CBK AI Guidance Note: What Kenyan Banks Must Do Now

Kenya's Central Bank published its first dedicated AI rulebook for banks on 10 September 2026, and it changes the order of operations for every AI project in a Kenyan financial institution: approval from the regulator comes before deployment, not after. The Draft Guidance Note on Artificial Intelligence in the Banking Sector is still a draft, with public comments closing 7 November 2026, but the direction is unmistakable and the institutions that start preparing now will not be scrambling when the final version lands. This post breaks down what the draft actually requires, how it interacts with the Data Protection Act and the ODPC's own AI guidance, and a practical 90-day plan to get ready.

What CBK published and when it takes effect

The AI guidance note did not arrive alone. It sits inside a larger consultation package that includes revised Prudential Guidelines, revised Risk Management Guidelines, a draft Guidance Note on Cybersecurity, a draft Guidance Note on Third-Party Technology Service Providers, and a framework for domestic systemically important banks. That packaging matters: CBK is treating AI as supervisory material, examined alongside the frameworks it already uses to inspect banks, not as a standalone statement of principles.

Two dates govern everything else:

• 10 September 2026. The package was published and public participation opened.
• 7 November 2026. Comments close. Submissions go to fin@centralbank.go.ke using the template on the CBK website, under the subject line set out in the public notice.

It is a draft. Wording can change after consultation. But drafts from CBK's Bank Supervision Department rarely get weaker between consultation and final issue, and this one is already the strictest pre-deployment AI regime in East Africa. The Standard's review found no major jurisdiction that currently imposes a pre-approval requirement of this kind on financial institutions.

Why CBK is moving now: adoption outran governance

The draft is a response to CBK's own data. In July 2025 the regulator published its Survey on Artificial Intelligence in the Banking Sector, covering 37 commercial banks, one mortgage finance company, 14 microfinance banks, three credit reference bureaus and 70 digital credit providers. The findings explain the urgency:

• Half of all licensed institutions had adopted AI, including 66 per cent of commercial banks.
• The top applications were credit risk assessment (65 per cent), cybersecurity (54 per cent), customer service (43 per cent), electronic know-your-customer (41 per cent) and fraud risk management (40 per cent).
• Governance lagged badly: only 29 per cent of banks had an AI strategy and 36 per cent an AI policy, even though 68 per cent were already using generative AI tools and 40 per cent relied on third-party AI vendors.
• Only 56 per cent of banks using AI said their models were explainable.
• 92 per cent of commercial banks, and every microfinance bank and credit reference bureau surveyed, asked CBK to issue AI guidance.

The practical stakes are already large. The Standard reported that one tier-one lender uses machine learning models to score borrowers and approve mobile loans at a rate of Sh1.5 billion a day. When automated decisions move that much money daily, a regulator that waits for failures before writing rules is taking a risk CBK clearly decided not to take.

The six requirements that matter most

1. Written approval before deployment

The core sentence of the draft is short: institutions shall seek approval of the Central Bank before deployment of AI systems. The application must be in writing and accompanied by the Data Governance and Artificial Intelligence Checklist in Annex III, which asks for:

• Data sources and evidence that training data is representative of the real-world scenario the system will operate in
• Bias testing by location, gender and age, with testing on real-world data
• Security testing and model validation results
• Decommissioning plans for the system

Read that list again. A bank cannot file a credible Annex III application without a data governance framework, a bias testing methodology and a model validation process already in place. The checklist is the compliance programme, worn on the outside.

2. Human review for critical decisions

Any AI-driven outcome with a significant legal, financial or similarly substantive effect on a customer triggers a right to human review. The draft names the categories explicitly: credit denial, fraud flagging, account freezing and pricing adjustments. Customers can ask a human to review and explain the decision. Banks running fully automated mobile lending or automated account freezes will need a staffed review path, with turnaround times and explanation standards, before the note takes effect.

3. Agentic AI is classified high risk

Any agentic AI system, meaning one capable of independently initiating actions, interacting with external systems, executing transactions or materially affecting the institution's operations, is classified as high risk and subjected to enhanced governance and independent review. The draft is specific about what such systems must do:

• Operate within predefined authority limits
• Never modify their own objectives or operating parameters without authorisation
• Resist unauthorised access and manipulation
• Keep complete audit logs of material actions
• Stay subject to continuous monitoring, demonstrated human oversight, and the ability to suspend or terminate

This is the most forward-looking line in the document. An AI agent that reconciles accounts, moves money between ledgers, or answers customers on WhatsApp with the ability to initiate transfers sits squarely inside this definition.

4. Generative AI gets explicit guardrails

Banks using generative AI must adopt acceptable use policies, validate outputs, manage hallucination risk, establish baseline metrics for factual consistency, and ensure material decisions are not based solely on unverified AI outputs. Given that 68 per cent of surveyed banks already use generative AI tools, this clause alone reaches most of the sector, including staff use of public chatbots on bank data.

5. A 24-hour incident clock

CBK must be notified within 24 hours of any AI incident that materially affects service availability, confidentiality or integrity, or that could significantly harm customers, reputation or financial condition. A final report follows within 24 hours of resolution, and quarterly incident summaries are due by the fifth day after each quarter ends. That clock starts when the incident is detected, not when the root cause is understood, so detection and escalation paths have to be built and rehearsed in advance.

6. The board owns it

The draft places ultimate responsibility for the ethical development and use of AI on the board of directors. Boards must approve a Data Governance Strategy, Data Governance Policy, Data Governance Framework, AI Strategy, AI Policy and AI Risk Management Framework; establish a Data Governance Committee and a Model Risk Committee that is independent of the teams building and operating models; commission an independent audit of AI systems at least once a year; and complete AI training themselves as part of the board training plan. Institutions already running AI will also owe CBK an AI register when the note takes effect.

The ODPC layer you cannot ignore

CBK is not the only regulator in the room. In July 2026 the Office of the Data Protection Commissioner issued its own Guidance Note on Artificial Intelligence, and for any AI system touching personal data both regimes apply at once. The ODPC note adds obligations the CBK draft does not repeat:

• Mandatory DPIAs. The ODPC's DPIA trigger table makes a Data Protection Impact Assessment compulsory before deploying AI credit scoring for loan decisions and AI fraud detection in payment systems, the two most common banking use cases in the CBK survey.
• A 72-hour breach clock. AI-related personal data breaches must be notified to the ODPC within 72 hours, with affected data subjects notified where required. This is a separate obligation from CBK's 24-hour incident notice, with a different recipient and a different trigger.
• Cross-border transfer rules. Sending personal data to offshore AI processors or cloud AI services requires a lawful basis under Section 48 of the Data Protection Act and, where the receiving jurisdiction lacks adequate protection, appropriate safeguards. A Kenyan bank piping customer transactions into a foreign-hosted model without a transfer assessment and a data processing agreement fails this test, a failure mode the ODPC spells out with a banking example.
• Vendor contracts. Written data processing agreements with mandatory provisions are required for every third-party AI vendor and cloud AI provider.
• Data subject rights. People retain the right not to be subject to decisions made solely by automated means, the right to be told when generative AI is processing their data, and the right to access and correct the personal data inside AI systems.

We covered the wider interplay of the Data Protection Act with AI in financial services in Kenya Data Protection Act and AI in Banking and Insurance; the short version is that CBK supervises the model and ODPC supervises the data, and a bank must satisfy both.

Outsourcing and data residency still apply underneath

Two older rulebooks sit beneath the new ones. First, under CBK's Prudential Guideline on Outsourcing (CBK/PG/16), moving core banking systems, payment processing or customer data to a cloud environment is classified as material outsourcing, which triggers mandatory prior notification to CBK, documented exit and contingency testing, and contractual guarantees of data portability and repatriation. An AI system hosted on a foreign cloud and fed customer data is material outsourcing and an AI deployment at the same time; both approval tracks run in parallel.

Second, Kenya's localisation rules require a serving copy of strategic public datasets to be maintained in a data centre in Kenya, and legal advisers recommend cloud contracts that expressly prohibit the provider from training its own models on your customer data. Institutions weighing where an AI system should physically run can find the infrastructure trade-offs in our guide to private LLM deployment for banks across VPC, on-premise and managed API options. Where customer data must be minimised before it reaches any model at all, our guide to PII redaction before the LLM for banks and insurers covers the practical patterns.

A 90-day readiness plan

This sequence assumes a mid-size bank starting from the survey's average position: AI in production, no AI strategy, no AI policy. Adjust the pace to your inventory size; the order matters more than the calendar.

Days 1 to 15: build the AI register. Inventory every AI system in the institution, including vendor-supplied AI inside core banking, collections and CRM platforms, and the generative AI tools staff actually use. For each system record the purpose, data sources, vendor, hosting location, decision rights and whether it can initiate actions. This register is what CBK will ask for first, and it is the input to everything else.

Days 15 to 35: gap assessment against Annex III. Score each inventoried system against the approval checklist: representative data, bias testing, security testing, validation, decommissioning plan. Classify each as agentic or non-agentic under the draft's definition. The output is a remediation backlog with an owner per item.

Days 30 to 60: governance scaffolding. Draft the six board-level documents (data governance strategy, policy and framework; AI strategy, policy and risk management framework), constitute the Data Governance Committee and the independent Model Risk Committee, and schedule board AI training. Commission DPIAs for credit scoring and fraud systems in parallel, since ODPC already requires these regardless of what happens to the CBK draft.

Days 45 to 75: human review and incident plumbing. Stand up the review path for critical decisions: who reviews, with what authority, in what time, with what explanation to the customer. Write the incident runbook covering both clocks, the 24-hour CBK notice and the 72-hour ODPC breach notice, then rehearse it once with a tabletop exercise.

Days 60 to 90: vendors and validation. Remediate vendor contracts: data processing agreements, no-training clauses, audit rights, exit provisions. Complete bias and security testing on the systems most likely to need approval first, typically credit and fraud models. Prepare the Annex III application pack for the highest-risk system as a rehearsal.

If 7 November 2026 is still ahead of you when you read this, add one more item: file comments with the Bank Supervision Department. This is the last point in the cycle where the industry can shape the final text, and the comment template is on the CBK website.

Common mistakes to avoid

• Treating this as an IT project. The draft assigns responsibility to the board and demands committees, policies and independent audit. A model documentation upgrade will not satisfy it.
• Waiting for the final version. The Annex III checklist tells you exactly what the approval application will ask for. Building data governance, bias testing and validation capability takes quarters, and the register obligation lands on AI already in production.
• Forgetting vendor and shadow AI. Forty per cent of surveyed banks use third-party AI vendors and 68 per cent use generative AI tools. The inventory that only covers models your data science team built is incomplete on arrival.
• Confusing the two incident clocks. CBK wants 24 hours for AI incidents; ODPC wants 72 hours for personal data breaches. One incident can trigger both, with different content and different recipients.
• No decommissioning plan. Annex III asks how the system will be retired. Models that cannot be switched off safely, with a manual fallback, will struggle through approval.
• Assuming agentic means futuristic. A customer-service bot that can initiate a refund or freeze a card already meets the high-risk definition today.

What the draft does not do

The note is a draft, so every requirement described here can still change in final wording, scope or timing. It also binds only CBK-regulated institutions: commercial banks, mortgage finance companies, microfinance banks, and the digital credit providers and credit reference bureaus under CBK's remit. SACCOs answer to SASRA and insurers to the IRA, though both regulators typically study CBK's approach and the ODPC note applies to any organisation processing personal data regardless of sector. Finally, the draft regulates deployment and governance; it does not prescribe technologies, vendors or architectures, so the build decisions remain yours.

Groups operating across borders should also read this draft next to the regimes they already face. CBK's model risk committees and validation demands echo the Federal Reserve's model risk tradition, updated for generative AI in SR 26-2 and GenAI Model Risk: What Banks Must Build Now, and its risk-tiering of agentic systems runs in parallel with the EU AI Act high-risk rules for banks and insurers arriving in 2027. A governance framework built to satisfy CBK will cover much of what those regimes ask for, but not everything, so map the overlaps once rather than three times.

Frequently asked questions

Does the CBK AI guidance note apply to AI systems already in production? Yes in practice. The draft requires institutions to maintain an AI register of existing systems when the note takes effect, and the governance, audit, bias testing and incident reporting obligations cover the whole portfolio, not only new deployments.

What counts as agentic AI under the draft? Any system capable of independently initiating actions, interacting with external systems, executing transactions or materially affecting the institution's operations. A scoring model that only recommends is not agentic; a bot that can move money, freeze accounts or commit the institution to a customer-facing action is.

How does the CBK approval relate to an ODPC DPIA? They are separate obligations to separate regulators. The DPIA is already mandatory under the Data Protection Act for use cases like AI credit scoring and AI fraud detection. The CBK approval is proposed and will apply once the guidance note is final. Expect to file evidence of each in the other's process.

What are the incident reporting deadlines? Notify CBK within 24 hours of a material AI incident and file a final report within 24 hours of resolution, plus quarterly summaries due five days after each quarter. Separately, notify the ODPC within 72 hours of an AI-related personal data breach.

Do the rules apply if the AI runs on a foreign cloud? Yes, and more rulebooks join in. Cross-border transfer of personal data needs a lawful basis under Section 48 of the Data Protection Act, hosting customer data or payment processing offshore is material outsourcing under CBK/PG/16 with its own prior notification duty, and contracts should stop the provider training on your data.

Should a bank comment on the draft? If the draft affects how you build or buy AI, yes. Comments close 7 November 2026, go to fin@centralbank.go.ke on the CBK template, and this is the only stage where the industry can change the text before it becomes the supervisory baseline.

Where to go from here

The pattern across the CBK draft, the ODPC note and the outsourcing rules is consistent: know what AI you run, prove its data is governed, test it for bias and security, keep a human able to intervene, and tell the regulator fast when it breaks. None of that is exotic, but assembling it into evidence a supervisor will accept is real work. Our enterprise AI practice for banks and insurers builds exactly this: private model deployment, RAG over policy documents, evaluation suites, and the governance documentation regulators ask for. For financial institutions automating document-heavy processes like KYC and reconciliation under these rules, see our Claude for financial services work. If you want the Annex III checklist turned into a working compliance plan for your institution, that is a conversation we are glad to have.