A bank and a telco do not fail at AI the same way.

Lending, fraud, AML and collections are already model-driven across Kenyan banks, SACCOs, microfinance and digital credit providers. The models work. What is usually missing is the file behind them: who approved this score, on what data, tested against whom, and what a customer is told when the answer is no.

Where it goes wrong

Credit scoring on alternative data

Mobile-money and behavioural data make thin-file lending possible and make proxy discrimination easy. Both need testing, not assurance by assertion.

Adverse action you cannot explain

A declined applicant is entitled to a reason. A model that cannot produce one is a regulatory finding waiting to be written.

Vendor and embedded models

Core banking, scoring bureaux and fraud vendors ship models you did not build and cannot see inside. They are still yours to govern.

Insurers are moving fast into AI-driven underwriting, claims triage and fraud detection, and the regulator has noticed. The exposure is concentrated: a pricing model that drifts on geography or age, or a triage model that quietly declines the same cohort twice, is a conduct problem before it is a technical one.

Where it goes wrong

Rating and underwriting drift

Models trained on historic books inherit historic exclusions. Without fairness testing across age, gender, geography and health status, you are automating them.

Claims triage without a human

Speed is the point of triage. Oversight has to be designed in deliberately, or there is nobody in the loop when it matters.

Health data classification

Health data is sensitive personal data under the Data Protection Act. Most insurers' AI systems touch it without the classification being written down anywhere.

Telcos and mobile money operators hold more behavioural data on more people than anyone else in East Africa, and they are deploying AI against it in churn, credit, KYC, fraud and increasingly in agentic customer service. Scale is the whole risk: a control that fails quietly fails against millions of people.

Where it goes wrong

Agents that act, not just answer

A customer-service agent with permission to change an account, issue a refund or unlock a line is taking actions, not drafting text. It needs release gates.

Consent and marketing automation

Opt-in consent, sender-ID registration and permitted sending hours are enforced. AI-driven campaign targeting does not get an exemption.

Mobile money and financial crime models

Transaction monitoring sits across two regimes at once — communications and financial services — and is audited by both.

Government agencies and the donor-funded organisations headquartered in Nairobi are both moving AI into eligibility, targeting, verification and case management. Neither has a customer who can walk away, which is exactly why the standard of evidence has to be higher, not lower.

Where it goes wrong

Automated eligibility and targeting

A model that decides who receives a service, a grant or a payment is making a determination about a person. It has to be explainable to that person.

Donor and grant assurance

Funders increasingly ask what AI touched programme data and beneficiary records. An answer assembled after the question is asked is worth very little.

Procurement without AI clauses

Most vendor contracts predate the systems now being bought under them. The obligations you cannot pass through, you keep.

Audit firms, law firms and consultancies hold other people's most sensitive material and bill on judgement. That combination makes unsanctioned AI use both the likeliest incident and the most expensive one — a confidentiality breach, a professional-conduct question and a client-relationship problem arriving together.

Where it goes wrong

Client material in personal-plan tools

The fastest route to a reportable breach in this sector is a fee earner under deadline pressure with a free-tier account and good intentions.

Engagement letters that say nothing

If your terms do not address AI use on client matters, you are either in breach of an expectation or relying on one nobody wrote down.

Judgement that cannot be evidenced

Work product shaped by a model still has to be defensible in a quality review, an inspection or a court. That means a record of what the model did.