Why East African Boards Misunderstand AI Risk Management
Most boards treat AI as an IT project or a future compliance matter. The real exposure is already inside their institutions: in the decisions AI quietly shapes, and in systems nobody has inventoried.
AI arrived in East African boardrooms as a strategy topic: an opportunity to cut costs, reach new customers and keep up with competitors. It has not yet arrived as a risk topic in the same way. Where it does appear on the risk agenda, it is usually framed in one of two ways: as a technology project to be overseen by the IT or audit committee, or as a regulatory matter to be dealt with once specific AI rules are passed.
Both framings miss where the exposure actually sits.
Four common misunderstandings
1. Treating AI as a project rather than a decision. Boards ask whether the AI project is on time and on budget. The more important question is which decisions it now shapes. A credit scoring model, a fraud filter or a CV-screening tool changes who gets a loan, whose transaction is blocked and who gets an interview. The risk is in those decisions, at scale, every day.
2. Trusting headline accuracy. A model that is 95% accurate overall can be far less accurate for women, rural customers or first-time borrowers. Overall accuracy hides who bears the errors. Boards rarely see error rates broken down by customer group, or how often staff override the system, which is the clearest signal of whether people trust it.
3. Assuming the vendor carries the risk. Much of the AI inside East African institutions was not built in-house. It arrived inside core banking systems, HR software, insurance platforms and customer service tools. Accountability does not transfer with the licence. If a bought system discriminates or fails, the institution answers to customers and regulators, not the vendor.
4. Waiting for AI-specific regulation. Kenya launched its National Artificial Intelligence Strategy 2025–2030 in March 2025, and detailed AI rules are still developing across the region. But laws that already apply are enough to create liability. Kenya’s Data Protection Act of 2019 gives individuals rights over decisions based solely on automated processing. Consumer protection, employment and credit rules apply whether or not a decision was made by a model.
The left column is what boards typically review. The right column is where exposure builds.
What a well-governed board does
Good practice does not require a new framework built from scratch. The NIST AI Risk Management Framework, published in 2023, and the ISO/IEC 42001 standard for AI management systems give boards a tested structure. What matters is applying it.
Know what you have. Commission an inventory of every use of AI in the institution, including AI embedded in purchased systems. Most boards are surprised by the length of the list.
Classify by impact. Not every use carries the same risk. A model that drafts internal summaries is not a model that decides credit. Rank uses by how much harm a wrong decision could cause, and focus oversight on the top tier.
Name one accountable executive. AI risk spread across IT, risk, compliance and business lines belongs to no one. One senior executive should answer to the board for it.
Set a risk appetite. The board should state which decisions may be fully automated, which require human review, and which may not use AI at all.
Ask for three numbers every quarter. For each high-impact system: error rates by customer group, the rate at which staff override it, and the number of complaints or incidents it generated. These three numbers tell a board more than any accuracy figure.
The opportunity in getting this right
Institutions that govern AI well will be able to use more of it, faster, because regulators, customers and partners will trust them. In a region where trust in financial institutions is hard-won, that is a competitive advantage, not a cost. The boards that understand AI risk as a question of decisions, not technology, will be the ones that capture it.