AI Regulatory Compliance • Enterprise GRC • Pillar 3 & 6
Know Your AI (KYA): The Enterprise Framework Every CISO Needs in 2026
How KYC logic applied to AI systems transforms enterprise governance — with a deep dive on the African regulatory context
👤 Patrick Dasoberi, CISA • CDPSE 📅 May 4, 2025 ⏱ 18 min read 🔗 Pillar 3 & 6
- What Is “Know Your AI” (KYA)?
- KYA vs. KYC: Same Logic, Different Stakes
- How the Know Your AI Framework Works
- Types of KYA Policies Enterprises Must Have
- KYA in Africa: A Compliance Landscape Unlike Any Other
- KYA Implementation: Building Your Enterprise Policy Stack
- Common KYA Mistakes That Expose Enterprises to Risk
- Frequently Asked Questions
Your bank won’t onboard a customer without knowing who they are. They verify identity, assess risk, monitor transactions, and flag anomalies — all under a framework called Know Your Customer (KYC). It’s a non-negotiable. Now ask yourself this: why are enterprises deploying AI systems across critical operations without applying the same logic to the AI itself?
That’s the question the Know Your AI (KYA) framework is designed to answer.
KYA is an emerging governance approach that treats every AI system deployed in your enterprise the way a financial institution treats a high-risk customer. You verify its identity. You assess its risk profile. You understand where it came from, how it makes decisions, and what it does with your data. And you monitor it continuously — because AI systems, like customers, can change behavior over time.
Why This Matters Now
Nearly 49% of employees admit using AI tools not sanctioned by their employer — meaning sensitive business data is already flowing through unvetted AI systems in most organizations. That’s not an IT problem. That’s a compliance crisis. (BlackFog Research, 2026)
In this guide, I’ll break down exactly what the Know Your AI framework is, how it works operationally, and the specific types of KYA policies every enterprise — especially those operating in Africa’s rapidly evolving regulatory environment — needs to build before regulators force the issue.
I’ve seen this firsthand. At CarePoint across Ghana, Nigeria, Kenya, and Egypt, we protected over 25 million patient records while navigating AI deployments across four different regulatory jurisdictions. Getting AI governance right wasn’t optional. It was the difference between operational continuity and catastrophic liability. KYA was the framework that made that governance real.
What Is “Know Your AI” (KYA)?
The Know Your AI framework is a structured governance approach that requires enterprises to identify, document, assess, and continuously monitor every AI system they deploy, procure, or interact with — before and after deployment. Think of it as an identity and risk verification process applied to AI systems rather than to people or organisations.
The concept draws directly from the logic of financial compliance. In banking, you don’t just onboard a client and hope for the best. You verify their identity, understand their risk profile, monitor their transactions, and exit the relationship if red flags emerge. KYA applies that same structured discipline to the AI systems that are increasingly making — or influencing — consequential decisions inside your enterprise.
The 4 KYA Questions Every Enterprise Must Answer
What is it? — The AI system’s identity: purpose, architecture, and capabilities.
Where did it come from? — Provenance: training data sources, vendor origin, third-party dependencies.
How does it behave? — Decision logic, output patterns, known failure modes and limitations.
What risk does it carry? — Security exposure, bias potential, regulatory obligations, and data handling practices.
When you can answer those four questions for every AI system in your stack, you have a KYA posture. When you can’t — and most enterprises currently can’t — you have a governance gap that regulators, auditors, and adversaries will eventually find for you.
According to the NIST AI Risk Management Framework, responsible AI governance requires Organisations to Govern, Map, Measure, and manage their AI systems. Without knowing what AI systems you have and how they work, none of those four functions are achievable. KYA provides the foundation that makes the entire NIST AI RMF operational.
KYA vs. KYC: Same Logic, Different Stakes
KYC is a regulatory process that financial institutions use to verify the identity and legitimacy of their customers. It exists because money — like data — can be weaponised when you don’t know who’s handling it or why. The framework works because it’s systematic, documented, and ongoing. KYA borrows that architecture and applies it to a different subject: the AI system itself.
| Dimension | Know Your Customer (KYC) | Know Your AI (KYA) |
|---|---|---|
| Subject | Individual or business customer | AI system or model |
| Identity Verification | Government ID, business registration | Model card, vendor documentation, architecture disclosure |
| Risk Assessment | AML risk, transaction patterns, PEP status | Model risk, bias profile, training data provenance, security posture |
| Ongoing Monitoring | Transaction surveillance, anomaly detection | Output monitoring, model drift detection, incident tracking |
| Exit Criteria | De-risking relationships with non-compliant customers | Decommissioning or replacing non-compliant AI systems |
| Regulatory Driver | FATF, BSA, local banking regulations | EU AI Act, NIST AI RMF, AU Continental AI Strategy |
| Documentation | Customer due diligence (CDD) records | AI system registry, model cards, risk assessments |
The stakes, arguably, are higher with KYA. A financial institution that fails KYC faces fines and reputational damage. An enterprise that deploys an unvetted AI system in healthcare, financial services, or public administration can cause direct, irreversible harm to real people — at scale, and often without anyone noticing until the damage is done.
Why the “Black Box” Problem Makes KYA Urgent
The majority of AI systems in production today are, to some degree, black boxes. You can see the input. You can see the output. But the reasoning in between — the logic that determined why a loan was denied, why a patient was flagged, why a job application was deprioritised — is often opaque, undocumented, and legally indefensible.
The EU AI Act, which entered into force in August 2024 and is rolling out in enforcement phases through 2026, explicitly requires transparency and explainability for high-risk AI systems. High-risk classifications include AI used in employment, credit, healthcare, education, and critical infrastructure.
Market Signal
The AI ethics and governance solutions market reached USD 1.90 billion in 2025 and is projected to reach USD 23.51 billion by 2035 — a 28.6% CAGR driven by explainability, accountability, and auditability demand. Enterprises building a KYA posture now position themselves ahead of regulatory mandates rather than scrambling to catch up. (Precedence Research, 2025)
At CarePoint, the black box problem wasn’t abstract. When we deployed AI-assisted diagnostic tools across facilities in Ghana and Nigeria, one of the first questions regulators and compliance officers asked wasn’t “does it work?” — it was “can you explain how it decides?” We couldn’t answer that question until we built a structured documentation process for every AI system we ran. That process, in retrospect, was KYA before the term existed.
How the Know Your AI Framework Works
Understanding the KYA conceptually is one thing. Operationalising it inside a real enterprise — with dozens of AI tools, multiple vendors, legacy systems, and compliance obligations spanning several jurisdictions — is something else entirely. KYA isn’t a proprietary methodology owned by a single standards body. It’s a governance posture you build by combining existing frameworks, structured documentation practices, and ongoing monitoring disciplines into a coherent system.
The 5 Core Pillars of KYA
Pillar 1 — Identity: Every AI system in your environment must have a documented identity: a unique system identifier, stated purpose, the vendor responsible for it, the version in production, and the business function it serves. Without identity documentation, you can’t inventory what you have — and you can’t govern what you haven’t counted.
Pillar 2 — Provenance: Where did this AI system come from? Who built the underlying model? What data was it trained on? Were third-party foundation models involved? A vendor telling you their tool is ‘AI-powered’ without disclosing the underlying model architecture is the equivalent of a customer saying ‘trust me’ without producing identification. It’s not good enough.
Pillar 3 — Risk Profile: Once you know what the system is and where it came from, classify its risk. What decisions does it influence? Does it process personal data? Does it operate in a regulated sector? Could its outputs cause harm if wrong, biased, or manipulated? Risk classification determines the depth of scrutiny the system receives.
Pillar 4 — Behavioural Monitoring: AI systems don’t stay static. Models drift. Training data becomes stale. Vendor updates change output patterns without notice. A KYA framework treats AI systems the way a compliance team treats ongoing customer relationships — with continuous monitoring, anomaly detection, and periodic reassessment.
Pillar 5 — Accountability: For every AI system, someone must be named as responsible. Who approved the deployment? Who monitors outputs? Who has authority to suspend it if something goes wrong? Accountability without documentation is just assumption — and in a regulatory investigation, assumption doesn’t hold up.
The KYA Assessment Process: Step by Step
Discovery and Registration
The AI system is formally logged into your enterprise AI registry. Name, vendor, purpose, version, deployment date, and business owner are recorded. If it’s not in the registry, it doesn’t get deployed.
Provenance Review
Request and review the vendor’s model documentation. What foundation model powers this tool? What training data was used? Has the model undergone third-party red teaming? A vendor who can’t answer these questions signals inadequate governance maturity.
Risk Classification
Using your enterprise risk classification policy, assign the system a risk tier — high, medium, or low. High-risk systems get deeper scrutiny, additional controls, and more frequent review cycles.
Security Assessment
Check for prompt injection vulnerabilities, assess whether vendor infrastructure isolates your data from other clients’ training pipelines, and verify that encryption, access controls, and audit logging meet your standards.
Regulatory Mapping
Identify which regulations apply based on the function, data processed, and jurisdictions involved. An AI system handling patient records in Ghana must comply with Ghana’s health data regulations. One operating in Nigeria maps against Nigeria’s Data Protection Act.
Formal Approval and Deployment
The system receives formal written approval from the designated accountability owner — CISO, CTO, or governance committee — before going live. The approval is documented, dated, and stored.
Ongoing Monitoring and Periodic Review
Post-deployment, the system enters a monitoring cycle. Output sampling, incident logging, drift detection, and scheduled re-assessments — quarterly for high-risk, annually for low-risk — keep the KYA posture current.
Model Cards: The Identity Document of AI Systems
If a KYA assessment is the process, the model card is the document that makes it possible. Originally developed by Google Research and now widely adopted across the AI industry, a model card is a standardised disclosure document that describes an AI system’s intended use, training data, performance characteristics, known limitations, and evaluation results.
Think of it as the passport of an AI system. A well-structured model card covers: the model’s intended purpose and out-of-scope uses; datasets used in training and fine-tuning; performance metrics across different population segments; known failure modes; recommended mitigation strategies; and the evaluation process used before release.
Governance Reality Check
If a vendor can’t produce a model card or equivalent documentation, that’s not a gap in their paperwork — it’s a gap in their AI governance maturity. A vendor with poor AI governance maturity introduces unquantified risk into your enterprise stack. In regulated sectors like healthcare and financial services, that’s not a vendor relationship you want to be in.
When we were evaluating AI diagnostic tools at CarePoint, model card availability became one of our first-pass screening criteria. Vendors who couldn’t explain how their models performed across different African patient demographics — different skin tones, symptom presentation patterns, baseline health profiles — didn’t make it past initial assessment. Not because we were being difficult, but because we were protecting 25 million patients from a system that hadn’t been tested against their reality.
Types of KYA Policies Enterprises Must Have
A KYA framework without supporting policies is a governance intention, not a governance program. Policies convert intent into enforceable, auditable practice. They define who does what, when, and to what standard — across every AI system your enterprise touches.
KYA in Africa: A Compliance Landscape Unlike Any Other
Most global KYA guidance is written with European or North American regulatory contexts in mind. That’s a problem for African enterprises — not because the underlying governance principles don’t apply, but because the regulatory landscape, infrastructure realities, and institutional maturity across African markets create a compliance environment that requires a specifically calibrated approach.
Africa isn’t one jurisdiction. It’s 54 countries with divergent data protection laws, AI governance frameworks at different stages of development, and enforcement capacity that varies dramatically across markets. An enterprise operating in Ghana, Nigeria, Kenya, and Egypt simultaneously isn’t navigating one regulatory environment. It’s navigating four, with different obligations in each.
What African Regulators Are Demanding
The pace of AI governance development across Africa has accelerated significantly. As of 2025, 45 African countries have enacted data protection laws, and 39 have established fully operational data protection authorities. That’s not a soft regulatory environment — that’s a continent that has moved faster than most people outside it realize. (Ecofin Agency, 2025)
At the continental level, the African Union’s Continental AI Strategy frames Phase 1 (2025–2026) as a period of governance framework creation and capacity building across member states. The AU strategy explicitly establishes governance, transparency, and accountability as foundational requirements for responsible AI deployment across Africa.
The Multi-Jurisdiction Reality for African Enterprises
Operating across multiple African jurisdictions introduces a KYA complexity that single-market enterprises don’t face. An AI system processing customer financial data across Nigeria, Ghana, and Kenya is simultaneously subject to Nigeria’s Data Protection Act, Ghana’s Data Protection Act, and Kenya’s Data Protection Act — three separate frameworks with overlapping but non-identical obligations. Your AI registry needs a regulatory mapping field for each system.
Africa-Specific KYA Requirement
African enterprises should explicitly require AI vendors to demonstrate model performance validation against African demographic and linguistic contexts when those systems will be deployed in African markets. “Our model has been validated” is insufficient. “Our model has been validated against populations representative of your deployment context” is what you need — and the difference between those two statements is the difference between a governance process and a governance pretense.
At CarePoint, this was a persistent challenge. AI diagnostic tools trained predominantly on Western patient data showed measurable performance gaps when applied to African patient demographics. Our KYA process caught this — specifically because provenance review and performance documentation were mandatory assessment gates. Without that process, those performance gaps would have made it into clinical use, affecting 25 million patients.
The enforcement reality is also shifting. Nigeria, Kenya, South Africa, Ghana, and Rwanda are already prioritizing stricter enforcement. In Uganda, a court sentenced the director of an online lending platform to prison for data protection violations. The era of regulatory non-enforcement across Africa is ending. See our full African AI Compliance guide for jurisdiction-specific breakdowns.
KYA Implementation: Building Your Enterprise Policy Stack
Implementation is where governance frameworks most commonly fail — not because the intent was wrong, but because the execution wasn’t structured, sequenced, or resourced appropriately. Here is a phased approach that works in real enterprise environments, including those operating under the resource and infrastructure constraints common across African markets.
Common KYA Mistakes That Expose Enterprises to Risk
Most enterprises don’t fail at AI governance because they didn’t care. They fail because they made predictable, avoidable mistakes in how they designed or implemented their KYA approach.
⚠
Mistake 1 — Treating KYA as a one-time assessment
The most common failure mode. An enterprise runs a vendor assessment before deployment, checks the compliance box, and never revisits that system. AI systems change. Vendors push model updates. Data drift shifts output behaviour. A KYA assessment that isn’t maintained becomes a governance liability — it creates the appearance of due diligence without the substance.
⚠
Mistake 2 — Scoping only vendor-supplied AI
Internally developed models, fine-tuned foundation models, and AI features embedded in existing enterprise software all carry governance obligations. If your data science team built a model that influences credit decisions, that model needs to be in your AI registry and subject to your KYA framework — even though no vendor invoice is attached to it.
⚠
Mistake 3 — Accepting vendor assurances without documentation
‘Our AI is secure and compliant’ is a marketing statement, not a governance artifact. Your KYA process needs documented evidence — model cards, security testing reports, data handling agreements, regulatory certifications. If a vendor can’t produce documentation, you’re accepting their word as your governance basis. That’s not a position you want to defend in front of a regulator after an incident.
⚠
Mistake 4 — Ignoring fourth-party AI risk
Your vendor’s AI is built on someone else’s foundation model, fine-tuned using another provider’s infrastructure, and served through a cloud provider whose security posture you’ve never assessed. Each of those layers introduces risk that flows into your governance obligations. Your vendor due diligence policy must require disclosure of the entire AI supply chain — not just the tool you’re directly paying for.
⚠
Mistake 5 — Building KYA in isolation from business units
Governance frameworks designed by security and compliance teams without meaningful business input tend to be impractical or ignored. The shadow AI problem exists partly because governance processes are too slow and opaque for the pace at which business teams want to move. Build your KYA policies with business stakeholders — not for them — and you get governance that works with organizational behavior rather than against it.
⚠
Mistake 6 — Failing to account for African-specific risk factors
For enterprises operating on the continent, deploying AI systems without assessing their performance against African demographic contexts, linguistic patterns, or data environments is a governance gap with direct operational consequences. The KYA framework must include Africa-specific validation requirements as a structured component of the provenance and risk classification pillars — not as an afterthought.
Frequently Asked Questions: Know Your AI Framework
Conclusion: KYA Is the Governance Discipline AI Adoption Demands
The enterprises that will navigate the next decade of AI deployment with confidence aren’t the ones that adopted AI fastest — they’re the ones that governed it best. Know Your AI is the framework that makes responsible governance operational. It takes the abstract principles of transparency, accountability, and risk management and converts them into documented, auditable, enforceable practice.
The parallel to KYC isn’t just conceptual. Financial institutions didn’t build KYC because regulators forced them to — the smart ones built it because they understood that unverified relationships introduce unquantifiable risk. The same logic applies to AI systems. An AI tool you can’t document, can’t explain, and can’t monitor is a liability wearing a productivity hat.
For African enterprises, the urgency is compounded by the pace of regulatory development across the continent. Ghana, Nigeria, Kenya, Egypt, and Rwanda are all moving toward structured AI accountability frameworks. The African Union’s Continental AI Strategy has made governance framework creation the explicit priority for 2025–2026. Enterprises that treat that trajectory as a future problem will be building governance programs under regulatory pressure — with less time, fewer choices, and higher stakes.
Start with the inventory. Classify what you find. Assess the highest-risk systems first. Build the policies. Monitor continuously. And don’t wait for a regulator to tell you it’s time.
Ready to Build Your KYA Framework?
Get hands-on, certification-aligned training on AI governance, KYA policy implementation, and enterprise AI compliance — designed specifically for African market realities.
Written by
Patrick Dasoberi
CISA • CDPSE • AI/ML Security Engineer & RAG Applications Specialist | Founder, AI Security Info
CDPSE
AI/ML Security Engineer
RAG Applications Specialist
Former CTO — CarePoint
MSc IT, University of West of England
Patrick Dasoberi is a CISA and CDPSE-certified AI/ML Security Engineer and the founder of aisecurityinfo.com. As former CTO of CarePoint (African Health Holding), he protected over 25 million patient records across Ghana, Nigeria, Kenya, and Egypt — navigating AI deployments across four regulatory jurisdictions simultaneously. He holds an MSc in Information Technology from the University of the West of England and contributed to Ghana’s Ethical AI Framework. Patrick operates at the intersection of AI security, governance, and compliance, with a specific focus on African enterprise contexts.