Preparing for the CBK's AI guidance note as a Kenyan bank or lender

The Central Bank of Kenya published its draft Guidance Note on Artificial Intelligence in the Banking Sector on 10 September 2026, with comments due by 7 November 2026. It is a draft, but it is detailed, and it follows the survey on AI in the banking sector that CBK published in July 2025. This guide turns the draft into the work an institution can start now, so the final version lands on records that already exist.

Start with a complete inventory

Almost every requirement in the draft depends on knowing what AI the institution runs. The annual register in Annex IV lists AI models, systems and services. The model risk committee reviews every model. Prior approval applies to each AI system before deployment. Incident reporting needs to know which system failed.

The inventory has to include AI inside vendor products, not just models built in-house. Credit scoring engines, fraud and AML monitoring, chatbots, document processing, collections tools and code assistants all count, and so do agents that act through other systems. For each, record the purpose, the business owner, the model and provider, the data it uses, the customers or decisions it affects and how much a person is involved. The AI system register guide covers the fields.

Put the governance structure in place

The draft expects the board to approve a data governance strategy, policy and framework, an AI strategy, an AI policy with the Annex II contents, and an AI risk management framework with a defined risk appetite. It also expects the board to decide permitted and prohibited uses of AI. Below the board sit a data governance committee, an AI governance committee and a model risk committee that is independent of the teams that build and run models. Smaller institutions may combine the data and AI committees, but not the independent validation role.

Internal audit assesses the design and effectiveness of the whole framework at least once a year, and external auditors report annually to the board and CBK on AI audits. The board reporting guide covers what directors need to see to carry that responsibility.

Prepare each system for approval

As drafted, an institution applies to CBK in writing before deploying an AI system, with the Data Governance and Artificial Intelligence Checklist in Annex III. The draft also requires a bias impact assessment before deployment and testing, validation and security testing with a human in the loop.

For each system, assemble the record the application will draw on. That means the use case and justification, the risk classification, data sources and quality checks, the validation and security test results, the bias impact assessment and the human oversight design. The ODPC’s draft AI guidance already treats AI credit scoring as high-risk and expects a regular bias audit of model outputs, so the same bias assessment serves both regulators.

Treat agents as high-risk

An agentic system that can initiate actions, interact with external systems, execute transactions or materially affect operations is classified as high-risk in the draft. It must operate within predefined authority limits, not change its own objectives or parameters without authorisation, stay subject to human oversight with the ability to intervene, suspend or terminate it, keep complete audit logs of material actions and decisions, and be continuously monitored.

That means each agent needs a written statement of what it may do, an identity that can be revoked, a kill switch that someone has tested, and a log that shows every material action. The guide to governing AI agents works through each of these.

Build the customer-facing duties

Customers must be told at the start of an interaction when an AI system is handling it. On request, the institution must explain the data, variables and factors behind an AI decision. Customers can ask for a human review of significant adverse AI decisions, carried out by someone with the authority, training and information to change the outcome, and must be told the reasoning afterwards. An AI complaints register feeds analysis of systemic issues and bias.

Those duties sit on top of section 35 of the Data Protection Act, which already requires written notice of solely automated decisions and reconsideration on request. One review process can serve both.

Be ready to report within 24 hours

The draft asks for notice to CBK within 24 hours of an AI incident that materially affects service availability, confidentiality or integrity, or could significantly affect services, reputation or financial condition. A final report follows within 24 hours of resolving a critical incident, and a quarterly report covers all AI incidents. Model failures, unintended outcomes, bias, data leakage, outages and significant performance deterioration all count as AI incidents. Meeting that clock depends on monitoring that detects the problem and an incident process that already knows which system, owner and vendor are involved. The AI incident guide covers the process.

Where Aicura fits

Aicura is an AI governance platform. The AI register holds every system, model and agent with its owner, vendor and the decisions it affects. Assessments record risk classification, bias and impact. Agent records carry authority limits and action logs, guardrails enforce your rules on live traffic, monitoring watches drift and performance, and incidents track each event to a final report. At Pro, assessment against ISO/IEC 42001 and the NIST AI RMF sits on the same records. Aicura does not assess against the CBK draft. It gives you the record the register, the approval checklist and the incident reports draw on, and the decisions stay with you.

Aicura is hosted on AWS in Sydney, Australia. The draft’s third-party guidance and Part VI of the Data Protection Act both apply to that transfer, and our data processing agreement sets out the safeguards.

A note on this page

This is Aicura’s reading of the CBK’s draft Guidance Note on Artificial Intelligence. It is not legal or prudential advice, and the final note may differ. Read the draft as published by CBK, and discuss how it applies to your institution with your advisers and your supervisor.