Kenya's Government Is Treating AI-Driven Cyber Threats as a National Security Issue - Businesses Need to Take Note

The government has formally escalated AI-enabled cybercrime - deepfakes, fraud, and identity manipulation - to a national security concern. Here is what it means for Kenyan businesses running digital operations.

AI-enabled fraud is now a national security threat in Kenya. The government said so directly in a formal statement this week, marking the first time senior officials have placed AI misuse on the same level as conventional threats to the economy and public order.

The declaration came from Cabinet, which issued a public warning that evolving digital technologies - particularly AI tools capable of generating realistic fakes, manipulating identities, and enabling increasingly sophisticated fraud - are creating risks that go beyond what existing cybersecurity frameworks were designed to handle. The full statement was reported by Citizen Digital, The Star, and KBC.

The specific threats named: AI-generated deepfakes used to impersonate executives and authorize fraudulent transactions; AI-powered phishing campaigns tuned to individual targets; identity manipulation at scale using synthetic voice and video; and automated fraud that adapts faster than human detection teams can respond.

What the Government Is Actually Doing About It

Parliament has approved the establishment of a National Cybersecurity Agency. The government described this as a “major milestone” that will centralize coordination, improve national cyber resilience, and replace the current fragmented response across multiple agencies.

The digital exposure that makes this urgent: Kenya’s eCitizen platform now hosts more than 24,000 government services, serves over 15 million users, and processes approximately 500,000 transactions daily. That concentration of digital activity is both Kenya’s greatest infrastructure achievement and its largest single attack surface.

The government also called on the private sector to treat cybersecurity as core infrastructure, not an IT line item. Officials specifically named financial services, healthcare, logistics, and digital commerce as sectors where AI-driven attacks are most likely to cause serious economic harm.

What This Means for a Kenyan SME or Corporate

The framing matters. When AI threats are categorized as a national security issue, regulatory pressure on businesses follows. In practical terms, this is the direction things are moving in 2026 and 2027:

Deepfake verification is no longer optional. If your business approves payments, contracts, or access requests based on calls, voice messages, or video, you need a second verification channel that does not rely on biometrics alone. The cost of building this now is a fraction of a single fraudulent transaction loss.

AI-generated phishing is targeting Kenyan businesses specifically. Generic spam filters are not trained to catch Swahili-language, M-Pesa-branded, or eCitizen-impersonating scams built with local AI tools. Your staff need updated phishing awareness training that includes AI-generated content.

Compliance requirements are coming. The AI Bill 2026 currently before the Senate will likely require businesses running AI systems to demonstrate governance and risk controls. Getting ahead of this now means you shape your own response rather than react to a regulator.

A Nairobi-based insurance intermediary we work with discovered in early 2026 that a supplier had been impersonated by an AI-generated voice in a payment approval call. The call was indistinguishable from the real contact. The fraud was caught only because the bank flagged an unusual beneficiary account number. The business now requires a written confirmation code for every payment instruction over KSH 50,000.

The Quick Check Your Business Needs This Week

Go through these three questions honestly:

If someone calls your finance team using your CEO’s voice and asks for an urgent wire transfer, what stops it from going through?
Do your staff know what AI-generated email looks like, or are they still looking for spelling mistakes as the main signal?
Does your IT vendor have a current incident response plan, or was the last one written three years ago?

If the answer to any of these is “I’m not sure,” that is the gap to close first. AI Consultancy Kenya runs a half-day AI security audit for SMEs and corporates that covers these three areas specifically. Chat with us on WhatsApp at 0711 344 702 to book one.