Contact usGet started

Frameworks · Kenya

AI governance frameworks and AI regulation in Kenya

Kenya has no AI-specific law in force. It governs AI through the Data Protection Act 2019, whose section 35 covers solely automated decisions, with draft AI guidance from the Office of the Data Protection Commissioner and the Central Bank of Kenya. A Senate AI bill and a draft national AI policy are in progress.

Who regulates AI here

Kenya

Kenya regulates automated decisions through the Data Protection Act 2019, with draft AI guidance from the Data Protection Commissioner and the Central Bank of Kenya, and an AI bill before the Senate.

LawKenya DPA section 35Kenya Data Protection Act 2019 and automated decision-makingSection 35 of Kenya's Data Protection Act 2019 limits solely automated decisions with significant effects. Exceptions, the notice and review duty, and AI.In force since 25 November 2019Regulator guidanceODPC AI Guidance NoteODPC Guidance Note on Artificial IntelligenceThe Kenya ODPC's draft Guidance Note on Artificial Intelligence applies the Data Protection Act to AI. High-risk uses, DPIA triggers and governance.Draft dated July 2026, consulted on, final version not yet publishedRegulator guidanceCBK AI Guidance NoteCBK draft Guidance Note on Artificial Intelligence in the Banking SectorThe Central Bank of Kenya's draft Guidance Note on AI would require CBK approval before deploying AI, an annual AI register and 24-hour AI incident reports.Draft for public comment until 7 November 2026

All Kenya frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Kenya

Frameworks elsewhere

Guides

Questions

Does Kenya have an AI law?

Not yet. The Artificial Intelligence Bill 2026, Senate Bills No. 4 of 2026, had its first reading on 2 April 2026, and in October 2026 the Senate's ICT committee recommended that the Senate not proceed with it. The government published a draft Kenya AI and Other Emerging Technologies Policy in July 2026 that plans an AI governance act. Until one passes, the Data Protection Act 2019 is the main binding rule for AI that processes personal data.

Is there a right not to be subject to automated decisions in Kenya?

Yes. Section 35 of the Data Protection Act 2019 gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them. Where such a decision is taken, the person must be told in writing and can ask for it to be reconsidered or retaken.

Does the Central Bank of Kenya regulate AI?

It is consulting on it. CBK published a draft Guidance Note on Artificial Intelligence in the Banking Sector on 10 September 2026, with comments due by 7 November 2026. As drafted, it would require CBK approval before deploying AI, an annual AI register and notice of material AI incidents within 24 hours.

What is the Kenya AI Strategy?

The Kenya Artificial Intelligence Strategy 2025 to 2030, launched on 27 March 2025 by the Ministry of Information, Communications and the Digital Economy. It sets priorities for infrastructure, data, research, talent, governance, investment and ethics, and proposes a soft regulatory framework first, with an AI act as the sector matures.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us