CBK draft Guidance Note on Artificial Intelligence in the Banking Sector

What it is

The draft Guidance Note on Artificial Intelligence in the Banking Sector is the Central Bank of Kenya’s proposed rulebook for AI in the institutions it licenses. It is dated August 2026 and CBK published it on 10 September 2026, together with draft revised prudential guidelines, risk management guidelines, a guidance note on third-party technology service providers and a framework for domestic systemically important banks. CBK invited comments from the public until 7 November 2026.

The note is issued under section 57(1) of the Central Bank of Kenya Act, section 33(4) of the Banking Act and section 48(2A) of the Microfinance Act. It links itself to the Kenya National AI Strategy 2025 to 2030 and to the Data Protection Act 2019.

Who it applies to

As drafted, the note applies to institutions licensed under the Banking Act and the Microfinance Act, to credit reference bureaus, money remittance providers and non-deposit-taking credit providers licensed under the Central Bank of Kenya Act, and to non-operating holding companies.

What it requires

Board and committees

The board holds ultimate responsibility for the ethical development and use of AI. It approves a data governance strategy, policy and framework, an AI strategy, an AI policy with the contents in Annex II, and an AI risk management framework that sets risk tolerance and appetite. It decides the permitted and prohibited uses of AI. The draft calls for a data governance committee, an AI governance committee and a model risk committee independent of the teams that build and run models, and for independent review and audit at least once a year. External auditors report annually to the board and CBK on the findings of AI audits.

Risk management and models

Institutions run an AI risk management life cycle of identification, assessment and classification, treatment, monitoring, reporting and periodic review, inside the enterprise risk framework. They keep an inventory of all AI systems and models, validate them independently and review them periodically, with the model risk committee covering bias and fairness baselines, explainability, stress testing, model updates and supply chain risk to fourth and nth parties.

Before deployment

Section 4.7 says institutions shall seek CBK approval before deploying AI systems, in writing and with the Data Governance and Artificial Intelligence Checklist in Annex III. Institutions must also carry out bias impact assessments before deployment, take a fairness-by-design approach and test, validate and security-test systems before and after deployment with a human in the loop.

Generative and agentic AI

Generative AI needs acceptable use policies, output validation and human review, controls on hallucination and prompts, and baseline metrics for factual consistency, and material decisions must not rest solely on unverified AI outputs. An agentic system that can initiate actions, interact with external systems, execute transactions or materially affect operations is classified as high-risk. It must operate within predefined authority limits, stay subject to human oversight with the ability to intervene, suspend or terminate it, keep complete audit logs of material actions and decisions, and be continuously monitored.

Customers

Customers must be told when they are interacting with an AI system, at the start of the interaction. On request, institutions must explain the data, variables and factors that inform AI decisions. Customers have the right to request human review of significant adverse AI decisions by a person with authority, training and access to the data and logic used, and to receive the reasoning behind the outcome. Institutions need complaint channels and a register of AI-related complaints.

Reporting to CBK

Part V asks for an annual register of AI models, systems and services in the Annex IV format, submitted when the note takes effect and then by the fifth day after each financial year. Institutions notify CBK within 24 hours of an AI incident that materially affects service availability, confidentiality or integrity, or could significantly affect services, reputation or financial condition. They file a final report within 24 hours of resolving a critical incident and a quarterly report on AI incidents.

Key dates

• August 2026. Date on the draft Guidance Note.
• 10 September 2026. CBK publishes the draft for public comment.
• 7 November 2026. Comments close.

How it relates to other frameworks

The draft is one of the most prescriptive supervisory texts on AI anywhere. Its board ownership, model inventory and independent validation follow the same lines as Singapore’s MAS guidelines on AI risk management and US model risk guidance. The prior approval requirement for deploying AI and the 24-hour AI incident reporting go further than either. Its human review right for customers builds on section 35 of the Data Protection Act, and its data governance requirements sit alongside the ODPC’s draft AI guidance note.

A note on this page

This is Aicura’s reading of the CBK’s draft Guidance Note on Artificial Intelligence. It is not legal or prudential advice, and the final version may differ. Read the draft as published by CBK, and discuss how it applies to your institution with your advisers and your supervisor.