AI Risk and Governance
Social House, Lavington, Nairobi
AI is already in your organisation. The governance usually is not.
Customer chatbots, credit and fraud scoring, recruitment screening, and staff pasting company data into public AI tools: most Kenyan organisations are using AI today, and very few have decided who owns the risk, what the AI is allowed to do, or what they would show a regulator, an auditor or a board if asked. This session gives you a working method for governing AI risk. It is built for people who are accountable for decisions, data or systems, whatever their title.
Anyone accountable for decisions, data or systems
Executives and managers
Who sign off on AI use, or inherit it when a team adopts a tool.
Risk, compliance and audit
Who must assess, evidence and report on AI the organisation runs.
Legal and company secretarial
Who answer for contracts, data protection and board records.
IT, security, data and product
Who build, buy or operate AI systems and vendor AI.
Consultants and advisers
Who serve Kenyan firms and need a defensible method to bring to clients.
No technical background needed
The session is about judgement, ownership and evidence, not code.
What we cover
What AI risk is in practice
Where AI is already in your organisation, and the five risks that recur: wrong or biased decisions, data leaking into AI tools, over-reliance and lost judgement, vendor AI you cannot see inside, and accountability nobody holds.
Governing it
The questions to answer before and after any AI is deployed: who owns it, what it is for, what data it uses, what could go wrong, who checks it, and what evidence shows it is working. The AI risk register, built live on an attendee's example.
The Kenyan context
What binds today under the Data Protection Act and the Office of the Data Protection Commissioner, what the Artificial Intelligence Bill before the Senate would add, and what that means for the systems in the room.
The board conversation
Turning the register into a one-page position, and the questions a director should ask about any AI the organisation runs.
Questions, close and certificates
Open questions, then certificates of attendance issued in the room.
Tools you use on Monday
- The DICB AI risk register template, with your first entries made in the room
- A one-page AI risk position for your board or leadership team
- The five-risk checklist for any AI system
- A plain-language reading of what Kenyan law requires today and what the AI Bill would add
- A DICB certificate of attendance recording two hours of structured training on AI risk and governance, with a unique reference number. Most professional bodies accept this as evidence for self-recorded CPD; check your own body's rules
Dr Joseph Ikhalia
Founder, Dr Ikhalia Cyber Bootcamp (DICB)
Joseph is a practising information security governance leader in regulated financial services. The questions this session answers are the ones he is accountable for in his own work: which AI the organisation runs, who owns the risk, and what the evidence looks like when a regulator or an auditor asks.
Over fifteen years in cyber governance, regulation and evidence across financial services, government and technology, he has spoken at CyberIsle, the Isle of Man Government's national cyber security conference, and at the London Law Expo in 2022, has trained business professionals for the Isle of Man Chamber of Commerce, and sits on the Industry Advisory Board of Brunel University London.
He is the author of the DICB Cyber Compliance Model and of The Three Problems of Cyber Regulatory Compliance, published on SSRN in July 2026. The method you learn on the 31st is one you can read and test for yourself.
Thirty seats. Saturday 31 October.
Before you book
Can my company pay by invoice?
Yes. Invoices are issued by BloctoSearch International Ltd, with KRA PIN, within one working day of your request.
Is M-Pesa accepted?
Yes, alongside card payment.
Is there a certificate?
Yes. A DICB certificate of attendance is issued to every attendee on the day.
Does this count towards my CPD?
The certificate records two hours of structured training with a unique reference. Many professional bodies accept this as evidence for self-recorded CPD hours.
What if I cannot attend?
Your seat can be transferred to a colleague up to Thursday 29 October. Tell us the name and we will update the list.
Where is Social House?
154 James Gichuru Road, Lavington, Nairobi, a five-minute walk from Lavington Mall. Parking is available on site.