AI Regulation in Kenya: What Businesses Need to Know

Artificial intelligence (AI) is transforming how businesses operate, from customer service and recruitment to financial decisions and data analysis. However, adopting AI also creates legal risks involving privacy, discrimination, cybersecurity and accountability. Businesses operating in Kenya should understand the current regulatory framework and prepare for potential changes.

1. Understand Kenya’s Existing Legal Obligations

The Data Protection Act, 2019, may apply where AI systems process personal data. Businesses must assess their lawful basis for processing, protect personal information and respect data subjects’ rights. Depending on the activity, registration with the Office of the Data Protection Commissioner (ODPC) and a data protection impact assessment may also be required.

2. Follow the Artificial Intelligence Bill, 2026

The proposed Artificial Intelligence Bill, 2026, seeks to establish a dedicated framework for the development, deployment and use of AI in Kenya. Among its proposals are an Office of the Artificial Intelligence Commissioner and specific safeguards for high-risk AI systems, including risk assessments, human oversight, transparency, record-keeping and cybersecurity measures.

Importantly, the Bill has not become law. In October 2026, a Senate committee recommended that the Senate should not proceed with it, raising concerns about regulatory duplication, compliance costs and potential effects on innovation. Businesses should therefore distinguish proposed requirements from obligations already in force.

3. Assess AI Risks Before Deployment

Businesses should evaluate whether AI tools could produce discriminatory outcomes, inaccurate decisions or unauthorised disclosures of confidential information. Human review is particularly important where AI informs employment, lending, healthcare or other decisions affecting individuals’ rights.

4. Review Vendors and Data Practices

Before adopting third-party AI tools, review contracts, data storage arrangements, confidentiality protections, intellectual property ownership and whether submitted information may be used to train external models. Cross-border transfers of personal data require particular attention.

5. Establish Internal AI Governance

Create clear policies on approved AI tools, employee use, human accountability, security and incident reporting. Assign responsibility for reviewing AI-related legal and operational risks.

Conclusion

Responsible AI adoption requires more than technological readiness. Businesses that establish sound governance and monitor regulatory developments can reduce legal exposure while embracing innovation. Grace Alice Advocates supports businesses with technology regulation, data protection and AI compliance.