Navigating AI Regulation in Kenya: What Companies Need to Know

Artificial intelligence is changing how Kenyan businesses lend money, hire staff, serve customers, diagnose patients and detect fraud. Kenya does not yet have a single, dedicated AI law, but that does not mean AI is unregulated. Existing laws on data protection, consumer protection, cybercrime, intellectual property, employment and sector regulation already apply to AI systems. This guide explains the current legal position and the practical steps companies should take to use AI responsibly and lawfully in Kenya.

Key takeaways

• There is no standalone AI Act in Kenya yet, but existing laws already govern how AI is built and used.
• The Data Protection Act, 2019 is the most important law for AI, especially its rules on automated decision-making and profiling.
• The Kenya National AI Strategy 2025–2030 signals the direction of future regulation: ethical, inclusive and risk-based AI.
• Companies remain legally responsible for decisions and outputs produced by AI tools they deploy.
• An AI governance framework, impact assessments and clear contracts with AI vendors are the best protection.

Kenya's policy direction on AI

Kenya has positioned itself as a technology hub, and government policy reflects this. The Distributed Ledgers and Artificial Intelligence Taskforce reported in 2019 on how emerging technologies could support national development. In 2025, the Ministry of Information, Communications and the Digital Economy launched the Kenya National Artificial Intelligence Strategy 2025–2030, which focuses on digital infrastructure, data, research, skills and governance, and commits to developing an ethical and risk-based regulatory approach.

Several legislative proposals on AI and robotics have also been tabled in Parliament. Companies should monitor these closely: future rules are likely to impose obligations based on the level of risk an AI system poses, similar to approaches taken in other jurisdictions.

Laws that already apply to AI in Kenya

1. Data Protection Act, 2019

Most AI systems are trained on, or make decisions about, personal data. The Data Protection Act therefore applies to most commercial AI use. Key obligations include:

• Lawful basis and purpose limitation: personal data must be collected for explicit, specified and legitimate purposes, and not reused for unrelated AI training without a lawful basis.
• Automated decision-making: under section 35, a person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects them, subject to limited exceptions. Where an exception applies, the data controller must notify the individual and allow them to ask for reconsideration or human intervention.
• Data protection impact assessments: processing that is likely to result in high risk, such as large-scale profiling or the use of new technologies, requires a DPIA before it starts.
• Transparency: individuals must be told how their data is used, including the logic involved in automated decisions.
• Cross-border transfers: sending personal data to foreign AI providers or cloud platforms must meet the Act's transfer safeguards.

For a full overview, read our article on Kenya's Data Protection Act.

2. Constitution of Kenya, 2010

Article 27 prohibits discrimination and Article 31 protects privacy. AI systems that produce biased outcomes, for example in recruitment, lending or insurance, may expose a company to claims that it has discriminated on prohibited grounds such as sex, ethnicity, disability or age. Article 47 requires fair administrative action, which is relevant where public bodies use AI to make decisions about individuals.

3. Consumer Protection Act and Competition Act

Businesses must not make false or misleading representations to consumers. Overstating what an AI product can do, failing to disclose that customers are dealing with a chatbot where that matters, or using AI to manipulate consumers can amount to unfair practices. The Competition Authority of Kenya can also act against algorithmic pricing that facilitates collusion or abuses a dominant position.

4. Computer Misuse and Cybercrimes Act, 2018

The Act creates offences such as unauthorised access, computer fraud, identity theft and the publication of false information. AI-generated deepfakes, impersonation and automated fraud can fall within these offences, and the Act has been amended to strengthen its provisions on online harms.

5. Intellectual property law

The Copyright Act protects works created by human authors. Questions remain about who owns AI-generated content and whether training AI on copyrighted works without a licence infringes copyright. Companies should secure clear contractual rights over AI outputs and confirm that training data was lawfully obtained. See our guide on intellectual property law in Kenya.

6. Employment law

AI tools used to screen candidates, monitor staff or assess performance must comply with the Employment Act's prohibition on discrimination and with data protection rules on employee monitoring. Decisions to dismiss must still follow a fair procedure with a human decision-maker.

7. Sector regulation

• Financial services: the Central Bank of Kenya expects banks and digital credit providers to manage model risk, treat customers fairly and protect data. AI credit scoring must be explainable and non-discriminatory.
• Capital markets: the Capital Markets Authority regulatory sandbox allows testing of innovative products, including robo-advisory services.
• Healthcare: AI diagnostic tools may require approval as medical devices and are subject to health data confidentiality rules.

Who is liable when AI gets it wrong?

Kenyan law does not recognise AI as a legal person. Liability therefore falls on the people and companies who develop, sell or deploy AI. Depending on the facts, claims may arise in negligence, breach of contract, breach of statutory duty, defamation, discrimination or product liability. A company that relies on an AI tool to make a decision is generally treated as having made that decision itself.

AI compliance checklist for Kenyan companies

1. Keep an inventory of AI systems used in the business, including third-party tools used by staff.
2. Classify each system by risk, focusing on uses that affect people's rights, finances, health or employment.
3. Carry out a data protection impact assessment for high-risk uses.
4. Ensure meaningful human review of significant automated decisions.
5. Test for bias and accuracy before deployment and at regular intervals.
6. Update privacy notices to explain AI use in plain language.
7. Review vendor contracts for data use, confidentiality, IP ownership, security and liability.
8. Adopt an acceptable-use policy for generative AI tools to protect confidential and client information.
9. Assign board-level responsibility for AI governance.

Frequently asked questions

Is AI regulated in Kenya?

There is no dedicated AI statute yet, but AI is regulated indirectly by the Data Protection Act, the Constitution, consumer protection, cybercrime, intellectual property and sector-specific laws.

Can a company use customer data to train AI?

Only if it has a lawful basis under the Data Protection Act, the use is compatible with the purpose for which the data was collected, and customers have been informed. Anonymisation can reduce risk, but must be robust.

Who owns content created by AI?

The position is not settled in Kenya. Copyright traditionally protects human authorship, so companies should rely on contracts with AI providers and employees to secure rights over outputs.

How W.O.A. Advocates can help

We advise technology companies, financial institutions and corporates on AI governance, data protection compliance, technology contracts and regulatory engagement. Talk to our technology law team about deploying AI safely in Kenya.