-empt and risk inconsistency with primary legislation currently under consideration in the 10th National Assembly—specifically the National Digital Economy and E-Governance Bill (at public-hearing stage following the Joint Senate/House Public Hearing in November 2025) and the National Institute for Artificial Intelligence and Robotic Studies Sciences Regulation Commission Bill (HB 143, 601, 942, and 1810, consolidated and passed Second Reading in the House of Representatives on 3 December 2024) [4]—which propose a risk-based model.

Responsibility Follows Control: Compliance duties must sit with the party that actually controls the risk. A Nigerian merchant controls the factual claims it makes about its goods; it does not control the neural network architecture of a commercial software tool it licenses off the shelf.

4A. Comparative Economic Lessons: How Nigeria, the US, and the UK Let New Markets Form Before Taxing Friction

Whenever a general-purpose technology emerges, regulators face a choice: impose blanket pre-registration at birth, or protect market formation while concentrating enforcement on actual fraud. History offers a clear lesson across three jurisdictions, starting right here at home.

Nigeria (2011–2020): Tiered KYC and the FinTech Expansion. When Nigeria set out to build instant digital payments and financial inclusion, had the Central Bank of Nigeria (CBN) required every roadside POS agent to complete full corporate vetting before transacting, digital financial inclusion would have stalled. Instead, the CBN pioneered the Three-Tiered KYC Framework in 2013 [1], matching compliance friction to risk rather than taxing entry at the bottom.

The United States (1998–2018): Protecting E-Commerce Formation. Through the Internet Tax Freedom Act (ITFA) of 1998 (made permanent by President Obama in 2016) and the remote-seller protections under the Supreme Court's Quill doctrine (maintained until the 2018 Wayfair ruling) [5], the US protected e-commerce formation before imposing tax and collection obligations scaled to economic significance.

The United Kingdom (1981–2016): Competition and the Regulatory Sandbox. Following the Thatcher government’s telecoms and City liberalisation (1981–1986), Britain later pioneered the FCA Regulatory Sandbox in 2016 (which drove an estimated 15% increase in startup capital raising) [6], proving that rules inviting experimentation under supervision attract capital and talent.

The National Digital Economy and E-Governance Bill (Nigeria): The Joint Senate/House Public Hearing held in November 2025 reflects domestic legislative intent to promote risk-based AI governance and proposes statutory regulatory sandboxes to foster safe innovation [4].

5. Proposed Architecture: The Four-Tier Risk Framework

Under our proposal, an undertaking’s obligations are determined by the nature, likelihood, severity, scale, and reversibility of potential consumer harm. Company turnover and the mere use of software do not elevate a promotion’s tier. General consumer protection law applies across all tiers at all times.

Tier 0 — Routine Assistive

Illustrative Promotional Activities Covered: Drafting, editing, spell-checking, translating, or localising copy into Nigerian languages; audio transcription; background cleanup or lighting correction on product photos that do not falsify material attributes; campaign scheduling.

AI-Specific Regulatory Obligations: None. No AI registration, no mandatory AI watermarking/labels, and no special technical record-keeping solely because software assisted production.

Tier 1 — Limited Risk

Illustrative Promotional Activities Covered: Customer-facing promotional chatbots answering FAQs; automated cart-abandonment or follow-up emails/SMS; standard product recommendations based on a consumer’s own past purchases or stated preferences with no adverse exclusionary effect.

AI-Specific Regulatory Obligations: Targeted Transparency & Hygiene: Clear disclosure that the user is interacting with a bot (where not obvious); simple, free, functional opt-out mechanism; standard substantiation of promotional claims. No separate AI registration.

Tier 2 — Material Risk

Illustrative Promotional Activities Covered: Synthetic testimonials, AI-generated endorsers, or virtual influencers; AI-generated visual or factual demonstrations of medical, health, financial-return, or technical performance claims; dynamic pricing or eligibility targeting driven by sensitive personal data or inferred vulnerability.

AI-Specific Regulatory Obligations: Enhanced Safeguards & Declaration: Prominent, clear disclosure of synthetic nature; single-field Tier 2 Declaration inside the existing per-promotion notification; documented pre-deployment risk check, human oversight sign-off, and 2-year retention of claim substantiation and complaint logs; separate registration only where specifically designated by the Commission after notice.

Tier 3 — Prohibited Conduct

Illustrative Promotional Activities Covered: Fabricated human testimonials passed off as genuine; unconsented voice or visual cloning (deepfakes) of real persons to endorse products or induce payment; deceptive algorithmic dark patterns; deliberate exploitation of children or vulnerable consumers; fraudulent investment or medical scams at scale.

AI-Specific Regulatory Obligations: Strictly Prohibited. Immediate enforcement action, takedown/corrective orders, corporate penalties, and fault-based director liability (requiring proof of personal consent, connivance, or wilful recklessness). No safe harbour.

Operational Mechanics (How a Business Knows Its Tier):

Self-Classification via Safe-Harbour List: Undertakings self-assess against the statutory criteria and a plain-language Safe-Harbour Schedule published by the Commission listing standard Tier 0 and Tier 1 tools.

Single-Window Declaration for Tier 2: Instead of building a parallel bureaucracy, the existing Sales Promotion Notification form adds one mandatory question: "Does this promotion deploy any Tier 2 Material-Risk AI activity?"

Commission Reclassification Power: Where the Commission has reasonable grounds to believe an undertaking has misclassified a Tier 2 activity as Tier 0 or 1, it may issue a reasoned written reclassification notice granting a reasonable window (e.g., 14 days) to comply with the higher tier before penalties attach.

Zero Tolerance for Tier 3: Tier 3 conduct is unlawful ab initio; no registration or classification shields fraud.

6. Proposed Amendments and Turnkey Statutory Wording

Because shifting from blanket tool-registration to a risk-tiered architecture consolidates and reorders the clauses currently sitting under the Part titled "Artificial Intelligence and Automated Marketing", we present the amendments below as a complete, self-contained Schedule of Substituted Provisions (Clauses AI-1 to AI-8) for direct insertion by the Commission’s Legal Drafting Committee, followed by a surgical textual amendment to Regulations 61.2(a) and 61.2(b) in Section 7.

6.1 Territorial Scope and Technical Definitions

Delete the words "or accessible to" wherever they appear in the Part titled "Artificial Intelligence and Automated Marketing" (and align with the Part on "Cross-Border Promotions and E-Commerce Transactions"), and insert the following Scope and Interpretation clauses at the head of the AI Part:

Clause AI-1 (Application and Territorial Nexus of the AI Part):

"(1) The provisions of this Part apply to sales promotions and automated marketing communications directed at consumers in Nigeria, having regard to whether the promotion uses Nigerian currency, indigenous Nigerian languages, domestic delivery or fulfilment terms, Nigerian payment rails, geo-targeted advertising parameters aimed at Nigeria, or Nigerian public figures and cultural identifiers.

(2) Passive accessibility of a foreign website or digital interface from within Nigeria shall not, without more, constitute a promotion directed at consumers in Nigeria or trigger the requirement to designate a local representative under the Cross-Border Promotions provisions of these Regulations.

(3) Nothing in sub-regulations (1) or (2) shall limit the Commission’s jurisdiction to take enforcement action against any person inside or outside Nigeria who deploys a prohibited practice under Tier 3 (Clause AI-7) that causes, or is reasonably foreseeable to cause, material harm to consumers in Nigeria."

Clause AI-2 (Definitions Applicable to the AI Part):

"In this Part—

'Artificial intelligence system' means a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as content, predictions, recommendations, or decisions that can influence physical or virtual environments [10];

'Routine assistive use' means the use of software, including an artificial intelligence system, solely to draft, edit, check grammar, translate, localise, summarise, format, transcribe, schedule, or improve the visual layout or accessibility of marketing material, where such use does not fabricate or materially alter an objective representation regarding a product’s identity, price, endorsement, or performance."

6.2 Registration by Declaration

Substitute the following for the clause requiring mandatory registration of undertakings deploying AI, machine learning, or automated marketing systems:

Clause AI-3 (Exemption for Routine Use and Registration by Declaration):

"(1) No undertaking shall be required to register with the Commission solely by reason of making routine assistive use of an artificial intelligence system (Tier 0) or deploying limited-risk automated marketing tools (Tier 1).

(2) An undertaking submitting a notification for a sales promotion under these Regulations (including via the simplified, fee-exempt notification channel for promotions not exceeding N500,000 in prize value) shall declare, within a single prescribed field on the notification form, whether the promotion deploys any Tier 2 Material-Risk Activity, namely: (a) synthetic testimonials, voice/likeness clones, or virtual influencers; (b) AI-generated demonstrations of product efficacy or financial returns; or (c) automated targeting based on sensitive personal data or inferred consumer vulnerability.

(3) Where empirical enforcement evidence demonstrates a systemic threat of consumer harm not adequately captured by sub-regulation (2), the Commission may, following a minimum 30-day public notice-and-comment consultation and by an amended schedule published in the Federal Gazette, designate a specific category of high-risk AI promotional activity for separate registration, specifying the responsible party, the proportionate information required, and any administrative fee strictly limited to cost recovery.

(4) Where multiple undertakings participate in the supply chain of a promotion, a declaration or registration made by the primary promoting undertaking shall satisfy this regulation for that promotion without requiring duplicate filings across the supply chain."

6.3 Materiality-Based Disclosure

Substitute the following for the clauses requiring all AI-generated content, chatbots, and virtual influencers to be identified:

Clause AI-4 (Material Disclosure for Synthetic Content, Virtual Influencers, and Chatbots):

"(1) An undertaking shall clearly, prominently, and intelligibly disclose that promotional content has been generated or materially altered by an artificial intelligence system where, in the absence of such disclosure, a reasonable consumer would likely be misled regarding a fact material to a transactional decision, including where synthetic content is presented as: (a) a genuine consumer testimonial or lived human experience; (b) the voice, likeness, or endorsement of an identifiable natural person, or a virtual influencer presented as possessing human qualifications in a regulated sector; (c) photographic or video evidence of a product’s physical characteristics, efficacy, or performance results; or (d) a recording of a real-world event or demonstration.

(2) An undertaking deploying an automated conversational agent or chatbot to engage consumers shall inform the consumer at the outset of the interaction that they are communicating with an automated system, unless that fact is immediately obvious from the context to a reasonable consumer.

(3) Routine assistive use does not require disclosure under this regulation."

6.4 Algorithmic Accountability and Supply-Chain Allocation

Substitute the following for the clause governing undertaking accountability for claims generated by AI systems:

Clause AI-5 (Accountability and Allocation of Supply-Chain Liability):

"(1) A promoting undertaking is responsible to consumers for the objective accuracy of claims and representations made in its sales promotions, whether generated by natural persons or by an artificial intelligence system deployed by or on behalf of the undertaking, and the autonomous behaviour of software shall not operate as a defence against consumer redress, refunds, or corrective orders.

(2) Notwithstanding platform liability provisions under these Regulations, an online platform or intermediary that merely hosts or transmits a third-party promotion without actual knowledge that it contains unlabelled Tier 2 or prohibited Tier 3 synthetic deception shall not be liable for administrative penalties provided it removes or disables access to the offending promotion expeditiously upon receiving written notice from the Commission.

(3) In determining whether to impose an administrative penalty on a promoting undertaking and the quantum thereof, the Commission shall take into account whether the contravention was deliberate, reckless, the result of failing to implement reasonable Tier 2 safeguards, or an inadvertent third-party software error that the undertaking promptly halted and corrected upon discovery."

6.5 Proportionate Record-Keeping

Substitute the following for the clause requiring two-year retention of detailed technical AI records:

Clause AI-6 (Proportionate Record-Keeping):

"(1) An undertaking shall maintain records reasonably necessary to demonstrate compliance with the obligations applicable to its risk tier.

(2) No AI-specific technical logs or algorithmic records shall be required for Tier 0 routine assistive use.

(3) For Tier 2 activities, an undertaking shall retain for a period of two (2) years following the conclusion of the promotion: (a) a plain-language summary of the AI tool and its promotional role; (b) the pre-deployment risk assessment and human review protocols applied; (c) the empirical substantiation for all material claims; and (d) a log of consumer complaints received regarding the system and remedial actions taken.

(4) An undertaking that licenses or uses a third-party artificial intelligence system without modifying its core architecture shall not be required to possess or produce proprietary source code, model weights, or training data that it does not control and cannot reasonably obtain under standard commercial terms."

6.6 Algorithmic Manipulation vs. Ordinary Personalisation

Substitute the following for the clause prohibiting manipulation, misinformation, or exploitation of consumer data or behavioural tendencies:

Clause AI-7 (Prohibited Algorithmic Manipulation and Tier 3 Conduct):

"(1) No undertaking shall deploy an artificial intelligence or automated promotional system to engage in Tier 3 Prohibited Conduct, namely: (a) fabricating human testimonials or deploying unconsented voice or visual clones (deepfakes) of identifiable persons to endorse products or induce payment; (b) deploying subliminal techniques, deceptive dark patterns, or unlawful discrimination; or (c) exploiting a consumer’s known or inferred vulnerability (including childhood, bereavement, physical or mental infirmity, or severe financial distress) so as to materially distort the consumer's economic behaviour.

(2) Customising or recommending promotional offers on the basis of a consumer’s voluntarily stated preferences, geographic location, or prior purchase history with the undertaking does not, without more, constitute manipulation or exploitation of behavioural tendencies under sub-regulation (1)."

6.7 Consumer Opt-Out and Statutory Equivalence

Substitute the following for the clause governing consumer opt-out from automated marketing:

Clause AI-8 (Right to Opt Out of Automated Marketing):

"(1) In alignment with the absolute right to object to direct marketing under Section 36(3) and (4) of the Nigeria Data Protection Act, 2023 [3], every automated marketing communication directed at a consumer shall provide a clear, free, and easily executable mechanism allowing the consumer to object to and opt out of future automated marketing, which the undertaking shall give effect to promptly upon receipt, and in any event not later than five (5) working days where suppression across pre-scheduled promotional batches is required.

(2) A consumer’s opt-out from marketing communications shall not restrict the transmission of transactional receipts, account security alerts, fraud warnings, warranty notices, or communications mandated by law.

(3) Demonstrable compliance with an equivalent opt-out or consent-withdrawal mechanism under the Nigeria Data Protection Act, 2023 or rules issued by a sector-specific statutory regulator shall satisfy the requirements of this regulation."

7. Penalties, Director Liability (Regulations 61.2(a) and 61.2(b)), and Due Process

As currently drafted, Regulation 61.2 states:

"Each director of an undertaking referred to in Regulations 61.2(b) is liable to be proceeded against as specified under Regulations 61.2(a). Such sanction may include disqualification as a director for a period not exceeding five (5) years."

Paired with corporate fines of up to N100 million or 1% of previous year's turnover (whichever is greater), individual penalties of up to N50 million, and N10 million for false statements, the current wording creates strict personal peril for company directors over administrative or third-party agency errors, and risks conflict with Sections 280 and 283 of CAMA 2020 governing director disqualification.

We urge the Commission to adopt the following replacement text for Regulations 61.2(a)–(d):

Proposed Amendment to Regulation 61.2:

"61.2 (a) Where an undertaking contravenes a provision of these Regulations, the Commission may impose an administrative penalty graduated according to the undertaking's culpability and the severity of consumer harm: (i) in the case of a Tier 3 Prohibited Practice or deliberate fraud, a penalty not exceeding N100,000,000 or 1% of the undertaking's annual turnover in Nigeria in the preceding financial year, whichever is greater; (ii) in the case of a non-fraudulent technical, notification, or disclosure breach, a penalty not exceeding N10,000,000 or 0.5% of the undertaking's annual turnover in Nigeria in the preceding financial year, whichever is lower; provided that for a first-time technical breach that has caused no quantifiable financial loss or physical harm to consumers, the Commission shall first issue a written Compliance Cure Notice granting the undertaking fourteen (14) days to remedy the breach without monetary penalty.

61.2 (b) Having regard to the statutory framework for the disqualification of company directors under Sections 280 and 283 of the Companies and Allied Matters Act (CAMA), 2020, no director or principal officer of an undertaking shall be proceeded against personally or subjected to a sanction of disqualification as a director (for a period not exceeding five (5) years) save where it is established on evidence that the contravention by the undertaking was committed with the personal consent, connivance, or wilful recklessness of that director.

61.2 (c) (Board Due Diligence Safe Harbour) A director shall not be personally liable under Regulation 61.2(b) where the Board of Directors had, prior to the contravention, adopted written compliance policies governing sales promotions and AI marketing, designated a responsible compliance officer, and obtained reasonable contractual warranties from third-party advertising agencies or software vendors where commercially available.

61.2 (d) (Procedural Fairness) Prior to imposing a sanction under Regulation 61.2(a) or commencing proceedings under Regulation 61.2(b), the Commission shall serve a written Notice of Alleged Contravention setting out the specific evidence relied upon, afford the undertaking or director at least fourteen (14) working days to submit a written response, and issue a reasoned written determination."

8. Inter-Agency and Legislative Coordination: Preventing Duplication

A Nigerian business launching a digital promotion in 2026 navigates overlapping mandates across federal bodies:

- FCCPC: Consumer fairness, deceptive representations, and sales promotion notifications (including the Commission’s own Consumer Protection Regulations, 2026 and Guidance Notes, 2026).

- NDPC: Automated decision-making, profiling, and direct marketing under Sections 36 and 37 of the NDPA 2023 and, where personal data is processed, Article 43 of the NDPC General Application and Implementation Directive (GAID) 2025 [3]. Because the NDPC already collects documentation and filings on AI, IoT, and blockchain technical and organisational parameters under GAID Article 43 where personal data is processed, requiring a second, standalone FCCPC AI registry creates unnecessary regulatory duplication.

- ARCON: Pre-exposure vetting and substantiation of marketing claims under the ARCON Act 2022.

- 10th National Assembly: The National Digital Economy and E-Governance Bill (at public-hearing stage following the Joint Senate/House Public Hearing in November 2025) proposes risk-based AI governance and regulatory sandboxes, while the National Institute for Artificial Intelligence and Robotic Studies Sciences Regulation Commission Bill (HB 143, 601, 942, and 1810, consolidated and passed Second Reading on 3 December 2024) [4] proposes a risk-based regulatory model for AI development and deployment.

We ask the Commission to establish a "comply-once" equivalence principle with the NDPC and ARCON so undertakings are not forced to register or file the same algorithmic parameters across multiple federal portals.

9. Implementation Roadmap, Transition, and 24-Month Review

To ensure smooth adoption and high voluntary compliance:

a) Pre-Finalisation Regulatory Impact Assessment (RIA): Publish a concise RIA evaluating the compliance cost of the AI Part on Nigerian MSMEs and creators.

b) Focused 21-Day Second Comment Window: Circulate the revised AI Part for a brief 21-day stakeholder verification window before gazettement.

c) Phased Commencement: Immediate effect upon gazettement for Tier 3 Prohibitions; a six (6) months transition period for Tier 1 and Tier 2 disclosure and declaration duties.

d) Safe-Harbour Guidance at Launch: Publish the initial Tier 0 & Tier 1 Safe-Harbour List on or before commencement.

e) Scheduled 24-Month Calibration Review: Commit in the Regulations to a formal review of the AI Part within 24 months of commencement.

10. Conclusion

Nigeria has a rare opportunity to set the African benchmark for intelligent AI consumer governance: uncompromising against deepfake fraud and algorithmic deception, yet effortless for the millions of honest Nigerian entrepreneurs using modern software to grow their businesses. By regulating the risk of consumer harm rather than the tool, the Commission will protect both Nigerian consumers and Nigeria’s digital competitiveness.

We respectfully urge the Commission to adopt the seven requests in Section 1 and the legislative text in Sections 6 and 7, and we commend the Executive Vice-Chairman and his team for opening this critical reform to public consultation.

Yours faithfully,

Adetokunbo (Ade) Atobatele

Chief Executive Officer, LegiShield Ltd

73, Oduduwa Crescent, GRA Ikeja, Lagos, Nigeria

Tel: +234 808 651 7281 | Email: info@legishield.com

Annex A: Line-by-Line Provision Mapping for the Drafting Committee

** Territorial Scope

Summary of Current Exposure Draft Text: Applies to AI promotions "directed at or accessible to" Nigerian consumers; foreign promoters must appoint a local representative.

Proposed Replacement / Amendment (Sec. 6.1): Clause AI-1: Narrow to "directed at" using objective Nigerian nexus indicators; clarify passive web access does not trigger local-agent mandate; retain Tier 3 harm hook for offshore fraud.

Regulatory & Economic Benefit: Enforceable in practice; stops passive foreign websites from technical breach while catching offshore USDT/deepfake scammers.

** Definitions of AI & Automated Tech

Summary of Current Exposure Draft Text: Broad undefined sweep capturing any AI, machine learning, or automated technology used in marketing.

Proposed Replacement / Amendment (Sec. 6.1): Clause AI-2: Adopt OECD AI definition [10] plus explicit carve-out for Routine Assistive Use (translation, grammar, layout, background cleanup, scheduling).

Regulatory & Economic Benefit: Keeps everyday office, translation, and creative software out of the regulatory net.

** Mandatory Registration of AI Systems

Summary of Current Exposure Draft Text: Standalone registration with the Commission required for any undertaking deploying AI or automated marketing systems.

Proposed Replacement / Amendment (Sec. 6.2): Clause AI-3: Exempt Tiers 0–1. Replace with a single declaration checkbox inside existing per-promotion notifications (including N500k route) for Tier 2; require 30-day consultation and Gazette notice for any new high-risk registration.

Regulatory & Economic Benefit: Prevents administrative overload on the FCCPC portal; harmonises with NASS AI bills and GAID 2025; gives visibility of real risk at zero added cost.

** Content Identification & Chatbots

Summary of Current Exposure Draft Text: Blanket rule that all AI-generated content must be clearly identifiable; transparency for chatbots and virtual influencers.

Proposed Replacement / Amendment (Sec. 6.3): Clause AI-4: Materiality threshold: mandatory prominent disclosure for synthetic testimonials, likeness/voice clones, virtual influencers in regulated sectors, faked product demos, and non-obvious chatbots.

Regulatory & Economic Benefit: Prevents consumer "label blindness"; preserves warning impact for deepfakes and regulated-sector claims.

** Undertaking Accountability

Summary of Current Exposure Draft Text: Undertaking accountable for AI claims; hosting platforms subject to platform liability provisions.

Proposed Replacement / Amendment (Sec. 6.4): Clause AI-5: Retain strict promoter accountability for consumer redress; add notice-and-takedown safe harbour for innocent hosting platforms; grade fines by culpability and prompt fix.

Regulatory & Economic Benefit: Protects consumers 100% while aligning platform liability with intermediary notice-and-takedown standards and encouraging rapid self-remediation.

** Two-Year Technical Records

Summary of Current Exposure Draft Text: Mandatory retention of detailed technical AI records for two years.

Proposed Replacement / Amendment (Sec. 6.5): Clause AI-6: Exempt Tier 0; tailor Tier 2 records to risk assessments, claim substantiation, and complaint logs; exempt third-party proprietary code/weights beyond user control.

Regulatory & Economic Benefit: Demands records that actually help FCCPC investigators and that Nigerian SMEs can legally possess.

** Ban on Exploiting "Behavioural Tendencies"

Summary of Current Exposure Draft Text: Bans manipulation, misinformation, or exploitation of consumer data or "behavioural tendencies."

Proposed Replacement / Amendment (Sec. 6.6): Clause AI-7: Define Tier 3 Prohibited Conduct (deepfake impersonation, subliminal tactics, dark patterns, exploiting vulnerable groups); protect normal purchase-history personalisation.

Regulatory & Economic Benefit: Targets predatory manipulation without criminalising standard e-commerce recommendations.

** Consumer Opt-Out

Summary of Current Exposure Draft Text: Consumers must be able to opt out of automated or AI-driven marketing communications.

Proposed Replacement / Amendment (Sec. 6.7): Clause AI-8: Align with the absolute right to object to direct marketing under NDPA 2023 s. 36(3)–(4) (prompt effect upon receipt; max 5 working days for pre-scheduled batch suppression); carve out transactional/security/OTP alerts; recognise NDPA equivalence.

Regulatory & Economic Benefit: Prevents conflict with NDPA 2023; protects banking/security alerts; avoids duplicate consent regimes.

** Penalties & Director Disqualification — Reg. 61.2

Summary of Current Exposure Draft Text: Corporate fine up to N100m or 1% turnover (whichever is greater); N50m individuals; N10m false statement; director disqualification up to 5 years under Reg. 61.2(b).

Proposed Replacement / Amendment (Sec. 7): Amended Reg. 61.2(a)–(d): Reserve "whichever is greater" for Tier 3 fraud; apply "whichever is lower" plus 14-day Cure Notice for harmless technical slips; having regard to CAMA 2020 ss. 280 & 283, require proof of personal consent, connivance, or wilful recklessness for director liability/disqualification plus Board Due Diligence safe harbour.

Regulatory & Economic Benefit: Avoids conflict with CAMA 2020; aligns punishment with fault; stops SME flight to informality.

** Commencement & Review

Summary of Current Exposure Draft Text: Immediate application upon gazettement.

Proposed Replacement / Amendment (Sec. 9): RIA; 21-day focused comment round on AI Part; immediate effect for Tier 3 fraud; 6-month transition for Tiers 1–2; 24-month review.

Regulatory & Economic Benefit: Smooth market transition and evidence-based calibration.

Annex B: Domestic & International Regulatory Benchmarks

No consumer-protection or advertising regime reviewed requires every business using AI in marketing to register with a central authority. Instead, best practice combines technology-neutral conduct rules, materiality-based disclosure, and risk-tiered obligations:

** Nigeria: CBN Three-Tiered KYC Framework (2013) [1]

Regulatory Approach: Scaled onboarding and compliance obligations across Tiers 1, 2, and 3 based on transaction value and financial crime risk rather than imposing Tier 3 rules on micro-accounts.

Direct Relevance to FCCPC Draft (Sections 4A & 5): Domestic precedent proving that risk-tiered regulation works in Nigeria’s institutional environment to drive both mass formalisation and targeted fraud control.

** Nigeria: NDPA 2023 (Ss. 36–37) & NDPC GAID 2025 (Art. 43) [3]; plus NASS AI Bills (HB 143, 601, 942, 1810, passed 3 Dec 2024) & National Digital Economy Bill [4]

Regulatory Approach: Where personal data is processed, NDPC GAID 2025 (Art. 43) already requires controllers and processors deploying AI, IoT, or blockchain to document and file technical and organisational parameters with the NDPC. Meanwhile, HB 143/601/942/1810 (passed Second Reading in NASS) propose a risk-based AI model, and the National Digital Economy Bill (at public-hearing stage) proposes risk-based governance and regulatory sandboxes.

Direct Relevance to FCCPC Draft (Sections 4, 6.2 & 8): A second FCCPC AI registry would duplicate existing NDPC parameter filings under GAID Art. 43 where personal data is processed and pre-empt pending NASS legislation. Replacing registration with a Tier 2 promotional declaration and a "comply-once" rule prevents duplication.

** European Union: EU AI Act (Regulation (EU) 2024/1689, Article 50) [7]

Regulatory Approach: Requires transparency where humans interact with AI chatbots (unless obvious), disclosure of deepfakes, and machine-readable marking of synthetic outputs. Registration is restricted to Annex III high-risk systems (with Annex III high-risk obligations deferred to 2 December 2027), not routine marketing use.

Direct Relevance to FCCPC Draft (Sections 6.2 & 6.3): Global benchmark showing that even the world’s strictest AI statute regulates marketing through transparency and conduct duties, not a registry of businesses using AI tools.

** Türkiye: Amended Regulation on Commercial Advertising and Unfair Commercial Practices [8]

Regulatory Approach: Requires disclosure where AI-generated content is capable of materially influencing a consumer's economic behaviour, and strictly prohibits creating a false impression that a synthetic replica genuinely endorsed a product.

Direct Relevance to FCCPC Draft (Section 6.3): Emerging-market peer precedent for anchoring AI advertising rules in a materiality and false-endorsement test.

** ICC Advertising and Marketing Communications Code (2024 Revision — Chapter A) [9]

Regulatory Approach: Establishes that core truthfulness, substantiation, and sales-promotion standards apply equally regardless of the medium or technology used to generate the promotion, expressly encompassing algorithms and AI.

Direct Relevance to FCCPC Draft (Section 4): Industry standard supporting technology-neutral enforcement without duplicating baseline promotion rules.

** OECD Updated Definition of an AI System (2023/2024) [10]

Regulatory Approach: Defines an AI system by its capacity to infer from inputs how to generate predictions, content, recommendations, or decisions influencing physical or virtual environments.

Direct Relevance to FCCPC Draft (Section 6.1): Provides a globally interoperable definitional standard when paired with a routine-software carve-out.

Reference Endnotes

[1] Central Bank of Nigeria (CBN): Circular on Three-Tiered Know Your Customer (KYC) Requirements, 18 January 2013.

[2] LegiShield Intelligence Hub: Official Interactive Briefing & Turnkey Clauses on the Draft Sales Promotion (Amended) Regulations, 2026, published permanently at https://legishield.com/fccpc-ai.

[3] Nigeria Data Protection Act (NDPA) 2023, Sections 36–37; Nigeria Data Protection Commission (NDPC): General Application and Implementation Directive (GAID) 2025, Article 43 (Technical and Organisational Parameters for AI, IoT, and Blockchain where personal data is processed).

[4] National Assembly of the Federal Republic of Nigeria: National Institute for Artificial Intelligence and Robotic Studies Sciences Regulation Commission Bill (HB 143, 601, 942, and 1810), consolidated and passed Second Reading in the House of Representatives on 3 December 2024; and National Digital Economy and E-Governance Bill, Joint Senate and House of Representatives Public Hearing held in November 2025.

[5] United States: Internet Tax Freedom Act, Pub. L. 105-277 (1998), made permanent by the Trade Facilitation and Trade Enforcement Act of 2015, Pub. L. 114-125 (signed 24 February 2016); Quill Corp. v. North Dakota, 504 U.S. 298 (1992); and South Dakota v. Wayfair, Inc., 585 U.S. 162 (2018).

[6] United Kingdom: Telecommunications Act 1984 (c. 12) and London Stock Exchange deregulation ("Big Bang", October 1986); Financial Conduct Authority (FCA): Regulatory Sandbox Lessons Learned Report (London: FCA, October 2017) & Giulio Cornelli et al., Regulatory Sandboxes and Fintech Funding: Evidence from the UK (CEPR / VoxEU, 2020).

[7] European Union: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act), OJ L, 2024/1689, Article 50 (applicable 2 August 2026; Annex III high-risk system obligations deferred to 2 December 2027).

[8] Republic of Türkiye (Ministry of Trade): Amended Regulation on Commercial Advertising and Unfair Commercial Practices (governing AI-generated commercial advertising and synthetic endorsements, in force 1 August 2026).

[9] International Chamber of Commerce (ICC): ICC Advertising and Marketing Communications Code (2024 Revision), Chapter A (General Provisions and Definitions governing algorithmic and AI-assisted marketing communications).

[10] Organisation for Economic Co-operation and Development (OECD): Explanatory Memorandum on the Updated OECD Definition of an AI System, OECD Artificial Intelligence Papers, No. 8 (Paris: OECD Publishing, 2024).


----
About Ade Atobatele: https://www.linkedin.com/in/adeatobatele
There Are No Problems In The World, Just Solutions Waiting To Be Found!