Building an AI Governance Program in Kenya: A Boardroom Guide

Across Kenya and East Africa, organisations are moving from asking whether they should use artificial intelligence to asking how they should govern it. An AI governance program in Kenya is now a board-level conversation, not an IT initiative. Banks, fintechs, SACCOs, insurers, manufacturers, NGOs, and public sector entities are all confronting the same question: how do we capture the value of AI while managing the risks it introduces?

For boards, the question has a defensibility dimension. When a regulator, customer, donor, or external auditor asks how the organisation oversees AI use, leaders need a credible answer. A well-designed AI governance program in Kenya provides that answer. It defines who is accountable, what controls are in place, how risks are assessed, and how performance is monitored over time.

This article sets out what an AI governance program in Kenya should cover, the regulatory and standards anchors organisations should align to, and a practical 90-day approach for standing one up. It draws on the Data Protection Act, 2019, the Kenya Standard KS 3007:2025 on AI applications, the National AI Strategy 2025-2030, and international frameworks including ISO/IEC 42001 and the NIST AI Risk Management Framework.

Why an AI Governance Program in Kenya Has Become a Boardroom Priority

Three forces have moved AI governance from the IT department to the board table. The first is regulatory direction. The National AI Strategy 2025-2030 sets out Kenya’s ambition to become a leading AI economy and signals that organisational AI governance will increasingly be expected. The Kenya Bureau of Standards has published KS 3007:2025, a Code of Practice for AI applications that gives organisations a national reference point. The Data Protection Act, 2019 already restricts decisions made solely by automated means where they produce significant effects on individuals, and the Office of the Data Protection Commissioner is actively supervising compliance.

The second force is sectoral expectations. The Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority, and the SACCO Societies Regulatory Authority have all signalled that AI-enabled decision-making in their respective sectors will be subject to existing prudential, conduct, and consumer protection rules. Banks deploying AI in credit scoring, fintechs using machine learning for fraud detection, insurers applying algorithms to underwriting, and SACCOs piloting member analytics are all subject to oversight today.

The third force is commercial. Customers, investors, donors, and counterparties increasingly want assurance that AI is being used responsibly. For export-oriented manufacturers and service providers, European customers ask about alignment with the EU AI Act. For NGOs and public benefit organisations, donors ask about responsible AI in programme delivery. For listed companies, investors ask about AI risk disclosure. An AI governance program in Kenya is now part of how organisations earn and keep trust.

What an AI Governance Program in Kenya Actually Covers

At its core, an AI governance program in Kenya is a set of interlocking components: principles, policies, roles, controls, and oversight mechanisms. Each component has a distinct purpose, and together they create a framework that boards and management can rely on.

AI Principles and Policy

The starting point of any AI governance program in Kenya is a short, clear set of principles that articulate how the organisation will use AI. Common principles include human oversight, fairness, transparency, accountability, privacy, and safety. These principles translate into a written AI policy that establishes what is permitted, what requires approval, and what is prohibited. The policy is approved by the board and applies across business units, geographies, and third-party arrangements.

Roles, Accountabilities, and the AI Ethics Committee

Clear accountabilities sit at the heart of an effective AI governance program in Kenya. Most organisations designate an executive sponsor (often the CEO, COO, or CIO), a working-level AI governance lead, and a multidisciplinary AI Ethics Committee that reviews higher-risk use cases. The committee typically draws from compliance, risk, legal, IT, data, and the business. Internal audit attends in an observer capacity to maintain independence.

Model Lifecycle Controls

Every AI system in the organisation moves through a lifecycle: idea, design, development, testing, approval, deployment, monitoring, and retirement. The AI governance program in Kenya defines the controls applied at each stage. These include risk classification on entry, data quality and consent checks before training, bias and performance testing before approval, documented sign-off before deployment, and continuous monitoring once live.

Risk Tiering and Approval Gates

Not all AI systems carry equal risk. A chatbot answering generic product questions sits at a different level from a credit scoring model approving loans, a fraud detection algorithm flagging customer transactions, or a recruitment tool screening job applicants. An AI governance program in Kenya tiers each use case – typically into minimal, limited, high, and unacceptable risk – and assigns approval authority accordingly. Minimal-risk use cases proceed at the line level; high-risk ones require Ethics Committee or board approval.

Monitoring, Audit, and Board Reporting

Once deployed, AI systems are monitored for drift, bias, performance degradation, and incidents. The AI governance program in Kenya defines what is monitored, by whom, and how exceptions are escalated. Internal audit periodically tests the framework’s effectiveness, and the board receives regular reporting – typically quarterly – on the AI portfolio, key risks, incidents, and remediation status.

The Regulatory and Standards Anchors for an AI Governance Program in Kenya

An AI governance program in Kenya is grounded in a specific set of anchors that boards and management can point to as the basis for their framework.

KEBS KS 3007:2025

The Kenya Bureau of Standards has published KS 3007:2025 as a Code of Practice for AI applications. The standard is voluntary, but it provides a Kenyan reference point that organisations can adopt, adapt, and demonstrate alignment to. It addresses governance, risk management, transparency, fairness, security, and incident handling across the AI lifecycle. Aligning the AI governance program in Kenya to KS 3007:2025 gives the framework local legitimacy and a defensible position with national counterparties.

The Data Protection Act, 2019

The Data Protection Act, 2019 already shapes AI governance in Kenya. Section 35 of the Act restricts decisions made solely on automated processing where they produce legal or significant effects on a data subject, requiring human intervention, the right to express a view, and the right to contest the decision. The Act also requires Data Protection Impact Assessments for high-risk processing, a category that captures most consequential AI use cases. The Office of the Data Protection Commissioner supervises compliance and has issued guidance that applies directly to AI systems handling personal data.

Sectoral Guidance from CBK, CMA, IRA, and SASRA

While Kenya does not have AI-specific sectoral regulations, the existing prudential and conduct guidance from sector regulators applies to AI-enabled processes. The Central Bank of Kenya expects banks and microfinance institutions to apply existing ICT risk management, outsourcing, and consumer protection rules to AI systems. The Capital Markets Authority looks at algorithmic trading and AI-driven advisory services through its market conduct lens. The Insurance Regulatory Authority and the SACCO Societies Regulatory Authority apply the same logic to insurers and SACCOs using AI for underwriting, claims processing, member analytics, or credit decisioning.

The National AI Strategy 2025-2030

The National AI Strategy 2025-2030 sets out Kenya’s policy direction for AI adoption. It signals government support for AI investment and emphasises responsible deployment, ethics, and capacity building. Organisations building an AI governance program in Kenya should align their internal language and priorities to the Strategy’s responsible AI principles – it positions them favourably with both regulators and public sector counterparties when partnership opportunities arise.

International Frameworks Worth Mirroring: ISO/IEC 42001 and NIST AI RMF

Beyond local anchors, two international frameworks are shaping how organisations in Kenya structure their AI governance. ISO/IEC 42001:2023 is the first international standard for AI management systems, modelled on the structure of ISO 27001 for information security and ISO 9001 for quality management. Organisations can implement it internally and, in time, seek certification. The NIST AI Risk Management Framework, published by the United States National Institute of Standards and Technology, takes a flexible, risk-based approach focused on governance, mapping, measurement, and management of AI risks.

Many Kenyan organisations adopt a hybrid approach: ISO 42001 for structure and certifiability, NIST AI RMF for risk-management depth, and KS 3007:2025 for local alignment. An AI governance program in Kenya built on these foundations travels well across jurisdictions and stands up to scrutiny from international partners, lenders, and donors.

How to Stand Up an AI Governance Program in Kenya in 90 Days

For most organisations, an AI governance program in Kenya can be stood up in a focused 90-day effort, organised into three phases.

Phase one (weeks one to four) is discovery and design. The team inventories existing and planned AI use cases across business units, vendors, and embedded systems. It drafts the AI policy, principles, and risk tiering criteria. It defines roles, the AI Ethics Committee charter, and the approval pathway.

Phase two (weeks five to eight) is calibration and approval. The draft framework is socialised with the business, risk, compliance, legal, IT, and data functions. Risk tiers are tested against the inventoried use cases to ensure they produce sensible outcomes. The board approves the AI policy and the Ethics Committee receives its first batch of cases for review.

Phase three (weeks nine to twelve) is operationalisation. Monitoring routines are established, model documentation templates are issued, training is rolled out to high-touch teams, and the first quarterly board report is drafted. By the end of the 90 days, the organisation has a working AI governance program in Kenya – not a perfect one, but one that is functioning and can be improved over the following year.

Common Pitfalls Boards Should Watch For

Three pitfalls recur across organisations standing up their first AI governance framework. The first is treating governance as a documentation exercise rather than a decision-making framework. A policy that lives in a shared drive but does not change which AI investments get approved is a policy in name only. Boards should ask how many use cases have actually been routed through the approval pathway and what decisions resulted.

The second pitfall is excluding the business from the governance design. AI governance designed by risk, compliance, or IT alone tends to be either too restrictive (slowing experimentation and innovation) or too permissive (missing real risks). The Ethics Committee should include business voices so that risk tiers and approval gates reflect commercial realities while still protecting the organisation.

The third pitfall is neglecting third-party AI. Most organisations do not build AI from scratch – they consume it through SaaS platforms, ERP systems, and analytics vendors. An AI governance program in Kenya that does not address vendor AI, embedded AI in cloud services, and AI features in productivity tools misses a significant share of the actual AI footprint. Vendor due diligence and contractual AI clauses should be part of the framework from day one.

How FNJ & Associates Helps Organisations Build an AI Governance Program in Kenya

FNJ & Associates supports organisations across banking, fintech, SACCOs, insurance, manufacturing, NGOs, and the public sector in Kenya to design, implement, and refine their AI governance programs. Our advisory approach is grounded in ISO/IEC 42001, the NIST AI Risk Management Framework, KEBS KS 3007:2025, and sectoral guidance, and is tailored to the size, sector, and AI maturity of each client.

For directors and senior management, our AI governance training for boards explains what to approve and what to ask management.

We help boards approve a workable AI policy, set up Ethics Committees that function effectively, design risk tiers that fit the organisation’s actual use cases, and build the monitoring routines that keep the program alive after the 90-day stand-up. Through the Trigarc GRC Suite, implemented by FNJ, we also help operationalise the AI governance program in Kenya within a single platform – tracking the AI inventory, controls, incidents, and board reporting in one place.

Frequently Asked Questions

Does every organisation in Kenya need an AI governance program?

Any organisation using AI – whether built in-house, purchased from vendors, or embedded in SaaS platforms – benefits from a proportionate AI governance program. The size and formality of the program scale with the organisation’s AI footprint and risk profile, but the core elements (policy, accountabilities, model inventory, and monitoring) apply across banking, fintechs, SACCOs, insurance, NGOs, manufacturing, and the public sector.

How does AI governance differ from existing IT or data governance?

IT governance covers technology infrastructure and IT controls. Data governance covers data quality, ownership, and lifecycle. AI governance addresses the specific risks of AI systems, including model bias, explainability, drift, fairness, and the consequences of automated decisions. While AI governance draws on existing IT and data structures, it adds dedicated controls and oversight that the other frameworks do not provide on their own.

Who should lead the AI governance program in Kenya?

Most organisations assign executive sponsorship to the CEO, COO, or CIO, with day-to-day leadership held by a senior compliance, risk, or technology officer. An AI Ethics Committee provides cross-functional oversight, drawing from compliance, risk, legal, IT, data, and the business. Internal audit operates independently to provide assurance over the framework’s effectiveness.

How often should the AI governance program be reviewed?

At minimum, the AI governance program should be reviewed annually by the board, with quarterly management reporting on the AI portfolio, incidents, and emerging risks. Because AI use evolves rapidly, many organisations also conduct interim reviews when new high-risk use cases are introduced or when there are major regulatory or technology developments.

Can FNJ & Associates help us design our AI governance program?

Yes. FNJ & Associates designs and implements AI governance programs across the financial services, manufacturing, NGO, and public sectors in Kenya and East Africa. Our service includes use-case discovery, policy design, Ethics Committee setup, risk tier calibration, training, and operationalisation through the Trigarc GRC Suite. Contact us via fnjassociates.co.ke or [email protected] to schedule a consultation.