Nigeria's digital regulatory framework entered a new phase on February 13, 2026, when the Nigerian Communications Commission (NCC) activated the Internet Code of Practice 2026. The new code, issued under Section 70 of the Nigerian Communications Act 2003, supersedes the 2019 version and reflects how much the country's internet landscape has evolved.
The NCC also released Guidance Notes to accompany the 2026 Code, clarifying what regulators expect from operators and setting out implementation timelines. These notes sit beneath the code itself and must be read together with it.
From a policy standpoint, the 2026 Code shows the NCC shifting toward more assertive regulation. Yet success hinges on how well regulated entities understand their obligations, their capacity to implement changes, and whether enforcement remains consistent across the sector.
This analysis examines the main features of the 2026 Code and its Guidance Notes, focusing on what differs from 2019 and what practical steps telecommunications firms should take now.
The most striking change is how far the regulatory net now extends. The 2019 Code targeted only Internet Access Service Providers, but the 2026 version pulls in "impacted entities"—digital platforms, app developers, and other services running on telecommunications networks affected by the Communications Act 2003.
This broadening matters considerably. It brings digital service providers previously operating with minimal oversight into the NCC's jurisdiction, aligning Nigeria with global patterns where platforms face the same rules as network operators.
Yet a critical gap remains. The code treats licensed operators differently from impacted entities—applying strict enforcement to the former and gentler "soft" governance to the latter.
Without clear dividing lines between collaborative compliance and enforcement action, companies face real uncertainty about their obligations.
Businesses will struggle to judge their actual risk exposure, especially as they grow or add services. The sensible approach, then, is treating all soft obligations as binding ones, given the reputational and regulatory damage non-compliance could trigger.
The code now explicitly aims to align online platforms and digital services with Nigeria's regulatory framework through shared governance rules offering clear operating principles. This is significant because it shows the NCC wants to shape not just infrastructure but also content flows and digital behaviour.
That ambition creates real risks, however. Other regulators—particularly those handling data protection—may claim overlapping authority in these same spaces, producing confusion about who enforces what.
