Whose Law Governs the Algorithm? Domestic AI Content Regulations and the Crisis of Cross-Border Enforcement.

I. INTRODUCTION

If a hyper-realistic, malicious deepfake of the Nigerian president is generated on an American server, and spreads virally across European social media platforms, which nation’s laws will hold the algorithm accountable? Synthetic media traverses physical borders instantaneously, yet the global legal infrastructure regulating its lawfulness and spread is largely geographically confined.

The rapid growth of Artificial Intelligence has outpaced international treaties regulating it, which has forced nations to develop isolated and domestic regulatory frameworks to combat digital harms. Currently, there are two major international legislative instruments governing the lawful use of AI Content multilaterally— the European Union AI Act^[1], and the UNESCO Recommendation on the Ethics of Artificial Intelligence (2021)^[2]. In a domestic context, the impending National Digital Economy and e-Governance Bill^[3], which is expected to transition into an Act in 2026, aims to provide a unified legal framework for Nigeria’s digital transformation.

This article argues that while the EU focuses on compliance and the UN on transparency and accountability, Nigeria’s emerging agency-driven, risk-tiered approach exposes a critical flaw in global AI governance; and it is that domestic frameworks, regardless of their internal efficacy, inevitably collapse under the weight of cross-border enforcement when regulating a borderless technology.

From instances that might trigger a question of the lawfulness of a certain use of AI to the jurisdictional applicability of the safeguards surrounding the violations of these laws, the following sections analyse the domestic regulations on AI content in a country like Nigeria and the nightmare of implementing likewise regulations on unlawful AI content across foreign borders, while illustrating the urgent need for harmonized international enforcement mechanisms on AI Content.

II. LEGAL FRAMEWORK.

As of now, the global landscape vis-à-vis regulations on Artificial Intelligence (AI) content reflects a deep dichotomy between centralized, agency-led domestic laws and sweeping, yet structurally fragmented international instruments.

The Nigerian Model: The E-Governance Bill and Agency-Driven Enforcement Sponsored by the Federal Ministry of Communications, Innovation and Digital Economy and in its final legislative phases, the National Digital Economy and E-Governance Bill seeks to fundamentally restructure Nigeria’s digital governance landscape. Instead of forcing victims to rely exclusively on private tort litigation which are often prolonged, this proposed legislation intends to establish a binding and risk-tiered AI compliance framework, overseen by the National Information Technology Development Agency (NITDA) as the primary administrative clearinghouse.

The proposed bill classifies AI architectures into distinct risk tiers based on their potential to infringe on rights, livelihoods, and public institutional integrity. High-risk systems—such as those deployed in public administration, automated identity verification, and financial infrastructure, have mandatory requirements of strict conformity assessments along with human oversight mechanisms and formal registration with NITDA placed on them by the bill. In addition to this, the penalty schedule for violating its provisions is highly punitive, empowering NITDA to levy administrative fines of up to ₦10 million or 2% of annual revenue^[4]; whichever is higher, alongside explicit enforcement powers to issue operational bans or block non-compliant digital systems.

Multilateral Regimes: The Risk-Based EU AI Act and the Soft Law Baseline of UNESCO

​In contrast to Nigeria’s centralized, agency-driven approach,  the prominent European Union AI Act; an international instrument designed to govern algorithmic systems, stands as the world’s first comprehensive regional regulation on artificial intelligence. It utilises a strict, preventive classification model which categorizes AI systems into four distinct risk levels:​

• Unacceptable Risk: Banned outright (e.g., arbitrary or discriminatory social scoring systems).

• ​High Risk: Subject to intensive compliance and conformity audits.

• ​Limited Risk: Subject to clear transparency and labeling obligations.

• ​Minimal Risk: Exempt from rigorous administrative oversight.

While the EU framework relies on rigid and preventive market-access barriers to enforce safety standards on AI models within its international borders, the United Nations Educational, Scientific and Cultural Organization (UNESCO) Recommendation on the Ethics of Artificial Intelligence (2021) operates on an entirely separate plane. Despite being adopted by all 194 member states of the UNESCO including Nigeria and India^[5]; the most widely adopted AI governance instrument, the UNESCO framework is unfortunately a soft law— a non-binding quasi-legal instrument. It merely enumerates fundamental moral values and principles such as accountability, transparency, and human rights protections which are intended to serve as a baseline to guide member states in drafting their own national laws on AI use and policies.

​The key distinction worthy of note here is that inasmuch as Nigeria’s proposed framework provides a versatile and binding, agency-led regulatory mechanism, that of the EU—the EU AI Act, is largely preventive in its utilisation of rigid market-access gates, while the UN’s UNESCO Recommendation on the Ethics of Artificial Intelligence (2021) offers ethical benchmarks meant to inform national regulations on AI architecture and use, which are nonetheless unenforceable.

​Analyzing the mere statutory architecture of these instruments, however, is insufficient without evaluating how courts have historically grappled with the underlying jurisdictional friction that harmful borderless digital expressions may pose.

III. CASE LAW ANALYSIS

Judicial attempts to enforce domestic digital regulations against extraterritorial actors reveal an acute jurisdictional mismatch between geographic sovereignty and borderless algorithmic harms.

The Extraterritorial Expansion and the Limits of Long-Arm Jurisdiction

To put the cross-border enforcement crisis facing Nigeria’s new regulatory model into context, let us examine how global courts handle extraterritorial digital harms. In the landmark case of Google LLC v. Commission nationale de l’informatique et des libertés (CNIL)^[6], the Court of Justice of the European Union (CJEU) faced the question of whether a regional digital right—the “right to be forgotten” under the GDPR (The EU’s General Data Protection Regulation)^[7], could be enforced globally against an international search engine. The CJEU ultimately scaled back the regulator’s global ambitions, holding that while an internet platform must remove links across all its EU-specific domain variations, no international law permits a single regional authority to mandate global de-referencing across foreign jurisdictions like the United States.

​This decision revealed a critical enforcement gap, which is that even when an international framework possesses statutorily binding force, its enforcement capacity stops abruptly at the sovereign boundaries of foreign states that maintain conflicting legal values regarding the subject of those laws; in this case, digital Artificial Intelligence (AI) content.

Choice of Law and Harm in the Algorithmic Paradigm.

This jurisdictional loophole is further exacerbated by conflicting private international law doctrines concerning cross-border torts and digital media distribution. In Dow Jones & Co Inc v Gutnick^[8], the High Court of Australia established a foundational digital precedent by ruling that a cross-border defamation action occurs not where the content is uploaded or hosted (the United States), but where the uploaded data is downloaded and the harm to reputation is actually suffered (Australia)^[9]. While this “place of harm” doctrine provides domestic courts with a theoretical authority to assert jurisdiction over foreign offenders, the practical implementation of such judgments remains notoriously difficult.

This was seen in Yahoo! Inc. v. La Ligue Contre Le Racisme Et L’Antisemitisme (LICRA)^[10], where French advocacy groups successfully obtained an injunction against an American internet portal for displaying content that was unlawful in France. However, when Yahoo! sought a ruling that enforcing this injunction inside U.S. borders would violate the First Amendment, the United States Court of Appeals ultimately dismissed the case on procedural grounds, stating that the U.S. court either lacked jurisdiction over the French groups or that the case was not “ripe” (mature) enough because France had not actually tried to collect the fines in America yet.

These national judicial fault lines underscore the structural gap that inevitably manifests when domestic regulators attempt to apply localized enforcement powers to global algorithmic networks.

IV. CRITICAL EVALUATION

A close scrutiny of Nigeria’s emerging agency-driven framework exposes a fundamental sovereign limitation: no matter how robust NITDA’s internal risk-tiered compliance mechanisms are, they lack the structural teeth required to enforce punitive actions against a foreign-hosted, decentralized algorithm.

The Sovereign Ceiling: Gaps in the E-Governance Enforcement Matrix.

The fatal flaw within the National Digital Economy and E-Governance Bill lies in its underlying operational assumption that administrative penalties can effectively control a borderless technology. If a malicious deepfake targeting a Nigerian public official is generated via an open-source model hosted on an American server, NITDA’s statutory enforcement mechanism will be immediately paralyzed. Under current private international law and sovereign-immunity doctrines, NITDA  will not be able to compel a non-resident foreign developer to submit to its mandatory conformity assessments, nor will it be able to collect its 2% revenue fine without the cooperation of foreign judiciaries.

Consequently, the bill’s robust enforcement mechanisms risk becoming an internal regulatory bubble—capable of disciplining domestic tech startups while remaining utterly defenseless against foreign digital actors who inflict the most severe systemic harms on the domestic digital landscape.

Addressing the Counterargument: The Illusion of Extraterritorial Compliance.

While advocates of localized AI regulations may argue that significant local economic markets can force international compliance through market-access restrictions or technical blocking directives, this counterargument stems from the false premise that foreign developers will voluntarily comply with NITDA guidelines to avoid having their digital systems blocked at the national gateway, because the E-Governance Bill applies to all service providers operating “wholly or partially” within Nigeria.

However, this argument fails to address how modern generative AI is actually built and shared. Today, publicly available base AI models can be downloaded directly onto personal computers, altered and shared across independent, user-to-user networks, thus effectively bypassing the control of traditional internet service providers.

Furthermore, imposing sweeping online blocks or restricting access to specific server addresses directly contradicts Nigeria’s broader economic goal of fostering an open, $1 trillion digital economy^[11], given that heavy-handed censorship inevitably hinders legitimate online trade and disrupts domestic innovation.

In order to fully understand the broader implications of these enforcement gaps, it is necessary to contrast the operational machinery of Nigeria’s domestic model directly with that of its prominent international counterparts.

V. COMPARATIVE PERSPECTIVES

Placing Nigeria’s emerging regulatory paradigm alongside the EU AI Act and the UNESCO Recommendation on the Ethics of Artificial Intelligence (2021) reveals how the variance in the combinations of administrative versatility, binding statutory weight, and ethical principles still ultimately fail to resolve the crisis of cross-border law enforcement, viz:

Rigid Prohibitions vs. Dynamic, Agency Intervention.

​When contrasted with the European Union AI Act, Nigeria’s E-Governance Bill demonstrates a significantly more flexible administrative approach, yet it encounters the same structural limitations. The EU AI Act relies on a rigid, highly institutionalized market-entry model that demands extensive, preventative conformity assessments before an AI tool can legally enter the European Union market. While this preventative stance effectively forces large, established tech conglomerates to modify their global architectures in compliance with Brussels (the EU), it remains remarkably inefficient at intercepting spontaneous, cross-regional synthetic content generated by independent foreign entities.

Nigeria’s statutory model shifts the center of regulatory authority away from rigid legislative text toward dynamic agency intervention, allowing NITDA to rapidly adjust its risk-tiered classifications as new algorithmic threats emerge. Still, neither the EU’s heavy preventative gatekeeping nor Nigeria’s versatile administrative oversight answers the difficult question, “Whose law governs the global algorithm?” When a cross-border algorithmic violation occurs, both frameworks lack a formal mechanism to reconcile their domestic mandates with foreign sovereign laws.

​The Enforcement Deficit: Binding Hard Law vs. Aspirational Soft Law.

​The limitations of these binding frameworks become even more pronounced when evaluated against the aspirational baseline established by the UNESCO Recommendation on the Ethics of Artificial Intelligence. While Nigeria’s upcoming Act and the EU AI Act attempt to build concrete compliance frameworks backed by state power, the UNESCO framework operates entirely through voluntary moral persuasion and international principles.

Because the UNESCO Recommendation lacks any binding statutory authority or punitive enforcement mechanisms, it is fundamentally incapable of resolving a jurisdictional clash when member sovereign nations maintain diametrically opposed standards for algorithmic AI content protection. As a consequence, the comparative spectrum of remedies available ranges from the toothless, universal aspirations of UNESCO to the robust but geographically confined mandates of the EU and Nigeria.

It follows that, in resolving the cross-border enforcement crisis on synthetic media, otherwise known as AI Content, there must be a shift past isolated domestic frameworks toward a unified and universal enforcement convention specifically engineered for the algorithmic age.

VI. CONCLUSION

​Summarily, this analysis has revealed that while domestic regimes like Nigeria’s impending National Digital Economy and E-Governance Bill and regional frameworks like the EU AI Act establish robust administrative compliance mechanisms, global AI governance remains divided between these localized hard laws and international soft laws like UNESCO Recommendation on the Ethics of Artificial Intelligence (2021).

Additionally, judicial precedents confirm that long-arm jurisdictional statements consistently collapse at sovereign borders when confronting foreign-hosted digital content.

Ultimately, this confirms this article’s central thesis; regardless of its internal efficacy, an isolated domestic regulation will inevitably succumb to a sovereign ceiling and fail to enforce accountability across algorithmic networks beyond its borders.

If this cross-border enforcement crisis is to be effectively and decisively resolved, stakeholder nations must move beyond fragmented national legislation toward a multilaterally binding convention. Such an international framework must harmonize jurisdictional standards in mandating cross-border compliance and establishing mutual legal assistance protocols for an incisive resolution of extraterritorial algorithmic harms involving synthetic media.

Reference(S):

Cases.

Dow Jones & Co Inc v Gutnick [2002] HCA 56, (2002) 210 CLR 575.

Google LLC v Commission nationale de l’informatique et des libertés (CNIL) (Case C-507/17) EU:C:2019:772

Yahoo! Inc v Ligue Contre Le Racisme et l’Antisémitisme (LICRA) 433 F 3d 1199 (9th Cir 2006)

Legislation.

National Digital Economy and E-Governance Bill 2024 (Nigeria), s 12.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) OJ L 2024/1689.

UNESCO, ‘Recommendation on the Ethics of Artificial Intelligence’ (23 November 2021) SHS/BIO/PI/2021/1.

Secondary Sources.

Dow Jones & Co Inc, ‘Dow Jones Statement of Editorial Integrity’ (2020) https://www.dowjones.com

UNESCO, ‘UNESCO’s Recommendation on the Ethics of Artificial Intelligence’ (UNESCO, 2021) <https://www.unesco.org/en/artificial-intelligence/recommendation-ethics> accessed 23 July 2026.

Federal Ministry of Communications, Innovation and Digital Economy, ‘Strategic Blueprint’ (FMCIDE, 2023) https://fmcide.gov.ng

^[1] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) OJ L 2024/1689.

^[2] UNESCO, ‘Recommendation on the Ethics of Artificial Intelligence’ (23 November 2021) SHS/BIO/PI/2021/1.

^[3] National Digital Economy and E-Governance Bill 2024 (Nigeria), s 12

^[4] ibid

^[5] UNESCO, ‘UNESCO’s Recommendation on the Ethics of Artificial Intelligence’ (UNESCO, 2021) <https://www.unesco.org/en/artificial-intelligence/recommendation-ethics> accessed 23 July 2026

^[6] Google LLC v Commission nationale de l’informatique et des libertés (CNIL) (Case C-507/17) EU:C:2019:772

^[7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1

^[8] Dow Jones & Co Inc, ‘Dow Jones Statement of Editorial Integrity’ (2020) https://www.dowjones.com

^[9] Dow Jones & Co Inc v Gutnick [2002] HCA 56, (2002) 210 CLR 575

^[10] Yahoo! Inc v Ligue Contre Le Racisme et l’Antisémitisme (LICRA) 433 F 3d 1199 (9th Cir 2006)

^[11] Federal Ministry of Communications, Innovation and Digital Economy, ‘Strategic Blueprint’ (FMCIDE, 2023) https://fmcide.gov.ng