What Will Your Leadership Team Say When a Regulator Asks How You Govern AI?

Someone with authority is going to ask your organization a simple question: how do you govern the AI you use? Not whether you use it. How you govern it. If the honest answer in your leadership team today is a long pause, this column is for you.

I am writing this because the first half of October gave us three signals, at three different levels, all pointing the same way. None of them is a law you must comply with tomorrow. Together they tell you where the questions are going to come from.

The first signal came from Nairobi. From 5 to 9 October, the Communications Authority of Kenya hosted a five-day forum for ICT regulators under the ICT Policy and Regulation Institutional Strengthening Programme. Regulators from Sierra Leone, Mauritius, Namibia, Zimbabwe, Tanzania and Liberia sat in the room with their Kenyan hosts. AI was on the agenda next to cybersecurity, consumer protection, online safety and data governance, and the question on the table was how to let AI innovation happen without exposing consumers to new harms. The Authority's Director General, David Mugonyi, put it plainly: "Regulators must therefore remain agile, evidence-driven and collaborative." Participants also called for shared African frameworks, so that rules do not splinter across trade blocs.

Read that agenda again. AI did not get a separate track. It sat in the same conversation as data protection and cybersecurity. That is the practical point for leaders. The AI questions will not arrive from some new and unfamiliar body. They will arrive from the regulators you already answer to, in the same meetings, audits and reporting cycles you already know.

The second signal came from the financial world. On 14 October, at the African Caucus meeting during the IMF and World Bank Annual Meetings in Bangkok, the Governor of the Bank of Ghana, Dr Johnson Asiama, asked the IMF to help African countries build their capacity in AI governance, supervisory technology, cybersecurity and digital risk management. He also asked the Fund to bring AI into its surveillance work and its Financial Sector Assessment Programs. His warning was blunt: without urgent, coordinated action, the continent risks falling further behind.

If you lead in a bank, an insurer, a pension fund or a fintech, sit with that for a minute. When a central bank governor asks for AI to be built into how financial systems are assessed, supervisors start asking new questions. Today your supervisor may ask whether you use AI. The next questions are who approved it, how you test it, and who is accountable when it gets a decision wrong.

The third signal is continental. At the end of this month, from 26 to 29 October in Libreville, the African Union's Specialized Technical Committee on Communication and ICT meets for its sixth ordinary session. On the agenda are Draft Guidelines on AI Governance and Regulation in Africa, and a draft action plan and investment and financing plan for the AU's Continental AI Strategy. Experts meet first, and ministers meet on 29 October. To be clear about what this is and is not: the outputs are recommendations to the AU Executive Council, not binding rules for any country. But they show the direction the continent is setting.

So here is where we are. National regulators are comparing notes on AI. A central bank governor wants AI inside financial supervision. The AU is drafting guidelines for the continent. Nothing is binding yet. Everything is moving the same way.

The mistake I would ask you not to make is waiting for the final rulebook before you act. By the time the rules are written, the organizations that already have their house in order will simply be explaining their approach. Everyone else will be inventing one in a hurry, usually after something has gone wrong.

You do not need a thick policy document to start. You need your leadership team to be able to answer three questions, out loud, this quarter.

First, who owns AI decisions here? Not who owns the technology. Who decides whether a new AI use goes ahead, and who is accountable for it once it does. If the answer is "IT" or "nobody in particular", you have found your first gap.

Second, which AI tools are in use in our organization today? Not only the ones on the approved list. The ones people are actually using, including the free tools a busy colleague opened in a browser one afternoon. Ask it honestly and you may be surprised by the answer. That surprise is useful.

Third, how does a high-risk use get reviewed before it goes live? If AI touches who gets a loan, who gets hired, who gets a service or what a customer is told, someone senior should look at it before it reaches real people. Write down who that is and what they check.

This is the heart of the fourth LIFT pillar, Transforming Business with AI. Governance is not a compliance file you hand to the legal team at the end. It is a leadership capability. It is the difference between a leadership team that can explain its choices with confidence and one that discovers its own AI story for the first time in front of a regulator.

If your team cannot yet answer those three questions with confidence, that is not a failure. It is a starting point, and it is exactly the work we do with leadership teams in the AI Governance and Risk workshop. Book a call with Katlo, and we will look at where your team stands and what a focused day of work would change.

Sources, for anyone who wants the full story:

The regulators' forum in Nairobi: The Star, 5 October; Communications Authority of Kenya, 5 October; The Guardian (Tanzania), 12 October.

The Bank of Ghana Governor at the African Caucus: Citi Newsroom, 14 October; MyJoyOnline, 14 October.

The African Union meeting in Libreville: African Union event page; Streamline Feed, 12 October.