Kenya now has a national standard for responsible AI: KS 3007:2025, the Kenya Bureau of Standards (KEBS) code of practice for AI applications. It sets out what organisations that develop, provide, or use AI systems are expected to put in place to manage risk, assign accountability, and demonstrate trustworthy use. This guide explains what it means for your organisation and how to move from awareness to demonstrable alignment.
Most executives I speak to have heard the name of the standard. Very few have read it closely. Fewer still can point to a documented governance framework that would survive scrutiny from a board, a regulator, or an enterprise customer. That gap is the practical problem this article addresses.
What is KS 3007:2025?
KS 3007:2025 is published by KEBS under the title "Information technology, Artificial intelligence, Code of practice for AI applications." It was developed from the draft standard DKS 3007:2024, which went through public review in 2024. It provides a set of recommendations to help organisations develop, provide, or use AI systems responsibly, covering trust through transparency and explainability, common engineering pitfalls and how to mitigate them, and methods for assessing the reliability, accuracy, safety, security, resilience, and privacy of AI systems.
In plain terms, the standard answers a question boards have been asking for two years: if we use AI, who is responsible, how do we know it is safe, and how do we prove it?
It is worth being precise about what a code of practice is and is not. It is not a ban on AI. It is not a technical specification for building models. It is a reference for responsible practice: a way to make AI adoption auditable, defensible, and scalable. Organisations that treat it as a compliance burden will move slowly. Organisations that treat it as an operating discipline will move faster, because governance removes the fear that stalls AI projects at board level.
Who does it apply to?
The standard states that it applies to any organisation, regardless of size, type, or nature, that develops, provides, or uses AI systems. In practice, that means almost every mid-sized and large organisation in Kenya, and a growing number of smaller ones.
The executives who carry the most exposure are:
- Boards and audit committees, who are accountable for oversight of material risks, including AI risk.
- CEOs and COOs, who own the operational consequences of AI decisions.
- CFOs, who need assurance that AI spend is controlled and that AI-driven decisions in finance, credit, or pricing are defensible.
- CIOs, CTOs, and Chief Digital Officers, who are usually closest to the systems but rarely own the governance mandate.
- CHROs, given the people and workforce implications of AI adoption.
- Heads of Risk, Compliance, and Internal Audit, who will be asked to evidence governance.
A useful test: if your organisation has deployed AI in customer service, credit scoring, recruitment, marketing, fraud detection, or internal knowledge tools, the standard is relevant to you.
Why this matters now: the commercial case
Governance is often framed as a cost. In the East African market, it is increasingly a commercial advantage. Three forces are converging.
First, buyers are asking harder questions. Enterprise customers, multinationals, and development finance institutions increasingly ask for evidence of AI governance before they sign. A documented framework aligned to KS 3007:2025 is becoming a procurement asset.
Second, boards are escalating AI to the risk register. Once AI sits on the risk register, it needs an owner, a process, and evidence.
Third, voluntary standards rarely stay purely voluntary in practice. They become the reference point for regulators, auditors, and contracts. In our view, organisations that build governance now will face fewer retrofits later.
The organisations that move early will not just be safer. They will be faster, because they will stop losing weeks to internal debate about whether AI is allowed.
The five common gaps I see in Kenyan organisations
These observations come from advisory and training conversations with organisations across sectors. They are patterns, not statistics, and they are anonymised.
- Shadow AI is invisible. Staff are using AI tools that were never procured or approved. The organisation cannot govern what it cannot see.
- Accountability is undefined. No single person or committee owns AI risk. When a decision is questioned, the room goes silent.
- There is no AI inventory. The organisation cannot produce a list of AI systems in use, their purpose, their data sources, or their risk rating.
- Governance is confused with IT security. AI risk is treated as a cybersecurity issue. It is broader: bias, model drift, vendor dependence, data provenance, and decision accountability all sit outside a typical security review.
- Policy exists, evidence does not. There is a policy document somewhere, but no records showing it is applied, monitored, or reviewed.
If two or more of these are true, the organisation has a governance gap that a board or a customer will eventually surface.
The three-step readiness path
You do not need to implement everything at once. A practical sequence works better than a big-bang programme.
Step 1: Assess
Build a clear picture of current AI use and current governance maturity. This means an AI inventory, an accountability map, and a gap assessment against KS 3007:2025. The output is a prioritised list of gaps and a baseline you can report to the board.
A structured starting point is our Governance Health Check, which gives an executive-level view of where you stand in under two minutes.
Step 2: Align
Translate the gaps into a governance framework that fits your organisation: policies, roles, risk processes, vendor requirements, and decision rights. This is where most organisations stall, because frameworks imported from elsewhere rarely match local operating realities.
Our AI Governance Framework is built to align with KS 3007:2025 and is adapted to your sector and structure.
Step 3: Assure
Put in place the evidence trail: monitoring, reporting, periodic review, and internal audit hooks. Governance that cannot be evidenced is not governance. This step is what makes the framework defensible to a board, a regulator, or a customer.
Three questions every Kenyan board should ask this quarter
If you are preparing for a board or audit committee session, start here:
- Which AI systems are currently in use across the organisation, including tools staff adopted without approval?
- Who is accountable for AI risk, and is that accountability documented in a charter or terms of reference?
- Does our governance framework align with KS 3007:2025, and can we evidence that alignment?
If the answer to any of these is unclear, the organisation has work to do. That work is manageable, but it is easier to do deliberately than under pressure.
Where to start
The most common mistake is to begin with a policy document. The more effective first move is a focused diagnostic: understand what is in use, who owns it, and where the largest gaps sit. That diagnostic produces a board-ready picture.
If you want a structured starting point, you can book an AI Workflow Audit or speak to us directly. If your priority is board-level education, our Executive AI Education programmes cover governance, risk, and oversight for leadership teams.
Governance is not the opposite of innovation. It is what makes innovation safe enough to scale.
Frequently asked questions
What is KS 3007:2025?
KS 3007:2025 is the Kenya Bureau of Standards code of practice for AI applications. It provides recommendations to help organisations develop, provide, or use AI systems responsibly, covering transparency, explainability, risk management, and the assessment of reliability, safety, security, and privacy.
Is KS 3007:2025 mandatory?
It is a voluntary standard: it is not mandatory unless referenced in law, regulation, or contract. An organisation that wants to claim conformance must commit to adopting the measures it identifies. In practice, enterprise customers, funders, auditors, and regulators increasingly expect demonstrable AI governance, and KS 3007:2025 is the Kenyan reference point.
Who does KS 3007:2025 apply to?
The standard applies to any organisation, regardless of size, type, or nature, that develops, provides, or uses AI systems. In practice this covers most mid-sized and large organisations in Kenya, with accountability sitting at board and executive level.
How does KS 3007:2025 relate to international standards such as ISO/IEC 42001?
The draft standard cites international AI standards as normative references, including ISO/IEC 22989 (AI concepts and terminology) and ISO/IEC 23894 (AI risk management), and lists ISO/IEC 42001 (AI management systems) among the documents consulted in its preparation. Organisations already working toward ISO/IEC 42001 will find significant overlap. A gap assessment against both is the practical way to avoid duplicated effort.
How long does it take to align with KS 3007:2025?
It depends on size, sector, and current maturity. A focused diagnostic can take a few weeks. Building and embedding a full framework typically takes a quarter or more. The sequence matters more than the speed: assess, align, then assure.