AI already decides who gets a loan in Kenya, now decide who governs AI

The story opens at a panel discussion at the National Credit Market Convention in Naivasha, Kenya, centered on AI in credit scoring. The panel features banks, SACCOs, digital lenders, a rating agency, and a credit bureau. The fact they must start from is that AI is already making loan decisions. Kenya's 256 licensed digital credit providers have issued 8.37 million loans worth over Ksh150 billion, without human credit officers reviewing each application. Models have taken over.

The question at hand is not whether Kenya should permit AI in lending - the train left years ago. The question is what rules these AI models must adhere to. A few weeks ago, the European Union answered this question with the operational provisions of the AI Act. The Act categorizes credit scoring of individuals as high-risk, along with medical devices and hiring.

High-risk does not mean banned but regulated. Lenders using AI scoring systems in Europe must document model construction, test for bias, log decisions, maintain human intervention capability, and seek pre-use assessment. Violations can incur a penalty of 7 percent of global turnover.

The EU made a mistake by putting every credit scoring system in the high-risk category, from simple three-variable scorecards to complex self-learning systems. These systems vary greatly and should not be treated equally. Kenya, on the other hand, has experimented with scoring without governance. Millions of Kenyans were blacklisted at credit bureaus for mobile loans, causing distrust in the industry.

The solution was mass delistings and caps, which took years to address. The conclusion is that when scores cannot be explained, public trust erodes.

The speaker at the panel, Kevin Mutiso, who chairs the Digital Financial Services Association of Kenya, argues for model governance over model bans. He proposes that lenders should demand four things from scoring system vendors: a description of the data used in training, error rates broken down by customer segments, bias testing evidence, and an audit log that a third party can review.

These requirements are not novel; serious vendors already implement them in Europe. A Kenyan lender should not shy away from asking for them.

Additionally, every lender should name a human owner for every model in production, reportable to the board. Each model should also have a plain-language explanation for every automated decline. If the system cannot provide understandable reasons for declines, it is not ready for use. For regulators, the focus should be on classifying AI systems based on their use case and deployment - opaque and autonomous scoring falls under the high-risk category, whereas explainable scorecards do not.

The Central Bank should be the lead regulator for AI in financial services, with lenders maintaining a register of models and named owners.

Regulations should be in place within twelve months, categorizing AI systems based on actual deployment and use case. The Central Bank would oversee all AI models used in financial services, with a clear route for borrowers to challenge automated declines, rectify their data, and request human review. Importantly, borrower data should remain with the borrower, as credit history is the borrower's asset, not the lender's.

The digital credit industry supports these rules, surprising some but not the association Mutiso leads. Clear rules are preferable to scandals. Unexplained declines, biased models, and data leaks affect all licensed and unlicensed lenders. The question is whether governance arrives with the technology or after it. In Europe, governance arrived on August 2nd, 2026. Kenya should not wait for a scandal to set the date.