Finance and economics work splits roughly into things AI is already good at and things AI is not. The first category is where the production deployments live in 2026. The second is where vendors are selling hype.
Where AI works today
- Credit scoring — labelled data (default/no-default), bounded inputs, supervised learning has worked here for decades
- Fraud detection — high-frequency events with labels, anomaly detection patterns
- KYC / AML — document parsing, identity verification, transaction-pattern monitoring
- Customer service — first-line chatbots that handle routine queries and escalate
- Research automation — summarising filings, extracting tables, monitoring news flow
- Robo-advice — algorithmic portfolio construction for mass-market retail
Where AI doesn't work yet
- Complex deal advisory — too few examples, too high stakes, too context-dependent
- Regulatory interpretation — language is legally precise; LLMs are not yet good enough for production reliance
- Macro forecasting — the distribution shifts faster than the model can adapt
- Anything where the cost of error is catastrophic and an unflagged hallucination would land in a court document
Model risk management
Any production AI deployment in a regulated financial institution requires a model risk management (MRM) regime: documented data lineage, model validation, ongoing monitoring, drift detection, rollback procedures, and an audit trail. The US Fed's SR 11-7 letter (2011) is the foundational document and the de facto global standard.
Kenya regulatory context
The CBK has not yet issued binding prudential guidelines on AI in banking but has signalled they're coming. The Capital Markets Authority has consulted on algorithmic-trading rules. The Office of the Data Protection Commissioner (ODPC) enforces the Data Protection Act 2019 on any personal-data processing — which catches almost all customer-facing AI. The Insurance Regulatory Authority is the slowest mover; expect AI guidance via the IRA's risk-based capital and conduct framework.
A deployment checklist
Before you deploy
(1) Document the use case in writing — what decision the model influences, who reviews. (2) Validate the model on out-of-time, out-of-sample data. (3) Set up drift monitoring and define rollback criteria. (4) Get sign-off from Risk and (if regulated) the CRO. (5) Document everything for the eventual audit.
Exercise
A Kenyan tier-2 bank's chief credit officer proposes replacing the bank's existing logistic-regression credit-scoring model with an LLM that reads a customer's documents and outputs a credit decision. The CCO argues the LLM is 'smarter' and will pick up signals the linear model misses. List four reasons this is the wrong call, plus the one application where the LLM would actually add value alongside (not replacing) the existing scoring model.