- Home
- Sectors
- Technology, Data and AI
- AI and Model Risk Governance for Financial Institutions
Flagship · Technology, Data and AI
AI and Model Risk Governance for Financial Institutions
Model risk and AI governance frameworks for banks, SACCOs, insurers and lenders, built to meet Central Bank of Kenya, SASRA and IRA expectations.
- Sector
- Technology, Data and AI
- Typical timeline
- 10 to 14 weeks
- Delivery
- Onsite or virtual
- Deliverables
- 6
The problem
Kenyan finance runs on models. The Central Bank of Kenya's 2025 survey of 125 banks, microfinance banks, credit reference bureaus and digital credit providers found that half had adopted AI, with credit risk assessment the leading use, yet most respondents had no AI strategy and most adopters had no AI policy. Data quality, third-party dependence and AI governance ranked among the risks institutions themselves reported. When a scoring model declines a borrower or a fraud model freezes an account, the board remains accountable for the outcome.
Supervisory expectations are now explicit. The Business Laws (Amendment) Act, 2024 brought all non-deposit-taking credit providers under CBK licensing, and the implementing regulations require human oversight, explainability and bias controls where lenders use AI. CBK's consultation on revised prudential guidelines and guidance notes, including a draft note on AI in banking, closes on 7 November 2026. Decisions on personal data remain subject to the Data Protection Act, 2019, including its limits on solely automated decisions, and SACCOs and insurers answer to SASRA and the Insurance Regulatory Authority.
Policy anchors
- Business Laws (Amendment) Act, 2024
- CBK Survey on Artificial Intelligence in the Banking Sector (2025)
- CBK draft revised Prudential Guidelines, Risk Management Guidelines and Guidance Notes (2026)
- Data Protection Act, 2019
- Sacco Societies Act, 2008
How we work
Model inventory
We catalogue every model and AI system in use, from credit scoring and fraud detection to e-KYC and customer service tools, with owners, vendors, data sources and the decisions each one drives.
Risk tiering
We classify models by materiality and customer impact, so that validation effort and board attention match the risk each model carries.
Validation and fairness testing
We review model design, performance, stability and explainability, and test outcomes for bias across customer groups using the institution's own data.
Governance framework
We draft the model risk and AI policy, define board and management responsibilities, set human review points for adverse decisions and specify vendor oversight.
Supervisory readiness
We map the framework to CBK, SASRA or IRA expectations and the Data Protection Act, 2019, and prepare the board and management for supervisory engagement.
- Model and AI system inventory with risk tiers
- Model risk and AI governance policy for board approval
- Independent validation and fairness testing reports
- Human oversight and customer recourse procedures for automated decisions
- Due diligence checklist for third-party AI vendors
- Board briefing and supervisory readiness pack
Boards, chief risk officers and compliance heads of commercial and microfinance banks, deposit-taking SACCOs, insurers and non-deposit-taking credit providers.
Questions clients ask
Has CBK issued binding rules on AI?
Non-deposit-taking credit providers now face explicit requirements on human oversight, explainability and bias where they use AI. For banks, CBK put draft revised prudential guidelines and guidance notes out for consultation in September 2026, after the institutions it surveyed asked for AI guidance. Building the framework now puts you ahead of the final text.
We buy our scoring model from a vendor. Is it still our risk?
Yes. Outsourcing a model does not outsource accountability to the customer or the supervisor. CBK's survey identified third-party dependence as a leading AI risk, and our framework sets the documentation, testing rights and exit terms you should require from vendors.
Does this cover SACCOs?
Yes. Deposit-taking SACCOs are licensed and supervised by SASRA under the Sacco Societies Act, 2008. We scale the framework to the size and complexity of the society, keeping the same principles of inventory, testing and human review.