On this page
TL;DR:
- Yes, SACCOs and insurers can use AI safely if they begin with work that needs no personal data: letters from templates, board papers, explaining circulars, staff materials and spreadsheet formulas.
- A person must make decisions on loans, claims, underwriting and membership. Section 35 of the Data Protection Act limits decisions made solely by automated means.
- Member and policyholder details, and above all medical records, stay out of public AI tools.
- As of 9 November 2026, we found no AI-specific rules from the IRA or SASRA. The Data Protection Act applies today. The ODPC's AI guidance is a draft, and the IRA's cybersecurity guidance already names AI as a risk.
- Start with one low-risk task, train the small team that does it, and measure honestly for 30 days.
Who this guide is for
This guide is for people working in deposit-taking and non-withdrawable SACCOs, insurers, reinsurers, brokers and medical schemes in Kenya. That includes CEOs, board members, credit officers, claims handlers, underwriters, compliance and risk teams, and member service staff.
You do not need a technical background. If you write member letters, read claims files or prepare board packs, this is for you.
If you work at a bank, see our separate guide to AI in Kenyan banking.
Why this sector needs its own approach
SACCOs and insurers hold unusually sensitive information about ordinary people, and often have small teams looking after it.
Scale explains why this matters:
- SASRA's 2024 supervision report covered more than 350 regulated SACCOs, according to Sacco Review. The Standard reported that the sector had passed Sh1.07 trillion in assets and had 7.39 million members in 2024. Sources give slightly different member counts. SASRA's website now also lists a 2025 report, but we could not open its figures.
- The Standard also reported that SASRA has been raising governance requirements, including fit-and-proper vetting for board members and senior managers. It noted that smaller SACCOs with lean teams feel this workload the most.
- On insurance, Clyde & Co cited IRA and KNBS figures showing penetration of 2.3% in 2023, well below the global average of 7%.
- Sacco Review, citing IRA data, reported that complaints against insurers rose to 532 in the third quarter of 2025, from 423 in the quarter before, with 82% about general insurers. Clearer letters and faster replies are one practical response.
Interest is growing. In April 2026 the CEO of Mhasibu Sacco told The Standard, "We want to adopt AI," describing system and app upgrades and a decision-making dashboard. At a Minet Kenya claims conference reported in March 2026, a Minet manager said AI was "the future". Those are statements of intent, and we found no published Kenyan figures on results.
What the regulators say today
As of 9 November 2026, we found no AI-specific rule or guidance from the Insurance Regulatory Authority (IRA) or the Sacco Societies Regulatory Authority (SASRA). Check their websites, because this can change quickly. Existing rules still apply.
| Source | What it is | Status | What it means for AI |
|---|---|---|---|
| Data Protection Act, 2019 | The main law on personal data | In force | Covers every use of member, policyholder and staff data, including in AI tools |
| Data Protection (General) Regulations, 2021 | Detailed duties under the Act | In force | Regulation 22 covers automated decisions; Regulation 49 lists high-risk processing |
| Registration Regulations, 2021 | Who must register with the ODPC | In force | Financial services must register regardless of size; the ODPC's FAQ lists insurance too |
| IRA Guidance Note on Cybersecurity (Circular IC & RE 11/2025) | Issued 25 June 2025 | Listed as in force | Requires reporting of material cyber incidents within 24 hours; names AI and third parties as emerging risks |
| ODPC draft Guidance Note on AI | Dated July 2026; comments ran 1 to 17 August | Draft; we found no final version | Lists uses that always need an impact assessment |
| CBK draft AI guidance for banking | Consultation closed 7 November 2026 | Draft, aimed at the banking sector | Not written for SACCOs or insurers, but it shows where financial regulators are heading |
| Draft national AI policy and the AI Bill, 2026 | Government direction and a Senate bill | Not law. In October 2026 a Senate committee recommended that the Senate not proceed with the Bill | See our AI Bill explainer |
IRA. The cybersecurity note requires board-approved strategies, reporting of material incidents within 24 hours and quarterly reports, and it recommends at least one board member with cybersecurity expertise. The IRA's chief executive told a 2025 summit that safeguards are needed as insurers turn to AI-driven underwriting, and the IRA was preparing new rules for digital insurance at the time. If staff paste claims files into a personal AI account, you should ask whether that could be a reportable incident. Your compliance lead should answer that before it happens.
SASRA. We found no AI rule. The World Council of Credit Unions has published a white paper on ethics and AI, reported by Sacco Review in April 2026. It recommends board-level accountability, explainable automated decisions such as loan approvals, regular checks for bias, and strict data controls. It is voluntary, but it is a sensible checklist.
Where insurers and SACCOs differ
The two sectors share the same data law, but their highest risks are different.
| SACCOs | Insurers | |
|---|---|---|
| Most sensitive data | Payroll deductions, deposits, loans, guarantors, next of kin | Medical records, claims history, accident reports, beneficiaries |
| Riskiest AI use | Automated loan decisions or credit scoring | Automated claims decisions, underwriting and pricing |
| Biggest quick win | Member letters, AGM papers, circulars, loan ageing reports | Claims letters, policy explanations, broker queries, file summaries |
| Typical team | Small, with one person covering many roles | Larger, with separate claims, underwriting and compliance teams |
| Special trap | Guarantors' data is exposed along with the borrower's | Health data has extra limits under section 46 |
| Fairness risk | Scoring that disadvantages casual or irregular earners | Pricing that disadvantages older or chronically ill people |
Clyde & Co has warned specifically that automated pricing could discriminate against high-risk groups, such as older people or those with chronic illness.
Decide by risk: a traffic-light table
Sort tasks into three groups before anyone opens a tool.
| Colour | Task | Rule |
|---|---|---|
| Green | Explaining a public circular, drafting a template letter with blanks, AGM speech outlines, staff FAQs, spreadsheet formulas, marketing copy for a new product | Use approved tools. A person reviews. |
| Amber | Summarising an anonymised claim, drafting a reply to a complaint with details removed, analysing de-identified arrears trends | Remove identifiers first. A senior person reviews. |
| Red | Pasting identifiable member, policy or medical data into a public tool; AI deciding a loan, claim, premium or membership; AI-only fraud accusations | Do not do this. A red item needs a formal project, a contract and an impact assessment. |
Most organisations should stay in green and amber for at least the first few months.
Five worked prompts you can copy
Use placeholders in place of real details. These prompts follow the four Cs that we teach: Clarity, Context, Constraints and Customisation.
1. Remove identifying details first
Do this step by hand or inside an approved system. Do not paste the original into a public tool to have it cleaned. Replace each name with a label such as Member A, and each number with a placeholder. Then use the next prompts on the clean version.
Use a simple key on your own system: Member A, Claimant B, Guarantor C, Hospital D, Date 1, Amount 1. The key stays on your side.
2. A loan decline letter (after a person has decided)
I work at a SACCO in Kenya. A credit committee has already declined a member's loan application. Draft a letter to the member from the Credit Manager. Reason decided by the committee: [reason in plain words, no figures]. Constraints: under 180 words, respectful, simple English. Do not change or add to the reason. Do not give financial advice. Explain what the member can do next: [options]. Tell them how to ask for the decision to be reviewed by a person: [process]. Use [MEMBER NAME], [DATE] and [REFERENCE] as blanks. Customisation: the member may be disappointed and may read this on a phone, so keep paragraphs short.
The committee decides and the tool only writes it up. Your staff then fill the blanks inside your own system.
3. Summarise an anonymised claim file
I work in the claims team of a Kenyan general insurer. Below is an anonymised motor claim file. All names, numbers and dates have been replaced with labels. Produce: (1) a timeline of events; (2) a list of documents present; (3) a list of documents missing against this checklist: [paste your checklist]; (4) any statements in the file that contradict each other, quoting each one exactly. Do NOT recommend whether to pay or reject the claim. Do NOT say whether fraud is likely. Do not add any fact that is not in the file. If something is unclear, write [UNCLEAR]. Use short bullet points for a claims supervisor.
File: [paste anonymised text]
The two "do not" lines are the most important in the prompt. They keep the tool on the side of organising information, and leave judgement with the handler.
4. Turn a circular into a board note
Below is the full text of a public circular from [IRA or SASRA or ODPC]. Write a one-page note for our board. Context: the board includes members who are not lawyers. Constraints: list (1) what the circular requires, with paragraph numbers; (2) deadlines; (3) who in a [SACCO or insurer] would normally be responsible; (4) questions the board should ask management. Use only the text below. If the circular does not address something, write "Not stated". Use plain English.
Circular: [paste]
Public documents contain no member data, so this is a safe first exercise. Check every paragraph number before circulating the note. For a wider view of the board's role, see our guide to board-level AI orientation.
5. Loan ageing formulas in Excel
I use Microsoft Excel. My columns are: Loan Ref, Outstanding Balance (KES), Days In Arrears. Give me exact formulas to place each loan into these buckets: Performing, Watch, Substandard, Doubtful, Loss, using these day ranges: [paste the ranges from your current policy or SASRA requirement]. Then give me a summary table with the total balance and percentage in each bucket. Explain each formula in one sentence. I know basic formulas but not pivot tables.
Take the ranges from your policy or the regulations, not from the chat tool. And use only loan references, with member names removed.
What must stay with a person
Section 35 of the Data Protection Act gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. There are exceptions, such as where the decision is needed for a contract, is authorised by law with safeguards, or is based on consent. Even then, the controller must notify the person in writing, and the person can ask for reconsideration or a new decision that is not solely automated.
Regulation 22 goes further. It requires you to tell people, give meaningful information about the logic involved, prevent errors, remove discriminatory effects and bias, and let people obtain human intervention.
Keep these decisions with a qualified person:
- Approving or declining a loan, or setting its limit.
- Accepting or rejecting a claim, or deciding its amount.
- Underwriting, loading a premium or refusing cover.
- Accusing a member or claimant of fraud.
- Suspending or expelling a member.
- Hiring and disciplining staff.
An AI flag can start an investigation by a person. It should never be the outcome.
Beware of the rubber stamp. If an officer approves every recommendation in seconds, a regulator may not see meaningful human involvement. The draft ODPC note reportedly uses exactly that phrase. Give reviewers time and authority to disagree, and record the times they do.
Data rules that catch people out
Registration. Financial services are on the list in the Third Schedule of the registration regulations, so the small-business exemption does not apply. The ODPC's FAQ also names insurance.
Health data. Sensitive personal data includes health status. Section 46 limits who may process health data, generally to those under a health care provider's responsibility or a legal duty of professional secrecy. Medical insurers should get advice on how this applies to their staff and tools.
Sending data abroad. Section 48 sets conditions for transfers out of Kenya. Section 49 requires consent and confirmed safeguards for sensitive personal data. Most public AI tools are hosted abroad. Reports say the draft ODPC note would need a documented check of the destination's standards and a written agreement with the vendor, and the local company stays accountable.
Impact assessments. Section 31 requires a data protection impact assessment before high-risk processing. Regulation 49 treats these as high risk: automated decisions with significant effects, sensitive data, combining datasets, large-scale processing and innovative technology. Reports say the draft ODPC note goes further and lists credit scoring for loan decisions and fraud detection in payment systems among uses that always need one.
Breaches. Section 43 requires a controller to notify the ODPC within 72 hours of learning of a breach that creates a real risk of harm. Insurers also have the IRA's 24-hour rule for material cyber incidents. Plan for the shorter one.
Fines. Section 63 allows up to KES 5 million or 1% of annual turnover, whichever is lower.
This is general information, so take advice on your own position.
What must never go into a public AI tool
- Member, guarantor or policyholder names with ID numbers, KRA PINs or phone numbers.
- Payroll, deposits, loan statements and M-PESA records.
- Medical reports, hospital bills and diagnoses.
- Claims files that have not been anonymised, and police abstracts.
- Beneficiary and next-of-kin details.
- Board papers, audit findings and supervision letters from your regulator.
- Passwords and core system details.
Questions to ask an AI vendor
Before you buy a chatbot, a scoring tool or a claims system, get written answers to these:
- Where is our data stored and processed, and in which countries?
- Will our data train your models? Can we turn that off in the contract?
- Will you sign a written data processing agreement that meets section 42?
- Who are your sub-processors?
- How does the system reach a result, and can we explain it to a member or a regulator?
- What testing have you done for bias, on data from people like our members?
- How will a person review or overturn a result?
- How quickly will you tell us about a breach? (Remember the 24-hour and 72-hour clocks.)
- How can we get our data back and delete it if we leave?
- Which other Kenyan regulated bodies can we speak to?
What goes wrong, and how to avoid it
| What goes wrong | Why it happens | What to do |
|---|---|---|
| A claims file goes into a personal ChatGPT account | Staff want to save time and have no approved option | Provide an approved tool, a "never paste" list, and training |
| "Anonymised" data can still identify someone | The name was removed but a rare injury and date remain | Remove or generalise unusual details too |
| A summary leaves out the key fact | Summaries compress information | Read the source documents before deciding |
| AI invents a policy clause or SASRA rule | It predicts plausible text | Paste the actual document and require exact references |
| A letter promises cover or a refund | The tool writes helpful-sounding promises | Use templates, and let a named person approve |
| Officers approve AI suggestions without thinking | Speed targets | Sample decisions, and track how often staff disagree |
| Members in rural areas are left behind | Digital-only channels | Keep human and phone channels |
| Kiswahili explanations change the meaning of a policy | Translation drift | A fluent staff member and a compliance reviewer check it |
| Board learns about AI from a complaint | No one told them | Give the board a short report every quarter |
A 30-day plan for a small team
Week 1: set the rules. Write a short AI usage policy. Include approved tools, the traffic-light table and who to ask. Confirm your ODPC registration. Have your board or management approve it.
Week 2: pick one green task and time it. Good choices are AGM notices, member FAQs, or summaries of public circulars. Record how long it takes now.
Week 3: train the people who do that task. SACCOs often have one or two people doing many jobs, so a small group session works well. Use real but non-sensitive work.
Week 4: measure and report. Time the whole task, including checking. Record any errors. Report to management in one page, including what did not work. Only then consider moving one task to amber.
If you use Microsoft 365, Copilot Chat may be a sensible place to begin. Microsoft says it is available to business users with a qualifying subscription, and that without a Microsoft 365 Copilot licence, work data is limited to the files you upload. Ask your IT provider to confirm your settings before anyone uses it for sensitive work.
Where training will not help
Training will not repair a core banking system with dirty data, recover money lost to bad governance, or replace compliance staff. It also cannot make an unsafe vendor safe. If your members' records are incomplete, fix that before you consider any AI scoring.
Questions people ask
Can a SACCO use ChatGPT to process member data?
Not with identifiable member data in a public tool. Use it for templates, formulas and public documents, or remove all identifiers first. For work involving real member data, use a tool with a proper contract and, where the risk is high, an impact assessment.
Can AI approve loans for SACCO members in Kenya?
Be very careful. Section 35 of the Data Protection Act limits decisions based solely on automated processing, and where one is allowed, the member must be told and can ask for reconsideration. Reports say the draft ODPC note lists credit scoring for loan decisions as needing an impact assessment every time.
Can an insurer use AI to assess claims?
AI can organise a file, list missing documents and draft letters. A trained person should make the decision on the claim. Medical claims need extra care because health data is sensitive and restricted under the Act.
Does the IRA or SASRA have AI rules?
We found no AI-specific rule from either body as of 9 November 2026. The IRA's cybersecurity guidance names AI as an emerging risk, and the Data Protection Act applies to both sectors. Check their sites for updates.
Is anonymised data safe to put into AI?
It is much safer, if it is truly anonymous. Removing a name is often not enough, because a rare injury, a small town and a date can identify someone. Remove or generalise those details too.
Should a small SACCO buy an AI system?
Probably not at first. Free or low-cost general tools, used carefully, can help with writing and spreadsheets. Buy a system only when you have a clear need, clean data and a vendor who can answer the questions above.
Who should own AI in a SACCO or insurer?
Name one senior owner, usually in risk or compliance, with support from IT and operations. The board should receive regular reports. The World Council of Credit Unions also recommends board-level accountability.
Sources
All sources were opened and last checked on 9 November 2026.
- Kenya Data Protection Act, 2019 (full text, ICNL library), last checked 9 November 2026
- ODPC, Data Protection (General) Regulations, 2021, last checked 9 November 2026
- ODPC, Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, last checked 9 November 2026
- ODPC, Frequently asked questions, last checked 9 November 2026
- Digital Policy Alert, ODPC consultation on the draft Guidance Note on AI, last checked 9 November 2026
- PPC Land, report on the draft ODPC guidance and its impact assessment list, last checked 9 November 2026
- Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026), last checked 9 November 2026
- Digital Policy Alert, CBK draft Guidance Note on AI in banking, last checked 9 November 2026
- The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026), last checked 9 November 2026
- Eastleigh Voice, "Kenya opens draft AI policy for public consultation" (23 July 2026), last checked 9 November 2026
- Digital Policy Alert, IRA Guidance Note on Cybersecurity, Circular IC & RE 11/2025, last checked 9 November 2026
- Eastleigh Voice, "Kenyan insurers must disclose major cybersecurity breaches within 24 hours, regulator says" (14 July 2025), last checked 9 November 2026
- The Star, "Kenya tightens digital insurance rules" (27 November 2025), last checked 9 November 2026
- Clyde & Co, "The Role of Digital Technology and Artificial Intelligence in Transforming Health Insurance in Kenya" (3 September 2025), last checked 9 November 2026
- Sacco Review, report from the Minet Kenya Claims Conference (29 March 2026), last checked 9 November 2026
- Sacco Review, "Unpacking SASRA Supervision Report 2024" (7 October 2025), last checked 9 November 2026
- Sacco Review, "WOCCU guidelines on use of AI in Saccos" (9 April 2026), last checked 9 November 2026
- The Standard, "Banks target Kenya's Sh1 trillion Sacco sector as regulation tightens" (18 February 2026), last checked 9 November 2026
- The Standard, "New branches, AI adoption as Mhasibu targets 100,000 membership" (21 April 2026), last checked 9 November 2026
- SASRA, Sacco Supervision Annual Reports, last checked 9 November 2026
- Microsoft Support, "How Copilot Chat works with and without a Microsoft 365 Copilot license", last checked 9 November 2026
Where FuKazee fits in
FuKazee is a Nairobi-based training company. Since 2022 we have trained more than 3,000 people, and we help teams use AI in the work in front of them. We assume nobody in the room knows AI yet, we avoid jargon, and we are honest that nobody becomes an expert in a few days. We show the free version of every tool, teach the four Cs, and cover safe handling of data.
For insurers and SACCOs, we build sessions around your own letters, reports and files, using anonymised examples, and we are clear about what must stay with a person. See our pages on AI training for insurance companies in Kenya and AI training for SACCOs in Kenya. If you are comparing notes with a bank, our page on AI training for banks in Kenya covers similar ground.
Our office is in Westlands, Nairobi. Elsewhere we train on-site by arrangement or live online.
To talk through training for your team, email us at lead@fukazee.com.
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
