RISK-BASED GOVERNANCE AND AUDIT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE IN KENYA'S HEALTHCARE SECTOR

Abstract

This capstone study was undertaken at the end of a fellowship on AI Ethics and Governance in Africa Organized by the Policy Innovation Centre and African Hub for Innovation and Development, in Nigeria. Artificial Intelligence (AI) is increasingly becoming part of healthcare transformation in Kenya, with applications spanning diagnostic support, disease surveillance, telemedicine, health information management, predictive analytics and administrative decision support. The study responds to a governance gap: Kenya has developed an important legal and policy foundation for digital health and AI, but the existing arrangements do not yet constitute a single, operational, risk-based healthcare AI governance and audit system. The capstone adopted a desk-based qualitative design supported by systematic literature review and document analysis. Evidence was drawn from peer-reviewed literature, Kenyan legislation and policy documents, international standards, AI governance frameworks and reports from authoritative organizations. Priority was given to literature published between 2020 and 2026, while seminal sources were retained where they provided foundational theoretical or conceptual value. The findings show that AI adoption is progressing, but institutional readiness is uneven. National referral hospitals, research institutions, private facilities and donor-supported programmes are relatively more active, while county and primary healthcare settings face greater infrastructure, skills, financial, data, interoperability and governance constraints. The study further found that Kenya’s Kenya National Artificial Intelligence Strategy 2025–2030, Digital Health Act 2023 and Data Protection Act 2019 provide an important foundation, but significant AI-specific gaps remain around risk classification, algorithmic accountability, explainability, independent auditing, post-deployment monitoring, lifecycle governance and liability. Five interrelated categories of risk were identified: governance, ethical, technical, operational and regulatory. The study found that these risks interact and cannot be managed effectively through isolated controls. International frameworks reviewed, WHO, OECD, the EU AI Act, NIST AI RMF and ISO/IEC 42001, offer complementary strengths, but none can be transferred to Kenya unchanged. The principal deliverable is therefore a context-specific Risk-Based Governance and Audit Framework. The framework combines governance leadership, legal and ethical compliance, risk assessment and classification, lifecycle governance, human and clinical oversight, continuous monitoring, independent AI auditing and continuous learning. It adopts a proportional approach in which higher-risk healthcare AI receives more rigorous validation, monitoring and independent assurance. The report concludes that responsible AI adoption in Kenya requires a shift from principle-based statements alone towards operational governance. The proposed framework provides a practical reference for policymakers, regulators, healthcare institutions, professionals, AI developers, auditors, researchers and other stakeholders seeking to promote safe, ethical, transparent, accountable and trustworthy AI in healthcare.