Published: March 2026 • Reading time: ~12 minutes
Kenya is on the cusp of making history. The Artificial Intelligence Bill, 2026, sponsored by nominated Senator Karen Nyamu and currently under debate in the Senate, represents the country’s first comprehensive attempt to regulate how AI systems are developed, deployed, and used within its borders. If enacted, it would position Kenya among the first nations in Africa to establish a dedicated legal framework for artificial intelligence.
AI adoption is accelerating across Kenya’s economy, from mobile lending algorithms that determine who gets a loan, to diagnostic tools in rural health clinics, to chat bots handling customer service for major banks. Yet until now, there has been no single piece of legislation governing how these systems operate or who is accountable when they cause harm.
The urgency was underscored in February 2026, when the High Court of Kenya issued an order in response to an urgent petition arguing that the absence of safeguards for high-risk AI systems threatens fundamental rights, including privacy and equality. Senator Nyamu has also cited the harassment of female politicians through AI-generated imagery as a direct motivator behind the legislation.
This post breaks down what you need to know about the bill: its governance architecture, what it means for developers and businesses, the rights it grants to ordinary Kenyans, and the concerns critics have raised about its practical feasibility.
What the bill proposes: a three-tier governance architecture
At the heart of the legislation is an ambitious institutional design. The bill creates three new government bodies to oversee AI in Kenya, each with a distinct mandate.
- The Office of the Artificial Intelligence Commissioner
- The Artificial Intelligence Authority
- The Artificial Intelligence Advisory Council
Key takeaway: The structure separates enforcement (Commissioner), standard-setting and ecosystem support (Authority), and strategic advice (Council). Critics argue it could also create duplication and regulatory confusion.
Risk-based classification (borrowing from the EU playbook)
The bill adopts a risk-based regulatory model aligned with the EU AI Act. AI systems would be classified by the level of risk posed to health, safety, fundamental rights, the environment, or societal welfare. Higher risk means stricter compliance.
High-risk systems include AI used in:
- Healthcare diagnostics
- Credit scoring
- Biometric identification
- Law enforcement
- Education
- Public administration
Developers and operators of high-risk systems would need prior approval before deployment, plus mandatory registration, regular audits, and ongoing conformity assessments.
Cracking down on deepfakes and synthetic media
With the 2027 General Elections on the horizon, the bill targets deepfakes and deceptive synthetic media.
- AI-generated content that resembles real persons, places, or events must be clearly labelled as artificially generated.
- Creating or distributing harmful deepfakes intended to deceive, defame, or spread misinformation can carry criminal penalties, including fines up to KES 5 million or imprisonment up to two years, or both.
New digital rights for Kenyan citizens
The bill grants several rights aimed at automated decision-making:
- Right to explanation: People can request a plain-language explanation of how an AI system reached a significant decision (loan rejection, hiring, welfare assessment).
- Right to human review: Anyone affected by an automated decision can request review by a qualified human.
- Privacy and data protection: AI training and deployment must comply with Kenya’s Data Protection Act (2019).
Regulatory sandboxes: balancing innovation with safety
To avoid stifling innovation, the bill introduces regulatory sandboxes, controlled environments where startups can test AI products under supervision, often with relaxed compliance during testing.
Operational details (eligibility, duration, and exit requirements) would be set through subsidiary regulations.
Penalties and enforcement: where Kenya goes further than most
The enforcement posture is unusually strong:
- Fines up to KES 5 million (or a percentage of annual turnover)
- Potential imprisonment for certain violations (deepfakes, prohibited systems, failure to conduct required risk assessments)
This criminal liability dimension goes beyond jurisdictions like the EU and UK, which primarily rely on administrative fines.
Extending governance to county governments
The bill explicitly applies to Kenya’s devolved structure. County governments would be expected to integrate AI in devolved sectors (health, agriculture, education) while meeting compliance standards for any public-sector AI deployment.
The case against: criticisms and concerns
Critiques cluster around:
- Institutional overlap: Kenya already has the ODPC and the Communications Authority. Adding three new bodies could fragment oversight and raise compliance burdens.
- The open-source problem: Local developers often adapt open models trained abroad, and may not have access to full training data and audit trails.
- Cost and funding: Building new institutions and ongoing compliance reviews could be costly for government and for startups.
- Vague definitions and overreach: Terms like “harmful AI-generated content” and “high-risk” could be interpreted too broadly and risk censorship.
- Enforcement against global players: Kenya may only be able to regulate local deployment rather than compel global model providers to submit to audits.
Counterpoint: Supporters argue the bill’s value lies in regulating deployment, because real-world impacts happen in Kenya and affect Kenyans.
The bigger picture: Kenya’s digital governance trajectory
The bill builds on Kenya’s National AI Strategy 2025–2030 and sits alongside milestones such as the Data Protection Act (2019) and the Virtual Asset Service Providers Act (2025).
It places Kenya among jurisdictions moving aggressively on AI governance, following the EU AI Act’s risk-based approach while going further on criminal penalties and county-level coverage.
What happens next?
The bill is under deliberation in the Senate. If it passes both houses of Parliament and receives presidential assent, it becomes law. Given the breadth of concerns, significant amendments are possible.
Questions likely to shape the final form include:
- Whether the three-body architecture is streamlined
- How high-risk sectors are defined more precisely
- Whether SMEs get meaningful exemptions
- How sandboxes work in practice
- Whether criminal penalties are narrowed to the most serious offenses
Conclusion
Kenya’s Artificial Intelligence Bill, 2026 is ambitious, imperfect, and necessary. It tackles deepfakes, discrimination, and opaque automated decisions while trying to preserve space for innovation. Whether it gets the balance right will depend on the quality of parliamentary debate, engagement with the tech community, and political discipline in drafting enforceable, precise rules.