By the time Dr Simon Bransfield-Garth took the stage at the fourth Safaricom Cybersecurity Summit in Nairobi on Wednesday, the room had already been told three times that AI is a leadership issue. Safaricom’s CEO Peter Ndegwa said cybersecurity sits in the boardroom. Safaricom’s Chief Corporate Security Officer Nicholas Mulila asked who is accountable for the AI in your business. Cabinet Secretary Hon. William Kabogo Gitau said responsibility remains with the people and institutions who deploy these systems. What none of them had done was tell a CEO what to do the next morning. Simon did, and that is why I think his keynote was quite possibly the most useful forty minutes of the day.

“AI governance is not a tax. AI governance is the enabler that helps you adopt AI within your organization.”

Forty Years In AI & The Question Many Cannot Answer

Simon is not a newcomer to this. He earned his Cambridge PhD working on neural networks in the mid-1980s, was a Royal Society Industrial Fellow, built Azuri Technologies into a pay-as-you-go solar business serving a quarter of a million African households, and now leads Akili AI, which helps banks and financial institutions across Kenya, Nigeria, South Africa and the UK adopt AI under proper governance. He opened with the observation that AI took eighty years to become an overnight sensation, which began when OpenAI released ChatGPT in November 2022, has outrun the governance that normally catches up with any fast growing technology.

Then the question. How many applications in your business have AI in them? The answer his team hears is typically 15 to 20. The answer an audit produces is between 50 and 100, almost all of it what he calls shadow AI: not tools anyone bought, but AI that arrived inside software the organization already uses. His slides put it more accurately than he said it: most of the AI in your business arrived unannounced and unvalidated as an “update”, and if a regulator asked tomorrow, could you list those applications and their associated data use policies? “If you can’t even say which applications in your organization have AI in them, how can you claim to be able to manage that AI responsibly?” he asked. Nobody in the room offered an answer.

What 200+ Delegates Told Him

The keynote had something most do not: data from the audience itself. More than 200 delegates took the AI Readiness Snapshot that Akili AI built for the Summit, a 24-question diagnostic across adoption, governance, data protection, capability and confidence. The results were on screen within the hour. 42% said they know unapproved AI is being used in their organizations, and a further 25% said it almost certainly is. Roughly half said an AI policy is being developed. Only 6% have a fully developed AI strategy and governance policy that has been reviewed and on which people have been trained.

Simon was careful to say that this is typical globally and that Kenya is not unusual. I would add a caution the Akili team themselves apply: Summit delegates are more AI-engaged than Kenyan businesses at large, so the 6% is a ceiling, not an average. His summary is the one to remember. “AI adoption is leading AI governance, and that is a challenge for all of us.”

Kenya’s AI Bill Means It Is No Longer Business As Usual

The Artificial Intelligence Bill 2026, sponsored by Senator Karen Nyamu and now before the Senate, would require approval from a proposed AI commission before any high-risk AI system is developed, deployed or operated, with fines of up to KES 5 million and up to 3 years in prison, and criminal liability extending to company directors. The Bill draws on the EU AI Act and defines high risk broadly: healthcare, education, employment, finance, agriculture, security and public administration. Simon’s point was not meant to create fear, and he said so. “I’m not suggesting you’re going to jail tomorrow. But it does rather concentrate the mind that this is not something abstract for your company to sort out. This is something you need to be thinking of individually.”

His example for the sceptics was a construction company that has never deployed AI, whose HR department is nonetheless screening CVs with it. Screening CVs is employment. Employment is high risk. The Bill touches you whether or not you think of yourself as an AI business.

Features, Not Bugs

The middle of the keynote was the best explanation of why large language models (LLMs) misbehave. “The characteristics of large language models are not bugs. They are features.” Conventional software gives the same output for the same input. AI is probabilistic; ask it the capital of France a thousand times and on the thousand and first it may decide you meant the capital letter in the word. More dangerously, it lacks common sense, and when it makes one small error it will reason perfectly logically from that error onwards. His illustration was a car wash 50 metres away, where the AI advises walking there, then advises an umbrella, having forgotten the car. Apply that to a marketing plan or a product strategy that goes to the board looking perfectly coherent, and somewhere in the chain of reasoning there is a mistake nobody noticed.

The responsibility, he insisted, does not change. “You cannot sue the AI. You can’t say it was the AI’s fault. If you write it, you are responsible for that document, whether or not you put AI in it.” He told the story of a Kenyan media group CEO who was worried about AI companies scraping his archive while his own journalists were feeding articles into the free tier of ChatGPT, where by default the data can be used for AI model training. That is not malice. It is the absence of a policy and the absence of training.

Agents Are Your Bodyguards, Until They Are Not

On the cybersecurity theme itself, Simon’s most candid contribution was about AI agents, the systems that do not just answer but act. He cited the July 2025 case where Replit’s coding agent deleted a live production database despite repeated instructions not to, wiping records for roughly 1,200 companies. “The AI agents are already inside your organization. They are your personal bodyguards, and your personal bodyguards are great until they’re not.” Perimeter security assumes the threat is outside the boundaries of a business. However, an AI agent with blanket access to your email, files and calendar is inside it. His remedy was permissions tied to purpose and time, and his analogy was both humorous and alarming: “If I lend my daughter my car, I’m lending her my car to go to the supermarket. I’m not lending her my car to take to a racetrack.” He also described a bank where a senior manager installed agent software on a laptop to tidy his inbox, brought it into the building, and watched it begin interacting with customers’ bank accounts.

Four Things To Do, Immediately

Simon’s recommendation was four words: measure, manage, train, evidence:

1. Measure means an inventory of every AI-enabled application in the business, and he was uncompromising about it. “It is not acceptable for any buisness in Kenya, or anywhere else, not to know how many applications in the organization have AI in them. That is probably your number one task for tomorrow morning.”

2. Manage means the familiar apparatus of a risk register, incident management, acceptable use, vendor and HR policies, with a warning that large customers are already sending suppliers letters demanding evidence of AI governance.

3. Train means reaching the edges of the organization, not the board. “The people you need to train are the people at the very farthest end of your organization. These are your store owners, your hotel receptionists, because these are the guys who’ve got the raw data.”

4. Evidence means a quarterly oversight meeting with minutes, because a risk register written three years ago and never reviewed proves nothing to a regulator.

The Enabler Argument

AI projects fail, he said, not because the technology fails but because nobody thought about data protection or privacy at the start, so the chief risk officer kills them at pilot. Governance put in first is what lets them through. His view on strategy was brutally candid. “I defy anybody in this room to write a five-year AI strategy. Nobody knows where AI is going to be in five years’ time.” Start with a business problem, not a technology. “Do it, succeed, repeat.”

AI projects, he said, typically run 3 months and pay back within the same financial year, which means they rarely need capital approval at all. His case study was Jafari Credit, a Kenyan microfinance institution, where loan provisioning fell from about two weeks to about five minutes plus the loan officer’s time, and where the first success exposed the next bottleneck, which is the point.

Simon’s presentation carried two more outcomes he did not have time to narrate: an insurance invoice reconciliation project that halved contested invoices and freed working capital, and a customer care deployment that automated half of routine calls and freed staff for the complex ones. The slide behind them I would put on every AI project charter in Kenya going forward: “AI is a business task, not a technology task. Seventy per cent is about people, processes and the business case.”

The 3 Key Insights Fom Simon’s Keynote

3 things. First, the Snapshot data from the room may be the most useful number produced at the Summit, because it is about the people who were there rather than the country in general, and it says that 2 in 3 of Kenya’s most AI-engaged organizations cannot account for the AI they are running. Second, Simon’s keynote and Mulila’s 3 questions are the same argument from two sides: Mulila asked boards where AI is being used and who is accountable; Simon handed them the method for answering. Third, his insistence that “there is nothing more frustrating than a customer being told no by AI” and that every customer must be able to reach a human to challenge an AI decision is the consumer-protection principle the AI Bill should be built around, and it came from the technologist in the room, not the regulator.

The Akili AI Beyond ChatGPT Webinar On 27th October 2026 

If you want to know where you stand, the Snapshot the delegates took is at safaricom.akili-ai.com and takes fifteen minutes. You can also join Akili AI’s Simon-Bransfield Garth and Shikoli Makatiani for the Beyond ChatGPT webinar that I’ll be moderating on Tuesday the 27th of October 2026 from 10.00 am to 11.30 am (East Africa Time — EAT) where we will explore what it takes to plan, implement, and manage AI for businesses based on a practical and responsible approach that can massively scale organizational performance — if done right. 

Register to attend for free: https://luma.com/j89mwf6s