Artificial Intelligence · Kenya
AI regulation in Kenya: laws & policy (2026)
Kenya shaded by its artificial intelligence status
AI in Kenya: proposed.
FrameworkArtificial Intelligence Bill, 2026 (Senate Bill No. 4 of 2025) pending in Parliament; Kenya National AI Strategy 2025-2030 (non-binding); Data Protection Act, No. 24 of 2019 (sectoral automated-decision provisions enforced by the Office of the Data Protection Commissioner)
Kenya has no comprehensive AI law in force. The Ministry of Information, Communications and the Digital Economy launched the non-binding Kenya National AI Strategy 2025-2030 in March 2025, and the Artificial Intelligence Bill, 2026 was tabled in the Senate (first reading April 2026) proposing a risk-based framework and an Office of the AI Commissioner, but it remains at committee stage and not yet law. In the meantime, AI-adjacent conduct is governed sectorally, principally by the Data Protection Act 2019 (right against solely automated decisions) and a draft AI and Emerging Technologies Policy being finalised in 2026.
Key points
The Artificial Intelligence Bill, 2026 was published as Senate Bills No. 4 of 2025 and received first reading on 2 April 2026; it was committed to the Senate Standing Committee on ICT and, because it affects counties, must also pass the National Assembly before presidential assent. It is therefore not yet in force.
The Bill adopts an EU-style four-tier classification (unacceptable, high, limited, minimal risk) with prohibitions on unacceptable-risk uses, conformity assessments for high-risk systems, and criminal penalties of up to KES 5 million and/or two years' imprisonment.
The Bill would establish an independent Office of the Artificial Intelligence Commissioner responsible for risk assessments, conformity audits, post-market surveillance, guidelines, AI-literacy promotion, and enforcement.
The Ministry of Information, Communications and the Digital Economy launched the Kenya National AI Strategy 2025-2030 in March 2025. It is a policy roadmap built around three pillars — AI digital infrastructure, data ecosystems and governance, and AI research/innovation/commercialisation — with cross-cutting enablers on ethics, skills and governance; it does not create binding obligations.
Section 35 of the Data Protection Act, No. 24 of 2019 gives data subjects the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, with rights to notification and human reconsideration; enforced by the Office of the Data Protection Commissioner.
The Ministry of ICT published a draft Kenya AI and Other Emerging Technologies Policy, 2026 to complement the Strategy, intended for finalisation during 2026; it remains a draft policy and not legislation.
Timeline - major decisions & events
The Ministry of Information, Communications and the Digital Economy launched Kenya's first National AI Strategy, setting a government-led, five-year roadmap across infrastructure, data, talent, governance and ethics. It signals Kenya's intent to lead AI adoption in Africa while flagging future legislation.
Ministry of ICT & Digital Economy ↗The Ministry of ICT published the draft Kenya National AI Strategy for public validation, the culmination of a consultative process begun in April 2024. It opened the framework to stakeholder input before the March 2025 launch.
Ministry of ICT & Digital Economy ↗The Kenya Bureau of Standards published a draft Code of Practice for AI Applications for public review (consultation closed 13 June 2024), establishing a voluntary framework for trustworthiness, risk management, testing and ethics. It draws on ISO/IEC standards and the EU AI Act.
Kenya Bureau of Standards (KEBS) ↗A bill proposing a licensing body for robotics and AI practitioners (with fines and jail terms for unlicensed activity) was conveyed to Parliament via public petition. Industry groups strongly opposed it as unworkable, and it stalled, shaping the case for a strategy-led rather than licensing-led approach.
Parliament of Kenya ↗The Office of the Data Protection Commissioner imposed administrative fines totalling KES 9.375M on three data controllers, marking the first enforcement under the Data Protection Act. It demonstrated that automated/data-driven processing in Kenya carries real enforcement risk.
Office of the Data Protection Commissioner ↗The High Court ruled that the government could not roll out Huduma cards without first conducting a Data Protection Impact Assessment, holding that the Data Protection Act applied. The decision cemented DPIAs as a binding precondition for high-risk, data-intensive state systems.
Privacy International ↗Kenya appointed its inaugural Data Protection Commissioner, activating the regulator responsible for enforcing automated-decision and profiling rights and high-risk processing safeguards. This stood up the institution that now anchors AI/data oversight.
Office of the Data Protection Commissioner ↗One of the world's first constitutional rulings to halt an all-purpose biometric digital ID, the court found NIIMS could not proceed without an adequate data-protection legal framework and safeguards. It established judicial limits on state collection of sensitive biometric data.
Privacy International ↗Kenya's foundational data-protection statute (commenced 25 Nov 2019) gave data subjects the right not to be subject to solely automated decisions and profiling, and mandated DPIAs for high-risk automated processing. It remains the primary legal basis governing AI systems in Kenya.
Kenya Law ↗Kenya's first comprehensive cybercrime statute criminalized unauthorized system interference, data interception and computer fraud, building the digital-harms legal backbone now used alongside data law to address AI-enabled misuse. Suspended provisions later took effect after High Court review.
Kenya Law ↗Kenya - other topics
Artificial Intelligence in other countries
Last verified 10/10/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →