Governance

Deployer / Operator

Entity placing AI systems into production or use.

How the laws define this

Regulatory frameworks consistently identify a deployer or operator as an entity or person responsible for putting an artificial intelligence system into active use, production, or commercial availability, while ensuring operational compliance and human oversight. All three instruments burden this actor with regulatory accountability and operational governance once the system is active. Instruments diverge, however, on the specific compliance obligations attached to the role. The Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942) expands actions to making systems available to users or integrating them into products, requiring formal administrative steps like registering and licensing deployed systems alongside market surveillance cooperation. In contrast, the National Artificial Intelligence Policy Framework (Draft) — Department of Communications and Digital Technologies emphasizes internal risk controls, explicitly mandating AI impact assessments, data stewardship, and procurement requirements. Meanwhile, the National Artificial Intelligence Policy (NAIP) highlights operational lifecycle duties, specifically requiring ongoing monitoring, maintenance, and safe operation.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

  • Under the Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942), would require registering and licensing deployed systems.source
  • Under the Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942), would require ensuring operational compliance including data protection, transparency, and human oversight.source
  • Under the Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942), would require incident reporting.source
  • South Africa's National Artificial Intelligence Policy Framework (Draft), which is superseded, called for conducting AI impact assessments.source

Definitions (3)

An entity or person that places an AI system into operational use (deploys or operates it) and is responsible for implementation safeguards such as human oversight measures, conducting AI impact assessments, ensuring documentation and data stewardship, and complying with procurement and regulatory requirements.

A person or organization who makes an AI system available to users or integrates it into products or services, responsible for registering and licensing deployed systems, ensuring operational compliance (data protection, transparency, human oversight), incident reporting, and cooperating with market surveillance and regulatory requirements.

An entity that deploys, operates, or places an AI system into production and is accountable for safe operation, monitoring, maintenance, incident reporting, and fulfilling operational compliance requirements during the system’s use.

Not to be confused with

Operator/Deployer

Operator/Deployer covers operating, deploying, or using an AI system, while Deployer/Operator focuses on placing into production or use with specific compliance duties.

Deployer/Operational User

Deployer/Operational User refers to organisations implementing AI into products or services, whereas Deployer/Operator emphasises operational use and safeguards like human oversight.

Questions and answers

What registration duties apply to a deployer under Nigeria's AI Bill?

The Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942) holds deployers responsible for registering and licensing deployed systems. It is currently under review.

Does deploying AI in South Africa require impact assessments?

South Africa's National Artificial Intelligence Policy Framework (Draft), now superseded, described deployers as responsible for conducting AI impact assessments. It was not binding.

What compliance obligations do AI deployers face in Nigeria?

Nigeria's Control of Usage of Artificial Intelligence Technology in Nigeria Bill (HB 942) requires deployers to ensure operational compliance with data protection, transparency, human oversight, and incident reporting.