By Kevin Mutiso
NAIROBI, Kenya, Sept 14 – This week I moderate a panel at the National Credit Market Convention in Naivasha. The topic is AI in credit scoring. The room will hold banks, SACCOs, digital lenders, a rating agency and a credit bureau. Here is the fact the room has to start from: the machine is already making the decision. Kenya’s 256 licensed digital credit providers have disbursed 8.37 million loans worth over KES 150 billion. No credit officer read 8.37 million applications. Models did.
The question is not whether Kenya should allow AI in lending. That train left years ago. The question is what rules the models answer to.
Five weeks ago, the European Union answered it. On 2 August 2026 the operational provisions of the EU AI Act came into force. The Act puts credit scoring of individuals on its list of high-risk uses, next to medical devices and hiring. High-risk does not mean banned. It means priced. A lender using an AI scoring system in Europe must document how the model was built, test it for bias, log its decisions, keep a human able to intervene, and submit it for assessment before it touches a customer. The top penalty for getting this wrong is 7 percent of global turnover.
Read that list again. Nothing in it stops a lender from using AI. Everything in it makes the lender able to answer one question: why did this customer get a no?
Europe got one thing wrong, and Kenya should not copy it. The EU put every credit scoring system in the high-risk tier, from a three-variable scorecard a supervisor can read in an afternoon to a self-learning system nobody can explain. Those are not the same machine and should not carry the same burden. Grade the system by how opaque and autonomous it actually is, not by the word credit. Borrow the architecture, not the list.
Kenya has run the other experiment. We did scoring without governance once. Millions of Kenyans were blacklisted at the credit bureaus over mobile loans, many smaller than five hundred shillings. The response was blunt: mass delistings, caps, and years of distrust that the industry is still paying down. We learned that when you cannot explain the score, the public eventually burns the scoreboard.
So here is the position I will argue in Naivasha, and it is the position of the association I chair. Model governance beats model bans. Regulate the use, not the technology.
For lenders, the work starts before any regulator writes a word. Every bank, SACCO and digital lender buying a scoring system should demand four things from the vendor: a description of the data the model was trained on, its error rates broken down by customer segment, evidence of bias testing, and an audit log a third party can read. These artefacts are not exotic. Every serious vendor selling into Europe built them this year to keep that market. A Kenyan lender who does not ask for them is choosing not to know.
Two more obligations belong inside the lender. First, a named human owner for every model in production, reporting to the board, the same way a bank names an owner for credit risk. Second, a plain-language explanation for every automated decline. If your system cannot tell a customer why, in words the customer understands, the system is not ready.
For the regulator, the ask is narrow. Within twelve months, Kenya should have rules that do five things. Classify AI systems by the use case and the actual deployment: opaque and autonomous scoring sits in the high-risk tier, a mature explainable scorecard does not, because loading the same burden onto both slows financial inclusion without protecting anyone. Name the Central Bank the lead regulator for AI in financial services, so no lender answers to five agencies for one model. Require lenders to keep a register of the models they run, each with a named owner. Give every borrower clear reasons for an automated decline, a route to correct their data, and human review on request. And let scoring data move with the customer who earned it, because a repayment history is the borrower’s asset, not the lender’s.
None of this requires new science. The EU has published the entire rulebook and the vendors have already built the compliance machinery. Kenya’s advantage is the position of the follower: we can take what works, drop the bureaucracy that does not fit our market, and write it in one act instead of five years of committee.
The digital credit industry I represent wants these rules. That surprises people. It should not. Clear rules are cheaper than scandals. Every unexplained decline, every biased model, every data leak lands on the whole sector, licensed and unlicensed alike. The lenders who invested in licences want the standard raised, because the standard is their moat.
The models will keep getting better. The data will keep getting deeper. The only open question is whether the governance arrives with them or after them. In Europe it arrived on 2 August. Kenya should not need a scandal to set the date.
Kevin Mutiso is the Chairman of the Digital Financial Services Association of Kenya.
