What Kenya's new AI Bill means for your business, and what to do before it becomes law
Clients have started asking us a version of the same question over the past few months: what does Kenya's new AI Bill actually mean for us? The honest starting point is that it isn't law yet, and won't be for a while. But the direction it signals is clear enough that waiting until it's enacted to think about it would be a mistake, especially for businesses that already hold ISO/IEC 27001 or are handling personal data under the Data Protection Act.
Where the Bill actually stands right now
The Artificial Intelligence Bill, 2026 was published as a Senate Bill. As of this writing it has not yet been tabled before the Senate, and because it touches on county government functions, it will also need to go through the National Assembly before it can reach presidential assent. In other words, there's a real legislative process still ahead of it, and the detailed rules that will actually govern compliance (how AI systems get classified by risk, for instance) are explicitly left to future regulations rather than spelled out in the Bill itself. Treat anything written about it today, this article included, as a reading of a draft, not a settled legal requirement.
Who the Bill is aimed at
As drafted, the framework would apply broadly: any business that develops, deploys or uses AI systems in Kenya, including international businesses operating in the Kenyan market. That's a wide net. It isn't aimed only at companies building AI models. A business using an AI-powered chatbot for customer service, an automated credit scoring tool, or AI-assisted recruitment screening would all plausibly fall inside scope once the detailed rules exist.
The risk tiers you'll need to classify against
The Bill proposes four categories, loosely modelled on the EU AI Act: unacceptable (effectively banned), high, limited, and minimal risk. Sectors named as likely to carry high-risk systems include things like healthcare, finance, security, employment and public administration, though the precise classification criteria are left to regulations that haven't been written yet. What matters for planning purposes now is simpler: if your AI use touches hiring decisions, credit or financial decisions, health outcomes, or security, assume you'll eventually sit in a higher-scrutiny category and plan accordingly.
What the obligations look like, in practice
For systems likely to be classified high-risk, the draft points toward several concrete obligations: risk and human rights impact assessments carried out before deployment, not after; explainability of how the system reaches its outputs; records of data inputs and performance kept for a minimum of five years; and a mechanism for a qualified human to review and override automated decisions rather than treating the system's output as final. Separately, and this one applies more broadly, there's a general disclosure duty: telling users the nature, purpose and limitations of a system, the extent to which decisions are automated, and what's being done to mitigate bias.
A specific provision worth flagging for anyone working with generated images, voice or likeness: the draft would require explicit consent from the person depicted and clear labelling of the output as AI-generated.
The overlap problem nobody's fully solved yet
If you're already managing obligations under the Data Protection Act 2019, pay close attention here. The Bill's governance structure, an Office of the Artificial Intelligence Commissioner with inspection and enforcement powers, sits alongside the existing Data Protection Act regime rather than replacing it, and legal commentators have flagged a real risk of businesses reporting to two different commissioners over what is functionally the same algorithmic process. Where your AI systems process personal data, which most do, expect your existing data protection impact assessment work to become the foundation you build AI-specific compliance on top of, rather than a separate exercise.
Why this matters more in some sectors than others
If you're in fintech and use any form of automated credit scoring, fraud detection, or algorithmic risk pricing, the stakes here are higher than for most businesses, because financial decision-making is explicitly flagged as a likely high-risk category. The same goes for healthcare providers using AI-assisted diagnostics or triage tools, and for any employer using automated screening or ranking of job applicants, a practice that's become common even among businesses that wouldn't describe themselves as "AI companies" at all. If any of these apply to you, this Bill is worth tracking more closely than a general compliance update, because the compliance burden described (impact assessments, explainability, record-keeping, human override) is not trivial to retrofit onto a system that's already in production.
What to actually do about it now
Inventory your AI use. Most businesses haven't actually listed where AI is used in their own operations, hiring tools, chatbots, fraud detection, marketing personalisation. You can't assess risk you haven't mapped.
Flag anything touching hiring, credit, health or security decisions. These are the use cases most likely to land in a higher-risk tier once classification rules exist.
Lean on work you've already done. If you hold ISO/IEC 27001 or have gone through Data Protection Act compliance, your existing risk assessment methodology and documentation discipline transfers directly. You are not starting from zero.
Don't wait for the final text to start the conversation internally. Legislative timelines in this space tend to move in bursts. Businesses that have already had the internal conversation about where AI sits in their operations will adapt faster than those who haven't.
Keep this on your radar, not your to-do list yet
We're tracking this Bill as it moves through Parliament and will flag anything material as it firms up. If you'd like help mapping where your current AI use might sit once classification rules land, or you want your existing ISMS or data protection documentation reviewed with this in mind, we're happy to talk it through.