Kenya AI regulation

Kenya's Artificial Intelligence Bill 2026 and the draft national AI policy

Kenya has no AI law in force yet, and two tracks are under way. The Artificial Intelligence Bill 2026, a private member's bill in the Senate, would create an Office of the Artificial Intelligence Commissioner, classify AI systems by risk and require risk and human rights impact assessments before high-risk systems are deployed. In October 2026 the Senate's ICT committee recommended that the Senate not proceed with it and that the government finalise its national AI policy first. The government's draft Kenya AI and Other Emerging Technologies Policy, published in July 2026, sets a risk-based approach and plans an AI governance act within a year of adoption. Meanwhile the Data Protection Act 2019 already governs any AI that uses personal data, and regulators such as the ODPC and the Central Bank of Kenya have published draft AI guidance.

Kenya is writing its AI rules on two tracks at once. In the Senate, the Artificial Intelligence Bill 2026 would set up a dedicated AI regulator. In government, the Ministry of Information, Communications and the Digital Economy published a draft Kenya AI and Other Emerging Technologies Policy in July 2026, which plans its own AI governance act. Neither is law yet. This guide sets out what each proposes, what already applies, and the work that holds up whichever version passes.

The Artificial Intelligence Bill 2026

The Bill is Senate Bills No. 4 of 2026, a private member’s bill sponsored by Senator Karen Nyamu. It was published on 19 February 2026 and had its first reading on 2 April 2026. After public participation, which drew 143 submissions, the Senate’s Information, Communication and Technology Committee reported in October 2026 that the Senate should not proceed with the Bill. The committee was concerned that its penalties could deter innovation and investment, and it urged the government to finalise the national AI policy before any AI legislation. The Senate’s bill digest sets out the Bill’s main features.

A regulator. An Office of the Artificial Intelligence Commissioner, recruited through the Public Service Commission and appointed by the President with Parliament’s approval, with powers to inspect systems and records, require information, issue enforcement notices and impose fines.
Risk tiers. The Commissioner would classify AI systems as unacceptable, high, limited or minimal risk. High risk covers systems used in critical sectors including healthcare, education, agriculture, finance, security, employment and public administration.
High-risk duties. Providers and deployers would conduct risk and human rights impact assessments before deployment, ensure transparency, traceability and explainability, keep datasets and documentation, comply with the Data Protection Act, ensure robustness and cybersecurity, and obtain consent to use a person’s likeness or voice. The Commissioner would keep a public register of high-risk systems.
Transparency. Providers and deployers would disclose a system’s nature and purpose, how much automation is involved and the measures taken to mitigate bias, and users would ensure human intervention rights where automated decisions affect individuals.
Workforce. Where AI affects employment, providers would assess potential job displacement and put reskilling in place.

Offences would carry fines of up to five million shillings or two years’ imprisonment for the most serious breaches, and directors who knew of an offence and did not exercise due diligence would be liable too.

The draft Kenya AI and Other Emerging Technologies Policy

The Ministry’s draft policy, dated July 2026, was open for public comment until 4 August 2026. It builds on the Kenya AI Strategy 2025 to 2030, launched on 27 March 2025, which called for a soft regulatory framework first and an AI act as the sector matures.

The draft takes a risk-based approach, with stronger requirements on assessment, documentation, monitoring, security, human oversight and accountability for high-risk systems. It asks for meaningful human control where systems affect rights, safety or access to essential services, and for high-risk agentic deployments to have defined limits on unauthorised actions, the ability to halt a system mid-task and records of the actions taken. People would be entitled to know when an AI system is acting on them.

Its scope is effects-based. It would reach entities outside Kenya whose AI outputs are used in Kenya, and the vendors and model providers that Kenyan organisations rely on. Legacy systems would get two years to submit a retrospective risk assessment and remediation plan, and high-risk legacy systems three years to comply fully. The legislative programme in section 4.5.3 plans an AI and Other Emerging Technologies Governance Act, drafted within six months and enacted within twelve, with AI procurement regulations alongside.

What already applies

While both texts are debated, AI in Kenya is governed by existing law. Section 35 of the Data Protection Act 2019 limits solely automated decisions with legal or significant effects and requires written notice and reconsideration on request. Section 31 requires an impact assessment for high-risk processing. The ODPC’s draft Guidance Note on Artificial Intelligence explains how those duties apply to AI, and the Central Bank of Kenya’s draft Guidance Note on AI in banking adds sector rules for licensed institutions.

Work that holds up whichever text passes

The Bill and the draft policy differ on who regulates, but they ask for the same underlying work, and much of it is already expected under the Data Protection Act.

Know what you run. An inventory of AI systems and agents, with purpose, owner, data, vendor and the people each one affects. The AI system register guide covers what each entry needs.
Classify by risk. A consistent way to sort systems by the harm they could do, so high-risk uses in finance, health, employment or public services are identified early. The AI risk assessment guide sets out a method.
Assess impact on people. For high-risk systems, an assessment of effects on rights, fairness and access to services, which is the core of both the Bill’s human rights impact assessment and a data protection impact assessment.
Keep a human in charge. Review and override for decisions that significantly affect individuals, with authority limits and logs for agents. The human oversight guide covers how to make review real.
Disclose. Tell people when they are dealing with AI and how automated a decision was.

How Aicura supports the work

Aicura is an AI governance platform. Discovery and the AI register build the inventory, assessments classify each system and record its effects on people, policies hold your rules and transparency statements, guardrails enforce them on live traffic, and oversight and monitoring keep a person in charge once a system is running. Aicura does not assess against Kenyan law or the draft policy. It gives you the record those texts would ask for, and the decisions stay with you.

A note on this page

This is Aicura’s reading of the Artificial Intelligence Bill 2026 and the draft Kenya AI and Other Emerging Technologies Policy as published. Both may change before adoption. It is not legal advice. Read the texts as published by Parliament and the Ministry, and take advice on how they apply to your organisation.

Common questions

Is Kenya's AI Bill law?

No. The Artificial Intelligence Bill 2026, Senate Bills No. 4 of 2026, was published on 19 February 2026 and had its first reading in the Senate on 2 April 2026. It is a private member's bill sponsored by Senator Karen Nyamu. In October 2026 the Senate's ICT committee recommended that the Senate not proceed with it, and the decision now rests with the Senate. Even if it went ahead, it would need to pass both houses of Parliament and receive presidential assent before it became law.

What penalties does the AI Bill propose?

According to the Senate's bill digest, deploying an unacceptable-risk system, deploying a high-risk system without the required risk assessment, failing a workforce impact assessment or misusing a person's likeness would carry a fine of up to five million shillings, up to two years' imprisonment, or both. Transparency failures and breaches of ethical guidelines would carry up to one million shillings or six months.

Does the draft national AI policy apply to foreign AI providers?

As drafted, yes. It would apply to entities outside Kenya whose AI systems or services produce outputs used in Kenya or have direct and foreseeable effects on people in Kenya, and to vendors, cloud, compute and model providers whose systems are relied on by actors in Kenya. Compliance could be shown through a substantially equivalent framework assessed by the Cabinet Secretary.

What should organisations in Kenya do before an AI law passes?

Build an inventory of AI systems, classify each by risk and impact, assess the high-risk ones for effects on people, and put human review in place for decisions that significantly affect individuals. That work is already expected under the Data Protection Act and the draft ODPC and CBK guidance, and it is what both the Bill and the draft policy would build on.

Start with the AI you run.

Find the AI in your organisation, give every system an owner and add assessments and guardrails when the work needs them.