Mufambi Advisory
Governance work usually gets judged on whether the paperwork exists, policies, risk assessments, sign-offs. I prefer to have mine judged on whether it would hold up in the moment it's actually tested, when a regulator asks a hard question, or a customer disputes a decision an AI system made. Over 25 years spent on both sides of the governance table across Malawi, South Africa and Kenya, I help organisations deploying AI in regulated environments build governance that exists for a lifetime, not just a moment, and that actually protects the people it was designed for.
Start a conversationWho this is built for
Automated credit decisions, e-KYC and collections systems can affect who gets access to financial services, on what terms, and with what consequences. The regulatory exposure is already significant across Malawi, Kenya and South Africa. If a customer can contest a decision your system made, you need to be able to explain how it was reached, what data and assumptions shaped it, and who is accountable for the outcome. If you can't answer those questions now, waiting for a complaint or regulatory enquiry is an expensive way to discover the gap.
Underwriting, claims and automated advice increasingly bring AI into decisions involving highly sensitive data and significant financial consequences. The question isn't whether AI will enter these processes, but whether the governance around it will be ready when it does. Building that governance before a disputed decision, data incident or regulatory enquiry forces the issue is considerably easier than retrofitting it afterwards.
Vendor tools, HR platforms and third-party scoring engines don't transfer accountability with the purchase order. You still need to understand what the system is doing, what data and assumptions it relies on, how it was validated, and whether its controls are adequate for your context. If you can't demonstrate that oversight, the governance gap already exists, whether or not the vendor says the system is compliant.
How I work
A focused review against a specific regulatory requirement, not a sweeping audit of everything at once. You get a clear answer: what's exposed, what isn't, and what needs fixing first.
The finding becomes a working process: who reviews a flagged decision, what a new AI tool gets checked against before it's bought, what the board or risk committee actually needs to see, not just what the policy says should happen.
Governance has to survive contact with how the business actually runs. Ongoing, that means checking that controls are still operating as intended, reporting back to the board or risk committee on what has changed, and making sure new AI deployments don't quietly create new gaps.
Who I am
I'm Katie Kasambala. My work is shaped by legal experience going back to my admission to the Malawi Bar in 2001, but law is only part of the perspective I bring. My background also spans risk, compliance, business operations and entrepreneurship, and I've spent much of my career not only advising on governance, but making decisions within it.
I've built and run businesses, managed people and budgets, navigated regulatory requirements and made commercial decisions where the right answer was rarely as simple as choosing between compliance and non-compliance. I've done this across Malawi, South Africa and Kenya, working within different industries and regulatory environments.
That experience matters because responsible governance cannot be separated from the organisation that has to operate it.
AI governance brings together legal, risk, data and technology considerations with questions of accountability and human impact. My role is to help organisations connect those questions rather than treating them as separate compliance exercises.
My particular focus is human-centred AI governance: understanding not only what a framework or regulation requires, but what needs to be protected, who carries the risk, how responsibility is allocated, and whether the governance arrangements are appropriate to the decisions being made.
Data privacy is an important part of that foundation. My approach is grounded in established data-protection law and regulatory practice, including South Africa's POPIA and the data-protection frameworks in Kenya and Malawi, as well as emerging AI governance standards and frameworks.
I am particularly interested in the governance challenges created when AI enters an organisation through a vendor, platform or third-party system; when global frameworks meet local regulatory and operational realities; and when decisions with real consequences are increasingly delegated to systems that organisations did not design themselves.
The objective is not governance for its own sake. It is governance that gives organisations a basis for making better decisions, knowing where responsibility sits, and being able to stand behind how AI is being used.
Get in touch