Table of Contents
Half of Kenya's banks, microfinance lenders and digital credit providers now use artificial intelligence in some form, according to a survey the Central Bank of Kenya (CBK) ran in March 2025. Nearly a fifth have gone further, folding it into live workflows and building the first scraps of governance around it. That makes banking, not chatbots or office software, the country's first scaled commercial buyer of AI.
The reason is structural. Banks sit on large volumes of structured data, operate under close regulation and carry real financial risk on every decision. As of mid-2025 the sector held about KES 7.85 trillion in assets and posted KES 311.8 billion in pre-tax profit. An industry that size does not buy AI to experiment. It buys tools that defend margins, cut losses, satisfy regulators and speed up decisions.
Why did banks move first?
The survey shows where the money is going. Among banks that have adopted AI, the leading uses are credit-risk assessment (65%), cybersecurity (54%), customer service (43%), know-your-customer checks (e-KYC, 41%) and fraud management (40%). None of these is a science project. Each attacks a specific cost: bad loans, breaches, slow service, weak onboarding, theft. A bank does not put AI here to look modern; it does so to widen margins and contain risk in the operations that make or lose it money.
The digital plumbing was already in place. CBK's 2025 innovation survey found that 96% of institutions offer mobile banking and 83% have adopted application programming interfaces (APIs), the connectors that let one system talk to another. Big data and analytics reached 42%, cloud computing 38%, biometrics 37% and optical character recognition 31%. The national picture is the same story at scale: the Communications Authority counted 61.99m mobile-data subscriptions and 51.36m mobile-money accounts by the end of 2025, with the average broadband user burning through 14.6 GB a month. Mobile interfaces, API links and digital identity checks are the rails AI runs on. Where they already exist, the trip from pilot to production is short.
What's pushing the market from models toward governance?
The bullish case is real. So is the catch. The CBK found that 70% of institutions still have no formal AI strategy, and among those that have adopted AI, fewer than half (41%) have written AI policies. The risks they name are mostly about plumbing, not algorithms: data quality, governance and management lead at 59%, followed by cybersecurity (54%), a shortage of AI-skilled staff and third-party dependence (52% each) and weak AI governance (51%). That list rewrites the investment case. The next wave of spending will reward whoever fixes governance, auditability, data hygiene and deployment control, not whoever ships the cleverest model.
Regulation is pushing the same way. Kenya's AI Strategy (2025–2030), launched in March 2025, puts responsible AI, rigorous data governance, domestic computing power, local talent and secure deployment at its centre. The Data Protection Commissioner has stressed that AI systems are bound by the existing Data Protection Act: they must honour data-subject rights, apply technical and organisational safeguards, and run impact assessments where needed. For banks, that ties future AI purchases to transparency, privacy controls, model-risk oversight and a compliance trail they can defend. Regulation here is less a barrier than a blueprint.
Where will the compute come from?
Running AI in production takes more than software. It takes somewhere secure, scalable and auditable to run it. Kenya's most-hyped answer has stumbled: the $1 billion Microsoft–G42 project, announced in 2024 to build a geothermal-powered data centre at Olkaria and an Azure cloud region for East Africa, has stalled — the grid cannot yet supply the power the first phase would need, and the financing terms are unsettled. As of mid-2026 it is not built.
The capacity banks can actually use is coming from local operators. iXAfrica calls its Nairobi campus East Africa's first hyperscale, carrier-neutral, AI-ready data centre, and Oracle chose it in January 2026 to host the country's first public cloud region. In May 2026 the firm went further, joining Mitsumi Distribution and Baobab Cloud Services to launch a sovereign public cloud in Nairobi: local hosting, billing in shillings, low latency and data kept inside Kenya's borders. For a regulated industry those are not marketing points. They are the conditions under which a compliance officer signs off on putting a model into production.
Where is the value for investors and operators?
The winners in this phase are likely to be unglamorous. The survey shows where the budgets sit: model-risk management, AI governance software, compliance copilots, e-KYC, document processing and data-cleaning pipelines, alongside private and sovereign cloud, cybersecurity automation and staff training. The logic is plain. Banks already run AI for credit, fraud and customer service, but they are held back by poor data quality, weak governance, thin expertise and third-party risk. A vendor that fixes one of those is selling into a live budget, not a pitch deck.
The lesson reaches past banking. Kenya is showing the rest of Africa that a real AI market is built by solving expensive problems inside regulated industries, not by chasing consumer fads. The country has found AI's first scaled buyer. The next round of value will go to whoever supplies the unshowy backbone (governance, compliance, clean data, secure compute) that lets banks run AI safely and at a profit.
