Choose a Framework
Choose a framework
Select which compliance framework you'd like to run a self-audit against. You can run audits against more than one framework, each tracked and scored separately.
Your FREE plan includes one framework's self-audit, free, with unlimited retakes. Choose Cybercrimes (Prohibition, Prevention, etc.) Act 2015 & 2024 Amendment Self-Audit or NDPA 2023 & GAID Self-Audit.
Once you complete a self-audit against one, upgrading to a paid plan is the only way to also access the other.
AI Governance Self-Audit
ai_governance
A guided self-assessment of how your organisation governs its use of AI and machine-learning systems. Your Nigerian legal baseline is always included: the Data Protection Act 2023 (section 37, automated decision-making), the NDPC's General Application and Implementation Directive (GAID), and the Cybercrimes Act 2015 (as amended 2024). You then choose whether to also be scored against UK GDPR, the international standards (ISO/IEC 42001:2023 and the NIST AI Risk Management Framework), and the EU AI Act. The National AI Strategy (NAIS) is covered as background context, not scored. Your score and gap list only reflect the frameworks you select.
AI System DPIA Questionnaire
Nigeria: Data Protection
A Data Protection Impact Assessment for a single AI system, completed from that system's entry in your AI System Register. Structured to satisfy the DPIA content expectations of the NDPC's GAID (and UK GDPR Article 35 where relevant): a description of the processing, an assessment of necessity and proportionality, the risks to individuals, and the measures that address those risks ending in a documented residual-risk rating and sign-off. Re-run it when the system changes materially.
Cybercrimes (Prohibition, Prevention, etc.) Act 2015 & 2024 Amendment Self-Audit
Nigeria: Cybersecurity
A guided self-assessment against Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as substantially amended in 2024. This is a distinct legal instrument from the NDPA 2023/GAID, with its own reporting channels, obligations, and penalties not a subset of data protection law.
ISO/IEC 27001:2022 Self-Assessment (Information Security Management)
International · Information Security (Voluntary Standard)
A comprehensive self-assessment against ISO/IEC 27001:2022, the current international standard for Information Security Management Systems (ISMS). The 2013 version's transition deadline passed 31 October 2025, so 2022 is now the sole valid edition, referenced throughout including its 2024 environmental amendment. Unlike the other frameworks on this platform, ISO 27001 is a VOLUNTARY standard, not a law. However, it is important for organizations that takes security seriously and is serious about proving this to clients, investors and other stakeholders as well as win their trust and confidence. This assessment measures alignment and certification readiness, not legal compliance. Covers all 7 management system clauses and all 4 Annex A control themes.
ISO/IEC 42001:2023 Self-Assessment (AI Management System)
International · AI Management (Voluntary Standard)
A self-assessment against ISO/IEC 42001:2023, the international standard for AI management systems. Like ISO 27001, it is a voluntary standard, not a law: it shows clients, partners and investors that you develop, provide or use AI responsibly, and can lead to certification. This assessment measures alignment and certification readiness. It covers clauses 4 to 10 and all 38 Annex A controls, and builds your ISO 42001 Statement of Applicability.
NDPA 2023 & GAID Self-Audit
Nigeria: Data Protection
A guided self-assessment against Nigeria's Data Protection Act 2023 and the NDPC's General Application and Implementation Directive (GAID) 2025, which took effect 19 September 2025 and now governs implementation alongside the Act. Built for SMEs with no in-house compliance team.
NIST AI Risk Management Framework 1.0 Self-Assessment
United States · AI Risk Management (Voluntary Framework)
A self-assessment against the NIST AI Risk Management Framework 1.0 (NIST AI 100-1), the US National Institute of Standards and Technology's voluntary framework for managing the risks of AI. It is widely used as a structure for AI governance and to show partners and buyers that your AI risks are managed. It covers the four functions of the AI RMF Core (Govern, Map, Measure, Manage) and builds your NIST AI RMF control register.
UK GDPR & Data Protection Act 2018 Self-Audit
United Kingdom: Data Protection
A guided self-assessment against UK GDPR, as retained under the European Union (Withdrawal) Act 2018, given effect by the Data Protection Act 2018, and substantially amended by the Data (Use and Access) Act 2025 (DUAA) including a mandatory complaints handling requirement that only took effect 19 June 2026. Built for SMEs with no in-house compliance team.