AI Rules and Regulations in Kenya (2026): What Applies to Your Business Now
Kenya has no AI law yet, but the Data Protection Act already governs AI that uses personal data. What is in force, what is proposed, and what to do now.
Kenya does not yet have a law written specifically for artificial intelligence, but a business using AI in Kenya is not in a legal vacuum. The Data Protection Act 2019 already applies to any AI that handles personal data, and two new instruments, the Artificial Intelligence Bill 2026 and a draft national AI policy, show where the rules are heading.
Here is what is in force today, what is only proposed, and what a business should do now.
What is law today: the Data Protection Act 2019
The Data Protection Act 2019 is enforced by the Office of the Data Protection Commissioner (ODPC). It covers AI whenever the system collects or uses personal data, such as customer chats, phone numbers, loan applications or staff records.
Section 35 matters most for AI. It gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects on them or significantly affects them. The exceptions are decisions needed for a contract with the person, decisions authorised by law with safeguards, and decisions made with the person’s consent. When a business does make such a decision automatically, it must tell the person in writing as soon as reasonably practicable.
The ODPC can fine up to KSh 5 million or 1 percent of the previous year’s annual turnover, whichever is lower.
What is a plan, not a law: the National AI Strategy 2025-2030
The Ministry of Information, Communications and the Digital Economy launched the Kenya AI Strategy 2025-2030 on 27 March 2025. It sets national priorities around digital infrastructure, data, and AI research and innovation, supported by governance, talent, investment, and ethics and inclusion. It guides government action; it does not place legal duties on businesses.
What is proposed: the AI Bill 2026 and the draft AI policy
The Artificial Intelligence Bill, 2026 was published on 17 June 2026 as a Senate bill, according to EY’s summary. It is not law yet. If passed as written, it would:
- create an independent Office of the Artificial Intelligence Commissioner
- classify AI systems by risk, with extra duties for “high-risk” systems
- require high-risk systems to have risk and human rights impact assessments before deployment, human oversight, and records kept for at least five years
- require providers to tell users the nature, purpose and limitations of their AI systems
Separately, the Ministry published a draft Kenya Artificial Intelligence and Other Emerging Technologies Policy 2026 for public consultation, which closed on 4 August 2026, Techweez reports. It proposes institutions such as a Kenya AI Safety Institute for testing and risk classification and a public AI registry. It still needs Cabinet approval.
| Instrument | Status | Binding on businesses? |
|---|---|---|
| Data Protection Act 2019 | In force, enforced by the ODPC | Yes, whenever AI uses personal data |
| National AI Strategy 2025-2030 | Launched March 2025 | No, it guides government |
| Artificial Intelligence Bill 2026 | Published June 2026, before the Senate | Not yet |
| Draft AI and Emerging Technologies Policy 2026 | Consultation closed August 2026 | Not yet |
What Kenyan businesses should do now
For an SME using a chatbot, a CRM with AI features or automated loan or hiring checks, the practical rules today come from the Data Protection Act. Three steps cover most of it:
- Know what personal data your AI touches and why, and make sure customers are told.
- Keep a human in the loop for decisions that matter. If an AI system approves loans, screens job applicants or sets prices for a person, have a person review the outcome, or rely on one of the Section 35 exceptions and tell the customer.
- Keep simple records of what each AI system does and how you checked it. If the AI Bill passes in something like its current form, documentation is likely to be required for higher-risk uses anyway.
For banks, SACCOs, insurers, hospitals and schools, the systems most likely to count as high-risk under the bill are those that decide on credit, health, education or employment. These organisations should follow the bill’s progress through the Senate.
This article explains the rules in plain terms; it is not legal advice. For your own situation, speak to a lawyer or to the ODPC.
Talk to us on WhatsApp at 0711 344 702, we help Kenyan businesses use AI in ways that stay on the right side of these rules.
What this means for your business
If your AI uses customer or staff data, the Data Protection Act 2019 already applies. The AI Bill 2026 and the draft AI policy are not law yet, but they show where rules are heading.
Want to apply this in your business?
We work with businesses in Nairobi, Mombasa, Kisumu, and across Kenya to turn developments like this into practical tools. Chat with us - no commitment required.
Chat on WhatsApp