Share with your CISO
Kenya’s Central Bank has drafted Risk Management Guidelines for 2026 that treat AI not as a tech-team concern but as a material enterprise risk sitting inside existing credit, operational, reputational, and model-risk frameworks. Boards bear ultimate accountability. The Three Lines of Defence, model validation, bias testing, and data governance obligations all extend explicitly to AI systems. Banks that still route AI oversight through an IT steering committee rather than their enterprise risk apparatus are already out of step with where this regulation lands.
What this means for your business
The recurring failure mode in AI governance looks like this: a bank deploys a credit-scoring or fraud-detection model, IT owns the deployment, risk owns the credit portfolio, and nobody owns the seam between them. The CBK guidelines are designed to close that seam by legal force. If your institution operates in Kenya or in any market watching Kenya’s approach, the question isn’t whether AI needs a governance framework. It’s whether the framework you already have for credit and operational risk has been extended to cover AI, or whether AI still lives in a parallel structure that senior risk committees never actually see.
The model risk section is where this gets expensive fast. The guidelines require transparency, explainability, bias testing, and ongoing validation for AI and machine learning models, not just point-in-time approval. That’s a materially higher bar than most banks currently meet for anything beyond their core credit models. A sophisticated fraud-detection model built on a black-box vendor architecture, common across the sector, fails this standard out of the box. CISOs and CDOs need to audit which AI systems are running against customer outcomes right now, because the explainability gap is where regulators will probe first.
Third-party concentration risk deserves attention here. The guidelines flag dependence on external AI providers as a distinct risk category, which means vendor lock-in to a single model provider isn’t just a procurement problem anymore. It’s a reportable risk exposure. Banks that have consolidated AI capability into one cloud provider’s model stack, or one fintech partner’s decisioning engine, will need to articulate that concentration clearly in their risk registers. The CISO who can map AI vendor dependencies to specific risk categories before the examiner asks is in a structurally stronger position than one who discovers the gaps during a supervisory review.
Concept deep-dive: Three Lines of Defence
The Three Lines of Defence is a risk governance model that assigns accountability in layers. The first line is the business unit that owns and operates the activity and its risks. The second line is the independent risk and compliance function that challenges and monitors the first. The third is internal audit, which tests whether the whole system works. Applying this to AI means a fraud model’s business owner, not the data science team, answers for its outcomes, while compliance and audit verify the controls independently.
Based on reporting from CBK Sets New Expectations for AI Risk Management in the Banking Sector, originally published 2026-09-19 06:37:00.
