Why governing AI can no longer wait for the law that will eventually require it.
Download PDFArtificial intelligence has moved from pilot project to production system inside many Kenyan institutions faster than governance structures have kept pace. Credit scoring, diagnostic support, fraud detection and customer service now routinely run on models that few Boards could describe in detail, let alone audit.
Kenya’s regulatory framework for AI is still taking shape, but the absence of a dedicated statute does not mean the absence of exposure. Existing obligations around fairness, accountability, data protection and consumer harm already reach into how AI systems are built, bought and deployed.
Boards that wait for legislation before establishing AI oversight will, by the time it arrives, be retrofitting governance onto systems already embedded in daily operations. The more defensible position is to govern now, on the assumption that regulation will simply formalise a standard already being met.
An algorithm that scores a loan application, flags a fraudulent transaction, or triages a patient is making decisions that used to sit with a trained employee — decisions that carried accountability, a paper trail, and a person who could explain the reasoning.
When a model makes that decision instead, the accountability does not disappear. It moves, by default, to whoever deployed the system: the institution, and ultimately its Board.
An institution that cannot explain how its AI system reached a decision has not automated a process. It has outsourced its judgment to a system it does not fully understand.
Kenya’s draft AI legislation signals an intent to regulate AI systems according to the risk they pose, echoing the approach taken in the EU’s AI Act and discussed in global forums such as the UN’s dialogue on AI governance. The details will continue to be negotiated, but the direction of travel — tiered obligations rising with the sensitivity of the use case — is consistent across jurisdictions now legislating in this space.
Institutions using AI in credit decisions, healthcare diagnostics or biometric identification should assume they will eventually sit in a higher-obligation tier, whatever the final statute says, because that is where comparable frameworks elsewhere have placed those use cases.
03Ask most Boards to name every AI system currently in production, including the ones embedded inside vendor platforms, and the honest answer is usually incomplete. That gap — not knowing what is running, rather than knowing and choosing to accept the risk — is the more urgent problem, because it cannot be managed if it is not first inventoried.
05Every Board should be able to put the following questions to management, and expect a considered answer:
Can we name every AI system currently in production, including those embedded in vendor platforms?
Who is accountable when an automated decision is wrong?
Is there a human in the loop for decisions that materially affect a customer or patient?
Do we have a policy governing staff use of generative AI tools?
How was each material model trained, and have we validated it ourselves or only trusted the vendor?
What would we do if a regulator asked us to explain a specific automated decision?
Is AI governance reviewed by the Board, or delegated entirely to the technology team?
Regulation will eventually catch up to where AI already operates inside Kenyan institutions. Boards that govern ahead of that curve will meet the coming framework as a formality; those that wait will meet it as an audit.
“Could your Board name every material AI system currently making decisions about your customers or patients?”
If the honest answer is “not fully,” that inventory — not the eventual statute — is where oversight should begin.
We help leadership teams understand, govern and continuously improve Digital Trust through structured, evidence-based advisory engagements.
A short monthly briefing from the Kenya Privacy Law Review — new ODPC determinations, guidance notes, and compliance deadlines. No spam, unsubscribe anytime.