By Peter Odupoy
To many organisations, “AI governance” is still just a website page. You will find there a list of ethics principles put to the board for approval such as fairness, oversight and transparency which are admired for a moment and then never put to the test. It is a form of reassurance, not control.
Those days are numbered. The kind of governance a board can put on paper no longer holds the same weight as what it can show; the next person to come asking how your AI makes its calls may well have the statutory authority to look under the hood.
By tabling the Artificial Intelligence Bill, Kenya is turning the soft talk of ethics into something with legal teeth. In part modelled on the EU’s AI Act, the legislation puts systems in one of four risk boxes: from minimal to unacceptable. The high-risk ones in sectors like finance, healthcare or public administration get the brunt of the new duties.
Take a high-risk system and the Bill demands pre-deployment impact assessments on human rights and risk, and an explanation for any automated decision. Most importantly for directors, you must be able to produce records of performance and inputs and outputs going back five years. There is also a new AI Commissioner with the power to fine you, issue notices and inspect your work.
You might also like
Bowmans would caution that some of the finer points of classification are yet to be spelt out in regulations, and even limited-risk systems have disclosure requirements. But make no mistake about the trajectory: when Nairobi legislates, the rest of the continent has a habit of following. If you build to the Kenyan standard you are building for Africa.
The sceptic has a point. Can you really expect enforcement from an emerging-market regulator that is short on resources? A new commissioner’s office takes time to get up to speed. CIPESA puts it bluntly: “Kenya does not have an AI regulation gap. It has an accountability gap.” The real issue is how we govern the institutions meant to be governing AI.
You could be forgiven for thinking that gives you leave to wait. Don’t. That is a strategic blunder. Your liability doesn’t stop at the regulator. When an AI misprices a policy or turns away an applicant, the aggrieved party will sue and the customer will walk, without waiting for the Commissioner. And if an inspection comes round, you can’t conjure up five years of records you didn’t keep.
A board needs to move from the claim of being responsible to the capability of showing it. Here is a blueprint for doing so. First, get your paper trail in order. Make an inventory of every AI system you have, whether you built it or it came in a vendor’s package, and classify them. For the higher risk ones, maintain contemporaneous records of the data and the model’s decisions that will stand up to scrutiny.
Secondly, ensure your algorithms can be audited. Any system of consequence should be able to tell you in plain terms why it decided; if you can’t explain it to a court or a customer, you can’t defend it. Have independent tests done for bias and accuracy and file the results.
And thirdly, put a name to it. One director should be answerable to the audit or risk committee for AI, just as they are for cyber or financial risk. Tie your AI governance to the Data Protection Act of 2019 so you aren’t duplicating work.
In the end, AI governance is treading the same ground data protection did a few years back: it has gone from a policy nobody bothered with to a necessity. Boards that see the 2026 Bill as an annoyance will be busy reacting in the next cycle. The ones with evidence to back up their claims will win over customers and deal with the regulator on their own terms.
The age of slogans is done. What you need now is unglamorous and auditable. In the end, the organisation that can prove how its machines decide will beat the one that can only make promises.
The writer is an experienced Tech leader, accelerating Africa’s digital future with AI, Strategic Innovation and Resilient Growth.
