By Zachary Ongeri | AI & Digital Transformation Associate, MN Legal
A borrower applies for credit through an app. Within seconds, the application is declined. The message offers little explanation: the applicant did not meet the lender’s requirements.
Behind that response may be a model evaluating repayment history, income patterns and other customer information. The lender receives a score. The borrower receives a decision that may affect their ability to pay school fees, purchase stock or manage an unexpected expense.
For lenders using artificial intelligence, that decision carries responsibilities. Can the lender explain the outcome? Can someone review it? Has the system been assessed for discriminatory bias? What happens when the information behind the score is wrong?
AI lending regulations in Kenya now include specific requirements under regulation 60 of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. Covered providers using AI for lending decisions must address explanations, customer disclosures, human oversight, discriminatory bias, model reliability, transparency and data security. The Regulations were gazetted on 29 September 2026. Read Legal Notice No. 191 of 2026.
For affected businesses, compliance requires a clear connection between the legal requirements and the systems that assess applications, communicate decisions and handle borrower complaints.
Which lenders do Kenya’s AI lending regulations cover?
The Regulations apply to non-deposit-taking credit business that is not regulated under another written law. They contain express exclusions, including institutions licensed under the Banking Act, alongside other specified categories of financial institutions and credit arrangements.
A lender must therefore establish whether its business falls within the Regulations before applying regulation 60 to its operations. The provision should not be presented as a rule governing every Kenyan bank or every transaction involving credit.
The framework also recognises lending models such as buy-now-pay-later, stock-now-pay-later and peer-to-peer lending. Whether a particular business falls within the regime depends on its activities and the applicable exclusions. See regulations 2 and 3.
This assessment matters for technology teams as much as legal teams. A product described commercially as a payment solution or a software platform may still require careful examination of who provides the credit, who makes the lending decision and which entity bears the regulatory obligations.
What CBK Regulation 60 requires: 7 duties
Regulation 60 addresses the use of artificial intelligence for making lending decisions. Its seven requirements can be summarised as follows:
| Requirement | What the provision addresses |
|---|---|
| Explain automated decisions | Customers must receive explanations of automated decisions affecting their loan applications. |
| Disclose AI interactions | Customers must be informed when they are interacting with an AI system rather than a human agent. |
| Retain human oversight | Human oversight and review of AI decisions and automated credit decisions must be retained. |
| Assess discriminatory bias | Risk assessments must identify and mitigate discriminatory bias and unfair outcomes arising from customer data. |
| Maintain model reliability | Deployed models must be technically robust, accurate and capable of making correct judgments. |
| Ensure transparency and accountability | AI algorithms, logic, data and design processes must be transparent, accountable and explainable. |
| Manage privacy and security | Data privacy and security concerns must be adequately managed. |
These duties appear together in regulation 60. Their practical implementation requires cooperation between the people responsible for credit policy, technology, compliance and customer service.
Explaining an automated loan decision
A credit score may be useful to a lender while telling the borrower very little.
Consider an illustrative application declined because the system relied on inaccurate repayment information. A useful explanation should help the borrower understand the material issue and identify whether information needs correcting. The lender should also be able to trace how that information influenced the outcome.
This requires more than preparing a standard rejection message. Providers should examine whether their systems can generate reasons that accurately reflect the decision and can be understood by the customer.
The Regulations also contain a general obligation to communicate a declined application immediately and state the reasons for the decision. That requirement under regulation 28 should be considered alongside regulation 60’s explanation requirement when designing customer notices. See regulations 28 and 60.
The precise detail an explanation should contain will depend on the decision and the applicable legal requirements. As a practical starting point, a lender should be able to identify the significant reasons for the outcome, verify that those reasons match the system’s operation, and direct the borrower to an effective review process.
Making human review meaningful
Human oversight works only when the person reviewing the decision can do something useful with it.
A reviewer needs access to relevant information, an understanding of the system’s limitations and appropriate authority to address an incorrect outcome. A process in which an employee simply repeats the automated result offers limited practical protection.
Providers should consider documenting:
- Who is responsible for reviewing challenged decisions.
- What information the reviewer can access.
- How customers can submit corrections or additional information.
- When a decision can be changed or escalated.
- How the review and its outcome are recorded and communicated.
These are implementation recommendations. Regulation 60 does not prescribe one review workflow for every lending business.
The distinction between AI assistance and a fully automated decision also matters. An AI model may inform a credit officer’s assessment, or it may determine the outcome without human involvement. Providers should understand and document what actually happens in their systems, because the applicable data-protection analysis depends partly on that distinction.
Testing AI credit scoring for bias and accuracy
A model can produce consistent results while relying on assumptions that deserve closer examination.
For example, a system might treat irregular income as a strong negative indicator. That approach could affect applicants whose earnings fluctuate because of seasonal work, self-employment or the nature of their businesses.
A lender should investigate whether the feature is relevant to repayment risk, whether the underlying information is accurate and whether its use produces unfair outcomes. Different outcomes between groups do not, by themselves, establish unlawful discrimination. They can, however, identify issues requiring further assessment.
Regulation 60 expressly requires risk assessments to identify and mitigate discriminatory bias and unfair outcomes. It also addresses technical robustness and accuracy. See regulation 60(d)–(f).
A practical governance programme should therefore consider how the model performs before deployment and during use. Relevant evidence may include validation findings, investigations into errors, review of material changes, customer complaints and records of corrective action.
Providers should also assign responsibility for responding when performance deteriorates. A monitoring report has limited value if nobody is responsible for deciding what happens next.
AI lending regulations and the Data Protection Act
The new credit-provider rules sit alongside Kenya’s existing data-protection framework.
Section 35 of the Data Protection Act addresses decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect an individual. It provides a right not to be subject to such decisions, subject to specified exceptions, including contractual necessity, qualifying legal authorisation and consent.
The section also requires written notification of relevant solely automated decisions and provides for requests to reconsider a decision or make a new decision that is not based solely on automated processing. Providers must assess the exceptions together with these safeguards. Read section 35 of the Data Protection Act.
Regulation 22 of the Data Protection (General) Regulations adds requirements concerning meaningful information about the logic involved, the significance and consequences of processing, fairness, error prevention and access to human intervention.
Regulation 49 identifies certain consequential automated decisions and profiling activities as high-risk processing requiring a data protection impact assessment. A lender should assess its particular use of customer data against those requirements before deployment or relevant changes. Read regulations 22 and 49.
MN Legal’s guide to DPIA requirements in Kenya explains the assessment process in more detail.
Using an external AI or credit-scoring provider
Purchasing a scoring system introduces questions about responsibility, access to information and control over changes.
Under regulation 31, providers remain liable for the acts and omissions of third-party service providers, and the final decision to grant loans is among the functions excluded from outsourcing. A lender using an external model should therefore examine how the arrangement works in practice and where responsibility for the final decision sits. Read regulation 31.
The use of a vendor’s scoring tool does not, by itself, resolve whether the arrangement improperly outsources a reserved function. That requires analysis of the actual decision process and contractual arrangements.
As a practical matter, providers should seek sufficient information and contractual support to investigate errors, understand material changes and respond to customer challenges. Relevant terms may address:
- Documentation of the system and its intended use.
- Access to appropriate validation and performance information.
- Notification of material model changes.
- Assistance with borrower complaints and reviews.
- Security incidents, data access and retention.
- Exit arrangements and access to necessary records.
The appropriate terms will depend on the service, the information processed and the parties’ respective roles.
A useful procurement test is to ask the supplier to walk through a sample adverse decision. Can the lender identify the information that mattered, distinguish a data error from a policy choice, and give a reviewer enough context to reconsider the result? The contract should support that practical exercise. A general assurance that a model is accurate will not answer a borrower’s question about a particular application. Legal and technology teams should therefore assess the explanation and review process alongside model performance, rather than leaving those questions until a complaint arrives.
AI lending regulations: a practical compliance checklist
A useful starting point is to select an actual lending process and trace it from application to final decision and review.
The following records can help providers demonstrate how their controls operate. They are suggested implementation evidence, rather than a list of documents expressly prescribed by regulation 60.
| Area | Suggested evidence |
|---|---|
| Decision process | A map showing where AI influences the outcome and where human judgment enters. |
| Customer explanations | Sample notices linked to the actual reasons used in decisions. |
| Human review | A review procedure, assigned authority and records of completed reviews. |
| Bias and accuracy | Assessment findings, validation results and corrective-action records. |
| Data protection | Data-flow documentation, relevant privacy notices and an applicable DPIA. |
| Vendor management | Contracts, due-diligence findings and records of material changes. |
| Continuing oversight | Named owners, monitoring arrangements and escalation procedures. |
The exercise should reveal whether the lender can explain an outcome, correct inaccurate information and respond when a system behaves unexpectedly.
Frequently asked questions
Does CBK Regulation 60 apply to banks?
The Non-Deposit Taking Credit Providers Regulations expressly exclude institutions licensed under the Banking Act. Banks must assess their obligations under the frameworks applicable to them. Regulation 60 should not be described as applying to every Kenyan lender. See regulation 3.
Must a lender explain an AI-generated loan decision?
For covered providers using AI for lending decisions, regulation 60 requires explanations of automated decisions affecting loan applications. Regulation 28 separately requires a declined application to be communicated immediately with reasons. See regulations 28 and 60.
Is automated lending prohibited in Kenya?
The cited provisions establish duties and safeguards for automated decisions. Section 35 of the Data Protection Act includes exceptions to the right concerning solely automated decisions, while also providing notification and reconsideration safeguards. A provider must assess its specific process against both data-protection requirements and the applicable lending rules. See section 35.
Does AI credit scoring require a DPIA?
The answer depends on the processing involved. Regulation 49 identifies certain automated decisions with legal or similarly significant effects, including relevant profiling and algorithmic processing, as high-risk activities requiring a DPIA. Providers should assess their systems against those criteria. See regulation 49.
For lenders developing or procuring AI systems, the practical objective is to be able to follow an individual application through the entire process: the information collected, the factors influencing the outcome, the explanation delivered and the review available to the borrower. That capability gives legal, credit, technology and customer service teams a shared basis for managing automated lending responsibly.
Zachary Ongeri is an AI & Digital Transformation Associate at MN Legal, focused on legal technology and frontier regulation. View his profile.
