As a consultancy firm specializing in legal, governance and corporate services, Akira Consult Ltd is committed to helping businesses of all sizes navigate the complex regulatory landscape and minimize any legal and reputational risk that may distract from the business competing effectively in the ever changing business environment.
First, congratulations to the Central Bank of Kenya. From the “test and learn” approach that let mobile money flourish to early guidance on cybersecurity and climate risk, CBK has long led on new governance frontiers. Its draft Guidance Note on AI continues that tradition, even anticipating agentic AI.
The timing couldn’t be better for AI Governance Professionals like us and every bank in Kenya. CBK’s 2025 survey of its licencees shows adoption racing ahead of governance. Among banks:
→ 66% have adopted AI, yet only 29% have an AI strategy and 36% an AI policy
→ 68% use generative AI tools; 40% partner with third-party vendors
→ 92% see AI’s future in credit risk assessment, yet only 56% have explainable models
→ 84% say AI has improved their performance
The draft guidance note on Artificial Intelligence for the Banking Sector counts credit denial as a “critical decision”, which customers can ask a human to review and explain. It also classifies agentic AI as high risk and which requires enhanced governance.
Patricia Wanjama has had the privilege of training bank Boards of Directors, management and staff to build AI literacy: the risks (bias, privacy, hallucination, shadow AI) and the rules of responsible use. The draft affirms this, making Boards responsible for AI training at every level, their own training being a must-do as part of the Board’s Training Plan.
But literacy is the foundation, not the destination. Next comes guided adoption, and with the CBK draft AI guidelines as our compass. The highlights are:
💡 Form a Board view on how the bank will use AI, including the permissible and prohibited uses
💡 Develop an AI strategy anchored in data governance, which the draft calls “the foundation of AI”.
💡 Draft the required policies: Data Governance and AI policies (the annexes in the draft guidelines set minimum contents) and an AI Risk Management Framework.
💡 Consider a Board Technology and Innovation Committee overseeing data and AI governance, supported by the management-level Data Governance, AI Governance and independent Model Risk committees.
💡 Mandate management to update risk frameworks: embed AI in enterprise risk management, inventory every AI system, and prepare to report material AI incidents to CBK within 24 hours.
Why act now? The draft proposes CBK approval before AI systems are deployed, with a checklist asking for these very strategies, policies and committee terms of reference.
Banks already using AI would owe CBK an AI register if and when the Note takes effect. In short: governance before deployment.
CBK has provided the compass. The journey belongs to each Board.
If your Board is ready to move from AI awareness to guided adoption, let’s talk.
hashtag#AIGovernance hashtag#CorporateGovernance hashtag#RiskManagement hashtag#Banking hashtag#Kenya