This Thursday morning I sat on the opening panel of the 41st Insurance Institute of Kenya Annual Conference at the Serena Beach Resort in Mombasa. The session was titled Leading the Intelligent Insurance Era: Leadership, Governance and Professional Excellence, chaired by Stella Njung’e, Managing Director and CEO of NCBA Insurance, alongside Miriam Magala of ZEP-RE and John Ohaga of TripleOKLaw and Heritage Insurance. My brief was the technology end of the conversation: artificial intelligence, virtual assets and the new virtual asset service provider regime, and what all of it means for an industry whose entire product is a promise.

The questions were clearly defined for insurance leaders but the consequences land on everyone who touches a policy or a claim. So this post is written for the claims handler in Kisumu as much as the board member in Upper Hill. I have kept the structure of what I said on stage as part of the panel and expanded it with the data and the regulatory detail that a one-hour panel cannot realistically cover. 

The Industry Is Growing Fast & Trusted Slowly. 

Kenya’s insurers wrote KES 466.58 billion in gross direct premiums in 2025, up 16.5% on the previous year, and penetration climbed to 2.63% of GDP, the highest level since 2016. Life business grew 23.2% and general business 9.37%, according to the Insurance Regulatory Authority’s annual statistics. That is a healthy market by any African measure. It is also a market that insures a sliver of the economy when the global average sits at roughly 7.4%, and the reasons are the ones this industry already knows: thin disposable incomes, a weak savings culture, and a public that has learned to expect complicated policies and slow claims.

The trust problem is measurable. In the first quarter of 2025 insurers rejected 22,364 claims worth about KES 658.9 million, mostly on suspected fraud, incomplete documents and inaccurate damage reports. In the first quarter of 2026 the number of fraud cases referred to the Insurance Fraud Investigation Unit rose 49%, and the fastest-growing category was not fake motor certificates but intermediaries diverting client premiums, up from two cases to seventeen. Fraud in this market is increasingly an insider problem, which matters for how we think about technology, because the tools that catch external fraud are not the tools that catch a trusted agent.

Technology is arriving into that context. It is not arriving into a blank slate, and any insurer that deploys it as if the trust deficit did not exist will simply automate the deficit.

AI In Kenyan Insurance Is No Longer A Hypothesis 

Three of the largest insurers in the country have now published hard numbers. Jubilee Holdings averted KES 1.28 billion in fictitious claims in 2025 using AI tools, roughly three times the KES 424.56 million it stopped in 2024. Old Mutual General Insurance saved about KES 400 million in 2025 by automating routine claims tasks and flagging fictitious claims. Britam launched an AI-driven drive-through motor assessment facility in Nairobi in March this year, built in-house by its BetaLab team, that analyses damage in about fifteen minutes and settles minor claims in roughly two hours against a typical wait of up to five days, paying out by bank transfer or M-Pesa.

This week Jubilee and FSD Africa named seven insurtechs, among them Agrails and Ibisa on satellite-driven parametric cover and Dukatech and Inclusivity Solutions on embedded insurance, for a co-creation programme that goes into Kenyan pilots in November. Therefore, the question for every professional in the industry is not whether AI is coming to their desk, but what decision rules their employer is using to decide where it goes first.

The Wrong Question Is “Should We Do AI?” 

Most boards in Kenya are still asking whether they should do AI. The better question is what decision rule(s) they will use when the technology moves faster than their controls, their skills and their operating model. On the panel I offered four possible approaches, and the point that matters most is that these are set before a pilot starts, not negotiated after it has consumed a budget.

1. The first is a named problem and a value hypothesis: Which insurance problem, for which customer, with what measurable result? If the answer is that the organisation wants to be seen to innovate, stop. Britam did not build a drive-through because AI is fashionable. It built one because motor claims took five days.
2. The second is decision reversibility: Flagging a claim for a human to look at is reversible and low harm. Automatically declining a claim or a life proposal is neither. Experiment freely where the harm is low and the decision can be undone; demand board-level sign-off where it cannot.
3. The thirdis evidence thresholds agreed in advance: Accuracy against human assessors, false-positive rates, complaint volumes, turnaround times, leakage recovered. Write down what success looks like and what failure looks like before the first customer is touched. A pilot without kill criteria is not a pilot. It is a commitment dressed up as one.
4. The fourth is control maturity. Data quality, a model risk function, vendor oversight and skills. Deloitte’s 2026 Global Insurance Outlook is explicit in that most insurers worldwide still struggle with fragmented data and legacy systems, and Kenyan insures are not the exception. Scale only as fast as the control environment can follow.

Pause Is A Decision & Withdrawal Is A Governance Success

In business, leaders are rarely coached on how to stop. Pause when an AI model drifts, when complaints spike, when a single vendor starts to concentrate too much of the risk, or when the rules change. Kenya’s Artificial Intelligence Bill now before the Senate is exactly that kind of trigger. Withdraw when the value hypothesis has failed inside the runway you gave it, or when the risk has moved outside the boundaries the board approved. Treat withdrawal as evidence that governance works, not as a failure of innovation, and the organisation will experiment more candidly because the people running pilots will stop hiding bad news.

Run innovation as a portfolio, not a parade of pilots. Most of the budget belongs on proven use cases, some on adjacent ones, and a small, deliberate part on the frontier. Jubilee’s fraud result is what a proven, scaled use case looks like. A chatbot that nobody measured is what the parade looks like.

Accountability Never Transfers To The AI’s Algorithm 

The governance answer comes down to three shifts:

1. First, from an annual strategy cycle to a quarterly decision cycle, because the technology will not wait for the next board retreat. 
2. Second, from “IT owns technology” to a named, accountable business executive for every AI use case in the building. 
3. Third, from trusting the vendor to governing the vendor, because almost every model a Kenyan insurer deploys in the next three years will be bought, not built.

In practice that means a written AI and digital risk statement, decided by the board in plain language, that says which decisions a machine (AI) may make alone, which it may recommend, and which always need a human. It means an inventory of every AI model in the business, who owns it, what data it consumes and when it was last tested. It means pre-deployment risk assessments, bias testing against protected characteristics, and records of inputs and outputs kept for years rather than weeks. It means a customer can ask why and get an answer a professional can stand behind, and can appeal to a person. It also means third-party due diligence on data residency, model provenance, security, exit terms and liability, because the insurer remains answerable to the policyholder and to the IRA regardless of whose software made the recommendation.

None of this is unique. The European insurance supervisor EIOPA published an opinion in August 2025 built on precisely these principles: data governance, record-keeping, fairness, cyber security, explainability and human oversight, applied proportionately to the risk of each system. The EU’s AI Act already treats AI used for pricing and risk assessment in life and health insurance as high-risk. Kenya’s draft AI Bill borrows the same rationale. The signature on the claim decision is still a professional’s, and the name on the regulatory finding is still the chief executive’s.

What Is Mature, What Needs Guardrails, & What Should Wait 

I broke down the use cases three ways on the panel and I would hold to that split in any boardroom in Nairobi.

1. Pursue now: Fraud detection and claims triage, where three Kenyan insurers have already published results and where the fraud statistics are moving in the wrong direction. Document intelligence at claims intake, reading hospital invoices, police abstracts and assessor reports with a human approving, because medical and motor make up 86.7% of general claims and that is where the paperwork and the leakage sit. Instant settlement on the payment rails Kenya already has, like M-Pesa, since paying a claim in minutes is a trust lever before it is a technology project. Parametric products driven by satellite and weather data for farmers and renewable energy operators. Embedded insurance for SMEs and the informal sector, sold inside the loan, the till, the ride or the device, because distribution is the problem that platforms and AI solve best in a market that insures under 3% of GDP.
2. Pursue with guardrails: Customer facing AI for first-line service and claims status, with a clear path to a human and strict limits on what it may promise, because these models still invent things. AI-assisted underwriting and pricing, where the model recommends and the underwriter decides on anything non-standard, because data on Kenyan lives is thin and uneven and bias is a real risk rather than a theoretical one. Straight-through approval of clear, low-value claims is reasonable. Automated repudiation is not. The industry already has a trust problem with rejected claims and a model should not be allowed to make it worse
3. Wait for the rules, or go only through a licensed partner: Accepting premiums in crypto or stablecoins, holding virtual assets as investments, and tokenising policies or reserves all belong here, for reasons the next section explains.

The Virtual Asset Law Hands Kenyan Insurers A New Line of Business In Four Weeks Time

The Virtual Asset Service Providers Act, №20 of 2025, was assented to on the 15th of October 2025 and came into force on 4 November 2025. It makes the Capital Markets Authority and the Central Bank of Kenya the licensing regulators for anyone offering virtual asset services in or from Kenya. The Regulations were gazetted in July 2026 and create ten licence categories: the CBK takes wallet providers, payment processors and stablecoin issuers, while the CMA takes exchanges, brokers, advisers, managers, token offerings, tokenisation and token issuance platforms. Minimum paid-up capital runs from KES 10 million for a broker to KES 300 million for a stablecoin issuer. Stablecoins must be fully backed by segregated reserves and redeemable at par within two working days.

Existing operators must be licensed by 4 November 2026. That’s im four weeks time. The regulations have a clause that should have every general insurer and reinsurer in the country paying attention: a licensee must hold insurance cover protecting its customers’ virtual assets, placed with an insurer licensed in Kenya unless the regulator approves an alternative, together with cover against cyber risks including theft, loss of keys and operational failure. This is a mandatory, regulator-driven line of business that did not exist a year ago.

The demand behind it is real rather than speculative. Bybit’s 2025 World Crypto Rankings place Kenya fifth in the world for crypto transaction volume, and Chainalysis recorded about USD 3.3 billion in stablecoin transactions through Kenya in the year to June 2024, the fourth-largest flow in Africa. The same Bybit report ranks Kenya 51st for institutional readiness, precisely because the rules were unclear. The Act and the Regulations are the answer to that gap, and the insurance industry’s answer should be measured rather than either evangelical or dismissive.

The caution is actuarial, not ideological. There is very little loss data, the cyber exposure is concentrated, and the wordings will need to be tight. The sensible path is syndicated capacity with the reinsurers who were sitting in that conference hall, hard limits, and a deliberate effort to build the claims data the market does not yet have. On the question I was asked about Generation Z paying premiums or receiving salaries in crypto, my answer was to build for the customer who pays in shillings today and might pay in stablecoins tomorrow, and to make sure the only thing that changes is the payment rail, never the promise. That means API-first products that can be bound inside someone else’s app, consent-based data and real-time decisioning, a regulated payment layer that converts to shillings before anything touches the insurer’s books, and a licensed VASP partner with the IRA engaged from day one, ideally through its sandbox.

Kenya’s AI Bill Is Coming & The Smart Move Is To Behave As If It Were Already Law 

The Artificial Intelligence Bill, 2026, Senate Bill №4 of 2026, had its first reading on the 2nd of April 2026 and is now at its second reading. It is not law and it may change substantially. As drafted it creates an Office of the Artificial Intelligence Commissioner with powers to inspect systems and impose fines, sorts AI into four risk tiers, names finance among the high-risk sectors, and requires pre-deployment risk assessments, human rights impact assessments, explainability, and records of inputs, outputs and performance kept for at least five years. Commentators including Bowmans and KICTANet have criticized it for deferring the classification criteria to future regulations and for duplicating the Data Protection Act of 2019, which already gives Kenyans rights around decisions based solely on automated processing.

Whatever the final approach, the obligations it signals are the same ones a well-run insurer should want anyway. An insurer that builds its AI model inventory, runs its risk assessments and keeps its records now will find compliance a formality later. One that waits for the Commissioner will find it an emergency.

What This Means For You, Whatever Your Work Or Role Is Within Kenya’s Insurance Sector  

If you handle claims, the tools are there to take the paperwork, not the judgement. Learn to read an AI model’s recommendation the way you would read a junior assessor’s: useful, fallible, and yours to override. Every override you log is the most valuable training data your employer owns, and it is also your professional record when a decision is challenged.

If you underwrite, insist on knowing what data the AI model was trained on and whether anyone tested it for bias before it reached you. A pricing model that has never seen a boda boda rider from Kakamega or a smallholder in Kitui is not neutral; it is simply ignorant of them, and ignorance in a pricing model looks like exclusion in a market.

If you sell, whether as an agent, a broker or a bancassurance officer, the Q1 2026 fraud numbers are a warning: the fastest-growing fraud category in the market is intermediaries diverting premiums, and the AI tools being deployed will catch it faster than the old audits did. The upside is that embedded and platform distribution will put more insurance covers in front of more Kenyans than any field salesforce in history, and the professionals who learn to sell inside those channels will be the ones who thrive.

If you manage a team, Deloitte found that 90% of insurance executives worldwide say reinventing how people and machines work together is urgent and only 25% have done anything about it. Close that gap in your own unit. Put AI literacy in the development plan, make override and escalation routes explicit, and measure outcomes rather than activity.

If you sit on a board, you do not need to become a data scientist. You need to ask five questions of every AI deployment: What data is it using? Could it unfairly exclude a customer? Can its decisions be explained and challenged? Who is accountable when it is wrong? And how are privacy, cyber security and vendor risk being handled? If management cannot answer all five, the deployment is not ready.

Automate The Paperwork, Assist The Judgement, Never Automate The Promise

Stella closed the panel by asking each of us for one practical action and one principle that must not be compromised. My action: within ninety days, put a written AI and virtual-asset risk statement in front of the board, listing which decisions a machine may make alone, which it may recommend and which always need a named professional, with an inventory of every model already running in the business attached. Everything else follows from that document. My principle: accountability never transfers to the algorithm or the vendor. The insurer, and the professional, remain answerable for every decision made in their name.

Insurance is a promise to show up when someone is at their most vulnerable. The intelligent insurance era will be judged on whether the technology strengthened that promise or quietly hollowed it out. That outcome is not going to be decided by the vendors. It will be decided by the people reading this.