Kenya's central bank has made credit provider regulations under which regulation 60 would set seven conditions, from commencement, on lenders using artificial intelligence to make lending decisions

What does regulation 60 say, word for word?

Regulation 60 is one sentence with seven limbs. Its opening words, as printed in Legal Notice No. 191, are "A non-deposit taking credit [sic] shall, when using artificial intelligence for making lending decisions, ensure that". The word "provider" is missing from the gazetted text; we reproduce it as printed. The duty runs from commencement, which the instrument leaves undated.

These duties apply from commencement, which the instrument does not date. The seven limbs, quoted from the gazetted text: (a) "automated decisions are explained to customers where they affect a loan application"; (b) "customers are informed when they are interacting with an artificial intelligence system and not a human agent"; (c) "human oversight and review of artificial intelligence decisions and automated credit decisions is retained"; (d) "risk assessments are undertaken to identify and mitigate discriminatory bias and unfair outcomes from data collected on the customers"; (e) "artificial [sic] models deployed are technically robust, accurate, and capable of making correct judgments"; (f) "artificial intelligence algorithms, logic, data and design processes are transparent, accountable and explainable"; and (g) "data privacy and security concerns are adequately managed".

Limb (e) reads "artificial models", with the word intelligence absent. Again, that is the printed text, and we have not corrected it.

The Regulations do not define "artificial intelligence". The term does not appear among the definitions in regulation 2.

Who falls inside the Regulations, and who does not?

Scope, like the duties, operates only from commencement, and the instrument does not give that date. Regulation 3(1) says "These Regulations shall apply to non-deposit taking credit business not regulated under any other written law." A "loan" is defined in regulation 2 to cover credit facilities and loan products "including buy now pay later, stock now pay later, and peer to peer lending".

Regulation 3(3) then lists ten exclusions, again operative from an undated commencement. Item (a) on that list is "an institution licensed under the Banking Act". Microfinance institutions, co-operative societies, Sacco societies, credit guarantee providers, hire-purchase arrangements and credit that is merely incidental to selling goods or services are also excluded.

So regulation 60 does not reach Kenyan banks. That matters because the Central Bank of Kenya has a separate document in play: a draft AI guidance note issued for public comment on 10 September 2026, which our earlier coverage reported is addressed to banks and other CBK-regulated institutions and which binds nobody while it remains a draft. Legal Notice No. 191 is a different instrument, made by the Bank as regulations, with its own scope.

Digital lenders are inside, though the provisions that bring them in operate only from commencement, a date the instrument does not give. Regulation 97 provides that "The Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, are revoked." Under regulation 96(4), a provider licensed under those 2022 Regulations "shall continue to carry on business and shall be deemed to have been licensed under these Regulations."

When do the AI duties start to apply?

The instrument does not say. The Regulations were made on 4 September 2026 and published in Kenya Gazette Supplement No. 234 on 29 September 2026. No express commencement clause was identified in the text. Regulation 96 confirms that the duties apply from commencement, with transitional arrangements for providers already operating at that time; the precise commencement date is not stated in the instrument.

The transition rule in regulation 96(1) uses two different reference points. It speaks of a person who "at the commencement of these Regulations, was conducting non-deposit taking credit business", and gives that person "six months of publication of these Regulations" to apply for a licence or registration. Once the Regulations commence, on a date they do not state, regulation 96(2) lets such an applicant keep operating pending the Bank's decision, subject to the Act, the Regulations and any conditions the Bank sets.

We have not converted that six-month window into a calendar deadline, and we do not treat the gazette date as the commencement date. Both would go beyond the text.

How does regulation 60 sit with the rest of the Regulations?

Two other provisions bear directly on automated lending, on our reading. Neither mentions artificial intelligence, and like regulation 60 they apply from a commencement date the instrument does not state.

Regulation 28(2) reads: "Where a loan application is denied, a non-deposit taking credit provider shall immediately communicate the decision to the applicant and shall state the reasons for the decision." Limb (a) of regulation 60 adds an explanation duty for automated decisions that affect a loan application. From commencement, whose date is not stated in the instrument, a provider whose model declines applicants would face both. The Regulations do not say how the two fit together, and we do not say they are the same duty.

With the same undated commencement, regulation 31(1)(a) excludes "the final decision to grant loans" from the material services a provider may outsource to a third-party service provider, and regulation 31(2) keeps the provider liable for the acts and omissions of any third party it does use. The text does not say whether running a vendor's credit model counts as outsourcing the final decision. Limb (c), retained human oversight, points the same way, but that link is our reading, not the Bank's.

Limb (g) on data privacy and security also sits next to regulation 58, which, once the Regulations commence, requires express, separately obtained consent to process customers' personal data, and regulation 61 on cyber security standards.

What would a compliance file and an audit look for?

The Regulations do not prescribe documents for regulation 60. They do not specify what an explanation contains, how often risk assessments are run, who performs human review, or what record proves any of it. What follows is our inference about evidence, not a list from the text.

From commencement, a provider would need to be able to show four things: that customers who receive an automated decision on a loan application get an explanation, that chat and app flows tell customers when they are dealing with an AI system, that a human can review AI and automated credit decisions, and that bias risk assessments have actually been carried out on customer data. For a CPA, the practical questions are whether those controls exist, whether they leave a trail, and whether the trail survives a change of model.

Regulation 36(3) is the nearest hook in the text. From commencement, which the instrument does not date, it expects, where applicable, an information and technology policy covering, among other things, "audit log management" and "application auditing and monitoring", and regulation 36(2) requires the Bank to be notified of a change of information and technology system.

On sanctions, regulation 86(a) lists a "monetary penalty which shall not exceed two million shillings, or three times the gross amount of the monetary gain made or loss avoided by the failure or refusal to comply, whichever is higher". Regulation 86(b) allows a separate penalty of up to 250,000 shillings against a responsible senior officer, and regulation 87(1) applies penalties to each violation. These are powers the Bank may use from commencement, a date the instrument does not state; the Regulations do not set a penalty specific to regulation 60.

What we did not verify

What we opened: the full text of Legal Notice No. 191 as published on Kenya Law (source PDF, converted to text, 3,089 lines). We read the arrangement of regulations, the enacting words, regulations 2 and 3 on interpretation and application, regulations 28, 31, 36, 58 to 61, 84 to 89, 95 to 97 and the closing "Made on 4th September, 2026." with the Governor's name. We did not read every schedule form line by line.

What we did not open: any Central Bank of Kenya press release or circular on these Regulations, the Central Bank of Kenya Act provisions cited in the enacting words, the Statutory Instruments Act or any other Kenyan statute on commencement or parliamentary scrutiny of subsidiary legislation, the revoked Digital Credit Providers Regulations, 2022, and, for this piece, the draft CBK AI guidance note itself, which we describe only from our earlier coverage.

What we refuse to claim: we do not give a commencement date or say the Regulations are in force on any date, because the instrument does not state one. We do not say regulation 60 applies to banks, microfinance banks or Saccos, because regulation 3(3) excludes them. We do not say whether the 2022 Regulations had an AI provision, because we did not open them, and we make no novelty or priority claim for it among Kenyan AI rules. We have not corrected the two drafting errors in regulation 60; they are reproduced as printed and marked [sic].

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• CBK drafts an AI guidance note for Kenyan banks
• Kenya's ODPC on automated decisions, human review and DPIAs
• Kenya AI Bill 2026: commissioner and risk tiers
• Middle East and Africa AI regulation tracker
• AI Regulation News hub