Responsible AI: Governing the AI Already Inside Your Organization

Editor's Letter

Three Ways AI Gets In

AI gets into any organization in at least three ways, and most responsible AI policies cover only the first. The first way is AI the organization chooses to build or buy. For a lender, that might be a tool that decides who gets a loan. For a farm business, it might be an app that advises farmers. For a foundation, it might be a tool that screens grant applications. The second way is harder to see. AI now arrives inside normal software updates from the companies that supply an organization’s accounts, customer records and payments. The third way may be the biggest. Staff use AI tools on their own phones and accounts because it helps them work faster.

September’s biggest AI debate was about a different risk. Dario Amodei runs the AI company Anthropic. On 12 September he argued that frontier AI companies, the ones building the most powerful models, “must slow the pace at which we improve the capabilities of AI models”. Sam Altman of OpenAI and Elon Musk agreed within hours. I found it interesting that the debate said little about the AI that organizations already use. For an organization serving people in Nairobi, Lagos, Chennai, Dhaka or Bogotá, that is where most of the risk sits today.

Each of the three ways can hurt the people an organization serves. Lenders show this clearly. A loan tool can turn down a good borrower, and nobody can explain why. A software update can change the tone of repayment messages overnight. A staff member can paste a customer’s ID card and mobile money records into a personal AI app. That customer’s private data has then left the lender. For any organization, responsible AI means preventing these harms in all three ways, including in systems it never chose to buy.

The first steps are cheap. Ask five frontline staff what they paste into AI tools. Write a one-page rule on which customer data must never go into a public AI tool. Ask every software supplier, in writing, which features use AI and which AI model sits behind each one. The board can then keep one list of all the AI in use, with a named person in charge of each item. The organization stays responsible for everything on that list, whatever its suppliers promise. The Portfolio Playbook below turns these steps into a one-month plan.

There is one more risk, and it is the supply of AI itself. Andrew Bailey chairs the Financial Stability Board (FSB), which brings together the world’s main financial regulators. He wrote to the finance ministers and central bank heads of the G20, a group of the world’s largest economies. In the letter, published on 31 August, he said that “for the financial system, the most immediate concern is the potential impact of frontier AI on cyber risk”. He also warned about relying on a few big technology suppliers. For any organization this risk is practical. AI rented from a company can be switched off, and the best open-weight AI comes mostly from one country (see The Cost of Switching AI). So every organization needs a plan for losing an AI model.

Accendo Associates is writing a four-part series with a partner organization on how lenders and other financial service providers can make that plan. It starts with a simple design. The organization connects to every AI model through one single point. At that point, it decides which customer data goes where and which model does which job.

The organizations best positioned for AI may not be those running the largest or newest models. They may be the ones that know what is already running inside them.

Prateek Shrivastava, Managing Partner, Accendo Associates

Portfolio Playbook

One practical plan an investor can run with the companies it backs this month.

Know Your AI in Four Weeks

Every company should start with one task. It should find out what AI is already running, who is in charge of each tool, and what happens if a tool stops. An investor can ask for all three in one request. In this plan, AI means any tool that predicts, scores, sorts or writes something without a person doing each step.

In the first month, a small team can list every AI tool the company uses and brief the board on what it found. Testing every fallback can take one or two more months, and that is normal. Two tools later in this edition help. The first is four questions to send every supplier (see Europe and the US Split on AI Rules). The second is a fallback table, which shows what the company would switch to if an AI tool stopped (see The Cost of Switching AI).

• Week one, the list. List every AI tool across the three ways AI gets in. Include what the company built or bought, what arrived inside supplier software, and what staff use on their own accounts. Count chat assistants and coding tools too. A short anonymous staff survey finds tools the official list misses, as long as no one gets in trouble for answering.
• Week two, the suppliers. Send each supplier the four questions in writing. Large AI providers rarely fill in forms, so save their published terms and the web link as their answer. If a supplier has not replied after 15 working days, mark it “no answer” and raise it at the next contract review.
• Week three, the fallback. Pick every AI tool that makes decisions about people or money. Fill in a row of the fallback table for each one. The fallback can be a second supplier, or staff doing the work by hand for a while. Practice one switch to see how long it takes. Also check two points the law may require. Customer data must stay in the places the law allows, and people must be able to ask a person to review a decision made by a machine.
• Week four, the board. Take three things to the next board or risk committee meeting. These are the list, the person in charge of each tool, and the first change the company will make. A young company without a board can send the same note to its lead investors.

The real test is the people the company serves. A good result means fewer good customers are turned down, and anyone who is refused gets a reason they can understand. Customer data stays where it belongs, and service keeps running when people need it most. At the next portfolio review, investors can ask for the four things the month produces: the list, the supplier answers, the fallback table and the board note.

Portfolio Playbook

Startups Can Do This from Day One

Young companies can do all of this from day one, and that costs much less than doing it later. A startup building its first products has no old systems to clean up. It can set up its AI list, supplier questions and fallback table in its first month, for a few weeks of one engineer’s time. An established organization doing the same work later has to untangle years of systems. Investors in early-stage companies, such as foundations and venture funds, can ask for this before they invest.

In August and September, eight early-stage AI companies raised USD 32 million between them, and each of them could start this way. Accendo works with investors and the companies they back, from early-stage ventures to established lenders. We help with this first step and with the AI plan that follows. If a company you invest in would benefit, write to prateek@accendoassociates.com.

Leaders

New responsible AI rules that can reach your portfolio companies through their suppliers and investors.

Europe and the US Split on AI Rules

Europe and the United States handle AI rules in different ways. The European Union (EU) has one main AI law. In July 2026 it delayed its strictest rules until 2 December 2027, including the rules for AI that decides who gets credit. One rule has applied since 2 August 2026: people must be told when they are dealing with an AI system.

The United States has no national AI law. A December 2025 order from the President aims to set one national approach and challenges AI laws made by individual states. Some states still act on their own. Colorado signed a new law in May 2026 on computer systems that make decisions about people. On 16 September, the Conference of State Bank Supervisors (CSBS), the group for state bank regulators, released an AI checklist that bank inspectors can choose to use.

Few organizations in emerging markets fall directly under either set of rules, but they still feel them in two ways. Their software suppliers often sell in Europe and the United States, so they build their products to those rules. Their investors often come from those places and ask questions based on them. So at the next supplier review, any organization can ask four questions in writing. Which features use AI? Which AI model sits behind each one? Where does customer data go, and is it used to train AI? How will the supplier warn us before the AI changes? Investors can ask their portfolio companies the same four questions once a year.

Leaders

Brazil's AI Law Waits

Brazil’s AI law is on hold. Deputy Aguinaldo Ribeiro leads the bill (Bill 2338/2023) in Congress. He said in late August that Congress would vote on it only after the October elections. So Brazilian lenders will probably have no AI law to follow for the rest of 2026.

They still have one rule to follow today. Brazil’s data protection law (LGPD, Article 20) lets people ask for a review of decisions made only by a computer. If you invest in a Brazilian lender, ask how it handles these requests for loan decisions now.

Advancements in Small AI

AI built to work with weak internet, unreliable power and older computers.

Southeast Asian AI That Runs on Less

On 18 September 2026, AI Singapore, a national program, and the chip maker NVIDIA released new AI models called Nemotron-SEA-LION-v4.8. They are built for Southeast Asian languages. Each model is made of many small expert parts, and only a few of them work at any one time. This lets the smaller model run on modest computers. It has 30 billion parameters (the settings a model learns), but only about 3 billion are active at once. Both sizes also come in compressed versions that can run on devices close to the user. Since February, the same program has also offered SEA-Guard, safety models tuned to Southeast Asian languages and cultures.

Before backing a product built on these models, an investor should check three things. First, check the license, because the release does not state it. Second, ask for test results in the customers’ own language. Third, ask for the real cost per conversation on the device that will run it, measured outside a demo.

Capital Flows

Where AI money went, and which part of the AI system it funded.

One Loan Was 82 Percent of the Money

Our Capital Flows note of 28 September tracks AI deals in five regions of the world. Between 1 August and 25 September 2026, 25 signed deals added up to USD 3.79 billion. Of that, USD 3.45 billion went to computing power, meaning data centers and AI chips.

One deal made up most of the total. Zankore rents out AI computing power in Indonesia. It signed a loan of up to USD 3.1 billion with five banks to buy AI chips. That one loan is 82 percent of all the money. Without it, the total falls to USD 690 million, and the share going to computing power drops to 51 percent.

Companies that build AI products for customers closed 15 of the 25 deals, worth USD 169 million in total. The biggest was USD 125 million for Kapital Grupo Financiero in Mexico. Eight young startups raised USD 32 million between them, and three grants added USD 11.5 million. The rest did not say how much they raised.

Read these numbers with two cautions. First, the big loan is counted at its maximum, while the other deals are investments and grants. So the figures show where money went, but they are not a fair size comparison. Second, 10 of the 25 deals did not share an amount, so all the percentages use only the deals that did.

Southeast Asia: 3 signed deals worth USD 3.1 billion, almost all of it the Zankore loan.

Sub-Saharan Africa: 3 signed deals worth USD 470 million (see the Regional Spotlight).

Latin America and the Caribbean: 9 signed deals worth USD 206 million, the most deals of any region, led by Kapital Grupo Financiero.

South Asia: 4 signed deals worth USD 12 million. Large data center projects in Telangana and Odisha, in India, are announced but not yet signed.

Middle East and North Africa: 6 signed deals, but only USD 1.5 million is known, because five deals by HUMAIN and White & Case did not share an amount.

Investors looking at a data center or AI chip deal can start with one question: how much of that computing power is booked by local companies? The Capital Flows Map is Accendo’s own record of publicly reported AI deals, and the note explains how we count them.

Regional Spotlight · Sub-Saharan Africa

Kenya Writes AI into Bank Rules

On 10 September 2026, the Central Bank of Kenya (CBK) asked the public for comments on new drafts of its main rule books for banks. Comments are due by 7 November. The drafts have no separate AI chapter. Instead, AI appears in three places. Boards should make sure AI-based early warning systems are in place. Internal auditors should check for fraud that uses AI. Security teams should defend against cyber attacks that use AI.

The new rules answer a clear demand from banks. The CBK’s own survey, using data up to the end of 2024, found that half of the 125 institutions that replied already used AI. Almost all of them, 93 percent, wanted guidance from the central bank. That guidance now sits inside the normal bank rules, and customers will feel it most through fraud protection. Scammers can use AI to fake a voice or send convincing messages, then empty a customer’s mobile money wallet before the bank notices.

Kenyan companies you invest in have until 7 November to comment, and they should check two things first. Which of these rules apply to them, since microfinance banks and digital lenders have separate rules? Does this year’s audit plan already cover fraud that uses AI?

Most of the region’s signed money went to infrastructure. We tracked three deals in August and September, worth USD 470 million. The biggest was a USD 300 million investment in the West Indian Ocean Cable Company (WIOCC), a digital infrastructure company. It came from the Africa Finance Corporation and Vision Invest. The second was a USD 170 million loan from Korea’s Economic Development Cooperation Fund to build an AI and digital skills institute in Tanzania. It is one of the few signed deals for skills.

Everything beyond infrastructure gets very little. Since January 2023, the map has found only 30 deals in Sub-Saharan Africa for anything beyond infrastructure. They span 23 countries and add up to about USD 110 million (Necessary, Not Sufficient). When a company you invest in plans an AI product, ask how much of the budget goes to local data and staff training. Then ask who is funding that part.

Southeast Asia: The Zankore loan makes up almost all of the region’s signed money. The SEA-LION release (see Advancements in Small AI) brought new AI models for the region’s languages.

South Asia: Reuters reported on 1 September, citing unnamed sources, that the National Payments Corporation of India (NPCI) is preparing a new system. It would let AI assistants make small payments on UPI, India’s instant payment network, without the user approving each one. Pine Labs, an Indian payments company, has run a similar system since June. It needs the customer’s permission only once.

Latin America and the Caribbean: CAF, the development bank for Latin America and the Caribbean, has announced a USD 12 billion plan for digital change. The plan is not yet signed.

Middle East and North Africa: Egypt’s plan for a national AI data center is also announced and not yet signed.

What We're Watching

Three deadlines. The FSB’s final report on twelve good practices for responsible AI is due in October 2026. Colorado’s comment period on its new AI rules ends on 26 October. Kenya’s comment period ends on 7 November.

One panel. On 28 October at 08:00 New York time, Accendo hosts a panel on getting more investment into African AI beyond data centers (register here). The speakers are Nick Williams (African Development Bank), Johan Bosini (Quona Capital) and Snehar Shah (iXAfrica). The panel picks up where the Regional Spotlight leaves off.

Two tests. First, we will watch whether the eight biggest unsigned AI plans on the Capital Flows Map, worth USD 66.6 billion, become signed deals. Second, we will watch whether NPCI confirms its system for AI payments.