27^th August 2026 | Thursday Training

WORK SMART. STAY SAFE. PROTECT TRUST.

Practical AI, Cybersecurity & Data Protection for KMA SACCO Staff��What changes in my daily work and what should I do differently?

QUOTE

“Technology trust is a good thing, but control is a better one.”

― Stephane Nappo

The future of the

“FACELESS FINANCIAL COOPERATIVES”

Digital convenience must be matched by strong controls, security and member trust.

START WITH THE MEMBER, NOT THE TECHNOLOGY

Why this matters to every one of us

AI can help us work better

Draft, summarize, analyze patterns, automate repetitive work and support decisions, while people remain responsible for judgement.

Cyber risk can start with one click

Phishing, smishing, social engineering and unsafe access can expose systems, money, member information and reputation.

Data is a trust

Member, employee and supplier information must be collected, used, shared, stored and protected responsibly.

The common thread: technology only creates value when people use it responsibly.

KMA SACCO • Staff Training | 2

THINK OF THEM AS ONE CONNECTED HABIT

The simple picture: three responsibilities

USE AI WELL

Use AI as a co-worker, for productivity, insight and service not as an unquestioned decision-maker.

STOP CYBER RISK

Pause, verify and report when something is unusual. Never let urgency replace controls.

PROTECT DATA

Use only the information needed, for the right purpose, with appropriate safeguards.

KMA SACCO • Staff Training | 3

PRACTICAL USES, WITHOUT NEEDING TO BE A TECHNOLOGY EXPERT

AI at work: where it can help

• Draft or improve routine emails, letters, notices and member communications.
• Summarize long documents or meeting notes into clear action points.
• Turn raw information into a first draft of a report, checklist or presentation.
• Support analysis of member behavior, savings trends, loan portfolio performance and branch performance.
• Reduce repetitive work so staff can spend more time on members, judgement and relationship building.

Think: “AI as co-worker”

Let it help with the first draft; you own the final result.

Think: “Human in the loop”

Review important outputs before they are used.

Think: “Explainable”

You should be able to understand and challenge important decisions.

KMA SACCO • Staff Training | 4

SPEED IS USEFUL. ACCOUNTABILITY IS STILL HUMAN.

AI: what not to delegate blindly

DON’T

Paste confidential member information into an AI tool without authorization or safeguards.

DON’T

Treat an AI answer as automatically correct. Check facts, calculations, tone and context.

DO

Use approved tools and follow KMA SACCO policies, access controls and data-handling requirements.

DO

Keep human judgement for sensitive member, credit, compliance and relationship decisions.

Rule of thumb: If you would not casually send the information to an unknown person, do not casually put it into an AI tool.

KMA SACCO • Staff Training | 5

ATTACKERS OFTEN TRY TO MAKE US ACT BEFORE WE THINK

The most common cyber attack: the human decision

TRIGGER

• Fear

• urgency

• authority

REQUEST

• Click • pay

• share • change

REACTION

Act without independent verification

IMPACT

• Account takeover

• fraud

• data loss

The control that works everywhere

STOP → VERIFY through a trusted, independently obtained channel → REPORT suspicious requests.

KMA SACCO • Staff Training | 6

MAKE THE SAFE CHOICE THE EASY CHOICE

A 60-second check before you click, pay or share

1

Was I expecting this?

2

Is there unusual urgency or secrecy?

3

Is the sender/link/account change independently verified?

4

Am I being asked for a PIN, OTP, password or sensitive data?

5

If something goes wrong, have I reported it quickly?

Never disclose PINs or OTPs

Open the official app/site yourself.

KMA SACCO • Staff Training | 7

PRIVACY IS NOT ONLY AN IT FUNCTION

Protecting member data is part of our job

• Collect and use personal data for a lawful, clear purpose.
• Use the minimum information needed for the task.
• Keep information accurate and up to date.
• Respect storage/retention requirements and protect confidentiality.
• Share or transfer data only through approved channels and with appropriate safeguards.
• Remember: members, employees and suppliers can all be data subjects.

Ask before sharing

Who needs it? Why do they need it? Is this the approved channel?

Ask before storing

Where is it stored? Who can access it? How long should it be kept?

Ask after an incident

Report quickly. Do not hide, forward or casually delete evidence.

KMA SACCO • Staff Training | 8

SIX HABITS FROM THE SOURCE MATERIAL

Data protection in plain English

Lawful & transparent

People should understand how their data is used.

Purpose limitation

Use data for the specified, legitimate purpose.

Data minimization

Do not collect or keep more than needed.

Accuracy

Keep information accurate and current.

Storage limitation

Do not retain data indefinitely without a reason.

Integrity & confidentiality

Protect data when processing, storing and transferring.

KMA SACCO • Staff Training | 9

SASRA, DATA RESIDENCY AND SOVEREIGNTY ARE GOVERNANCE ISSUES

Where data lives — and why it matters

SASRA COMPLIANCE

ICT operations should meet applicable regulatory requirements, including robust MIS, backups, audits, outsourcing due diligence, critical records and electronic returns.

DATA RESIDENCY

Where is the data physically stored? Example: a Nairobi data centre versus a data centre in another country.

DATA SOVEREIGNTY

Which country's laws govern the data? Cloud/service provider arrangements can create additional legal obligations.

For staff: do not assume that “it is in the cloud” means “it is automatically safe or compliant.”

KMA SACCO • Staff Training | 10

FAST REPORTING IS A CONTROL

If something goes wrong: speed matters

STOP

Do not click, pay, forward or alter evidence unnecessarily.

CONTAIN

Follow authorized technical containment instructions.

REPORT

Notify IT/security and the designated management escalation point.

RECOVER

Restore safely, assess impact and communicate through approved channels.

LEARN

Review root causes, improve controls and retrain where needed.

Good-faith reporting should be encouraged. Hiding an incident increases the risk.

KMA SACCO • Staff Training | 11

WHAT WOULD YOU DO?

One realistic KMA SACCO moment

SCENARIO

A senior manager receives an urgent message appearing to come from the CEO. It requests an immediate payment, says the matter is confidential, promises a major benefit, and says normal approval steps are unnecessary.

Red flags

Urgency • secrecy • authority • bypassing controls

Best response

STOP → VERIFY independently → REPORT

Key lesson

No single message should authorize a high-risk payment or credential change.

Discuss: What would make it harder for a staff member to say “no” — and how can our culture help?

KMA SACCO • Staff Training | 12

FIVE BEHAVIOURS THAT PROTECT KMA SACCO

Your practical playbook from tomorrow

1 USE AI RESPONSIBLY

Use approved tools, protect confidential data, verify outputs.

2 PAUSE UNDER PRESSURE

Urgency is a reason to verify — not a reason to bypass controls.

3 PROTECT MEMBER INFORMATION

Share only what is needed, with the right people and channels.

4 REPORT EARLY

Suspicious messages and incidents should be reported quickly.

5 KEEP HUMAN JUDGEMENT

Technology supports decisions; people remain accountable for important outcomes.

KMA SACCO • Staff Training | 13

THE TAKEAWAY

Work smarter.

Stay alert.

Protect trust.

Every staff member influences productivity, security, compliance and the member experience.

WHAT WILL I DO DIFFERENTLY FROM TODAY?

KMA SACCO • Staff Training | 14