AI in Public Service Delivery in Kenya: Rules, Uses, Risks

Kenyan government offices can use AI today, but only inside rules that already bind them: the Data Protection Act 2019, the ICT Authority’s standards and the public procurement law. The safest first uses are assistants that answer citizens from published information, and tools that help officers draft, sort and summarise, with a person making every decision that affects someone’s rights. Anything that decides for a citizen, such as eligibility or enforcement, needs a data protection impact assessment, a human review route and a much higher bar.

This is the strategic overview for national and county officers and co-operative leaders. If you want the cost breakdown for a single citizen-service project, read our companion guide on how Kenyan government offices can serve citizens faster with AI.

Key Takeaways

• Build on eCitizen, not around it. Point your AI assistant to official eCitizen services instead of creating a parallel payment or application channel.
• Do the data protection impact assessment early. The Act says it goes to the Data Commissioner sixty days before processing, so plan for at least ninety.
• Keep a named officer accountable for every AI-assisted decision, and give citizens a way to ask for human review.
• Buy a measured outcome, not “an AI system”. Write the specification around a number you will check, with an exit clause and data ownership in your favour.
• Start with low-risk work: answering questions from published information, drafting and summarising, and sorting incoming requests.

What does Kenya’s AI policy say about government use of AI?

There are three layers, and only one of them is law.

The National AI Strategy 2025-2030. The ICT Ministry launched it on 27 March 2025 at KICC, and Citizen Digital reported that at least KSh 152 billion is needed to implement it by 2030, with digital infrastructure taking 50 per cent of the budget. The draft published for comment in January 2025 set out three pillars (AI digital infrastructure, a data ecosystem, and AI research and innovation) and named public service delivery as a priority sector, described as “optimizing government services through AI-driven solutions”, according to ITEdgeNews.

The draft Kenya Artificial Intelligence and Other Emerging Technologies Policy 2026. The Ministry opened it for public comment on 28 July 2026 with a deadline of 4 August 2026, as Capital FM reported. The Star’s summary lists provisions that matter directly to public offices:

• Government agencies are expected to use AI to speed up service delivery and reduce bureaucracy.
• People must be told when they are dealing with an AI system rather than a human.
• Citizens can question important algorithmic decisions or ask for a review.
• Organisations deploying AI must comply with the Data Protection Act.
• A Kenya AI Safety Institute would assess high-risk systems before wide deployment, and an AI Governance Act is planned.

At the time of writing we could not find a final adopted version, so treat it as direction of travel, not law.

Political direction. On 30 June 2026 Cabinet approved a Standing Cabinet Committee on Artificial Intelligence to steer the national strategy, coordinate policy across government and “improve public service delivery”, according to People Daily. In September 2026 the ICT Authority’s CEO, Jessy Maruti, put the accountability point bluntly: “Government accountability cannot be delegated to a vendor or an algorithm,” Capital FM reported.

Our view: design every project as if the draft policy were already law. Disclosure and human review cost little at the start and a lot after a complaint.

Where does eCitizen fit into government AI plans?

eCitizen is the spine. It started in 2014 as a pilot with 41 services, and Treasury published draft Public Finance Management (eCitizen System Management) Regulations, 2026 to make it the official government portal for payment and access to services, The Star reported. By November 2023 the Secretary to the Cabinet said Kenyans could reach more than 14,000 government services on it (Capital FM). In July 2026 Deputy President Kithure Kindiki said 16.5 million adult Kenyans pay for government services digitally through the platform, and annual revenue through it had reached KSh 539 billion, up from KSh 20 billion in 2022 (Kenyans.co.ke).

Government’s own AI assistants are still early. GovStack described a conversational chatbot to be integrated into eCitizen, with the Kenya Film Commission as pilot institution, and in September 2024 said its service design had “just started” (GovStack). In August 2026 the ICT Cabinet Secretary unveiled Kabogo.AI, an assistant meant to route citizens to the right agency or service, but the platform was “still being prepared” and will launch only once review safeguards are in place (Kenyans.co.ke).

What this means for a county or agency: your AI should explain, route and remind, not collect payments or applications that belong on eCitizen.

Which AI uses work in public service, and which are risky?

The risk rises with how much the tool decides on its own and how personal the data is. Senior officials already talk about high-risk uses: Deputy Head of Public Service Amos Gathecha listed crime detection with predictive algorithms alongside traffic control and digital identity in May 2025 (Kenya News Agency). Those are not where a county office should start.

We hold one strong opinion here: a public office should not let AI publish anything to citizens without a human check. We learned this running our own AI publishing desk: an AI writer will invent statistics and client stories unless checks stop it, and a human-written rule set plus automated checks are what make AI content publishable. For a fuller risk framework, see our guide to AI governance and risk management for Kenyan enterprises.

What does the Data Protection Act require before a public office uses AI?

Four duties come up in almost every public sector AI project.

1. Registration. State and county departments and corporations must register with the Office of the Data Protection Commissioner whatever their size, because they are on the list of purposes that require registration (DLA Piper summary).

2. A data protection impact assessment (DPIA). Section 31 applies “where a processing operation is likely to result in high risk to the rights and freedoms of a data subject” (Data Protection Act text), and the Act says the reports “shall be submitted sixty days prior to the processing of data” (next page of the Act). This is not paperwork the courts ignore. In October 2021 the High Court quashed the Huduma Namba card rollout decision because the state “erred by not conducting a data protection impact assessment before rolling out the cards” (The Star).

3. Automated decisions. Section 35 gives every data subject “a right not to be subject to a decision based solely on automated processing” where it has legal or similarly significant effects, with limited exceptions (Act, section 35). For government this is the line between “AI helps the officer” and “AI decides”.

4. Breach notification and penalties. A controller must notify the Data Commissioner of a breach posing a real risk of harm within seventy-two hours of becoming aware of it, and penalty notices can reach KSh 5 million or 1 per cent of annual turnover, whichever is lower (DLA Piper).

Our view: the DPIA is the cheapest insurance a public office can buy. It forces the questions vendors skip: where data is stored, who sees it, and what happens when the tool is wrong.

How do you buy AI under PPADA without getting stuck?

Public entities buy under the Public Procurement and Asset Disposal Act 2015, and the practical realities in 2026 are these.

• AGPO still applies. In every State Department and agency, “30 percent of procurement is set aside for youth, women, and persons with disabilities”, and suppliers must register on the e-GP system to benefit, a Principal Secretary said in October 2025 (Kenya News Agency).
• e-GP is the direction, but its mandate has been contested. On 8 September 2025 the High Court stayed the circular making e-GPS mandatory, and until further orders entities may receive tenders electronically or manually under section 77(1) (Eastleigh Voice). Treasury has kept pushing: on 25 August 2026 the CS directed that all 47 counties complete e-GP integration with IFMIS by the end of September 2026 (Kenyans.co.ke). Check the current position with your procurement unit before you advertise.
• ICT Authority standards bind the build. The Authority says “all national and county government ICT projects must comply before rollout”, and lists standards including Systems and Applications, Information Security, Cloud Computing and Electronic Records Management (ICT Authority). Put the relevant standards into your tender document so bidders price compliance in.

In our view the costliest procurement mistake is buying “an AI chatbot” with a feature list. Specify the outcome instead: the questions it must answer, the languages, the handover to a human, the measure you will check after three months, who owns the data, and how you leave the vendor. A bidder who refuses an exit clause has told you enough.

Worked example: planning a permits assistant for a county office

This is a hypothetical example. The figures are stated assumptions, not results from a client.

Assume a county trade licensing office in Western Kenya receives 200 phone calls a day, each taking 4 minutes. That is 200 x 4 = 800 minutes, or 800 / 60 = about 13.3 staff hours a day on the phone.

The office plans a web and WhatsApp assistant that answers only from the county’s published licence list, fee schedule and document checklist, and passes anything else to an officer. Assume it handles 30 per cent of the questions callers now phone about. Calls fall by 200 x 0.30 = 60 a day, saving 60 x 4 = 240 minutes, or 4 staff hours a day. That is half an officer’s working day, freed for the counter queue. Treat the 30 per cent as a test, not a promise: count calls for a full month before launch and compare.

Now the timeline. The assistant will take names and phone numbers for follow-up, so the office decides a DPIA is prudent. Target go-live is 1 July 2027. Sixty days before 1 July is 2 May 2027 (29 days left in May after the 2nd, plus 30 in June, plus 1 July = 60). The legal minimum is to submit by 2 May. The safe working target is 90 days, so submit by 2 April 2027, which leaves a month for questions from the Data Commissioner without moving the launch.

The caveat: many residents will still phone or walk in, and one wrong fee that spreads can wipe out the gain. The approved content list is the real project. For the build options and their trade-offs, see our guide to AI chatbot development in Kenya.

What should co-operatives take from this?

Co-operatives are not government offices, but the Data Protection Act applies to them too, and member data is exactly what an AI tool will touch. Registration exemptions cover only organisations with turnover below KSh 5 million and fewer than 10 employees, and not when they process data for a listed purpose (DLA Piper). Check your position before loading a member register into any AI tool.

The sensible first projects are the same: answering member questions from approved information, drafting AGM notices and sorting member requests. Get member records in order first; our guide on how a Kenyan co-op can manage hundreds of farmer members digitally covers that groundwork.

How to start an AI project in your office this week

1. Pick one service with a queue you can count. Permit calls, repeated counter questions or a letter backlog. Write down today’s number.
2. List the approved content. Gather the published fees, checklists, hours and eCitizen links. If they conflict, fix them first.
3. Check your data protection position. Confirm ODPC registration and ask your data protection officer whether a DPIA is needed. Plan the sixty-day submission, then add a month.
4. Name the accountable officer and review route. Decide who signs off answers, how citizens reach a human, and how the tool discloses it is an AI.
5. Talk to procurement before vendors. Confirm the method, AGPO implications, e-GP position and the ICT Authority standards for the tender.
6. Write an outcome-based specification. One measured goal, a three-month check, data ownership, hosting location and an exit clause.
7. Run the pilot as an experiment. One service, compared against the step 1 baseline, then expand, change or stop on the number.

For how other Kenyan public offices sequence the wider digital work, see public sector digital transformation in Kenya: lessons from the field.

Mistakes to avoid

• Building a parallel channel to eCitizen. It confuses citizens and runs against government policy on a single portal.
• Skipping the DPIA because the tool is “only a chatbot”. The Huduma Namba ruling shows courts will stop a rollout for this.
• Letting AI decide eligibility or penalties. Section 35 gives citizens a right against solely automated decisions with significant effects.
• Pasting citizen records into free public AI tools. That is processing personal data outside your controls.
• Buying features instead of outcomes. A feature list cannot be measured; a reduction in calls can.
• No baseline. Without a count before launch, nobody can show the project worked.

Frequently asked questions

Is it legal for a Kenyan government office to use AI?

Yes. No law bans it, and the National AI Strategy names public service delivery as a priority sector. The Data Protection Act, ICT Authority standards and procurement law all apply, and the draft 2026 AI policy adds expectations such as disclosure and human review.

Does every government AI project need a data protection impact assessment?

Section 31 requires one where processing is likely to result in high risk to people’s rights. An assistant answering from published information with no personal data may not reach that bar, but anything that profiles, scores or decides about people almost certainly does. When unsure, do one; it is cheaper than a halted rollout.

Can a county use ChatGPT or other public AI tools for official work?

Officers can use approved tools to draft and summarise non-confidential text, with a person checking the output, but never paste personal data or confidential documents into consumer accounts. Write down which tools are allowed before people improvise.

How should AI be procured under PPADA?

Through the normal methods in the Public Procurement and Asset Disposal Act 2015, with AGPO set-asides respected and the e-GP position checked with your procurement unit. Specify a measured outcome, the relevant ICT Authority standards, data ownership and an exit clause.

Who is accountable when an AI tool gives a citizen wrong information?

The public body is. As the ICT Authority’s CEO put it in September 2026, government accountability cannot be delegated to a vendor or an algorithm. Name a responsible officer and publish how citizens can ask for a human review.

The bottom line

AI can take real pressure off Kenyan public offices, but the wins come from boring groundwork: one counted problem, approved content, an early DPIA, a clean tender and a named officer who owns the result. Expand only what the numbers support.

If you want a second opinion on where AI fits in your office or co-operative, our free AI Business Assessment is a good first conversation, and every quote we give is written and based on scope. WhatsApp us on 0711 344 702.