AI Governance sounds complex and abstract (it’s not)

Let’s start with what we want to achieve with AI Governance: 

Take all reasonable steps to ensure AI does not cause harm
Comply with the various regulations that relate to AI
Be able to demonstrate you have done both of the above

The first is protecting the business directly – preventing harm. The second is protecting the business indirectly – preventing regulatory sanction. And the third is protecting the business generally – providing the needed confidence to regulators, governments, customers, suppliers and even the press that you have things covered.

It’s for every business, not just the big ones

Many people think that governance is something for large organisations working in regulated spaces – banks, healthcare etc. But AI Governance is required for businesses of all sizes. The good news is that for most smaller businesses, the work required is not over complex. If you have dealt with data privacy reporting under the Data Protection Act, 2019, you will be familiar with much of the work to be done. For information security, the gold standard is ISO 27001.

The corresponding standard for AI is ISO 42001. These are excellent but they are also complicated. Certification can take upwards of a year, cost millions of shillings and require full-time staff to operate. Fine for a bank, not practical for a real-estate business – though they are still a useful guide to what good looks like.

It’s for every business, not just the big ones

Here the answer is “it depends”. Broadly, there are two types of regulation – specific AI regulation, and existing laws that already apply to AI, such as data protection, consumer protection and employment law. Don’t overlook the second: if your AI touches personal data, the Data Protection Act applies today. Regulation is also changing rapidly in Kenya, with a wide range of new regulations currently under discussion, including the Artificial Intelligence Bill, 2026, now before the Senate. And, given the speed of progress in AI development, we have to assume regulatory change will continue for some time.

In addition to national regulation, there are many international regulations and frameworks which vary in depth and scope, including the EU AI Act (which can apply to businesses outside the EU if their AI is used there), the voluntary NIST AI Risk Management Framework in the US and many others. So, depending on your sector, you will need to take advice on where AI impacts the regulatory environment in which you work.

So, what should I do right now?

Although the regulatory frameworks are developing fast, there are many well-established processes that underpin almost all governance systems.

Define your decision-making. Who decides what happens and how is that documented and controlled? Are the decision-makers capable of making that decision? For example, if you put the head of IT in charge of AI Governance, will they understand the risk of bias when HR uses the AI to sift employment resumes? People also have rights under the Data Protection Act when decisions about them are made purely by automated means, so this is a legal question as well as an ethical one.

It may look daunting, it’s not

Most AI Governance is applied common sense.

AI Governance means preventing harm, meeting your legal obligations and being able to show you have done both
It applies to businesses of every size, and existing laws such as the Data Protection Act already cover much of your AI use
You don’t need a big certification programme to start – know your AI, manage the risks and plan for when things go wrong

To explore further

Take a look at our Resources page with many  other helpful articles on AI and governance

Try our tools and solutions

Discover Akili’s tools and solutions designed to help you understand,
assess and govern AI with confidence.