Kenya Is Writing Its AI Rulebook

If you build software in Kenya, the biggest story of the year isn't a new phone or a funding round — it's that the government is deciding, right now, how artificial intelligence will be governed. And it's moving fast. As a developer who ships AI-integrated products from Nairobi, here's my plain-English read on what's happening and what it means for the rest of us who build.

What's actually going on with AI regulation in Kenya?

Kenya is regulating AI on two parallel tracks: a Draft AI and Emerging Technologies Policy 2026 (public consultation ran from 21 July to 4 August 2026) and a separate Artificial Intelligence Bill, 2026 working through Parliament. Together they would create a national AI regulator and a risk-based rulebook that applies to anyone building or using AI systems in Kenya — including foreign companies operating here.

Neither is final law yet. But the direction is clear, and if your product touches AI, this is the moment to pay attention rather than react later.

Two tracks, one direction

The policy, led by the Ministry of Information, Communications and the Digital Economy, is part of implementing Kenya's National AI Strategy 2025–2030. It proposes a National AI and Other Emerging Technologies Council to act as the central authority overseeing how AI is developed and deployed across sectors.

The Bill is more concrete and more consequential for builders. Introduced in the Senate and modelled partly on the EU AI Act, the Artificial Intelligence Bill, 2026 proposes an Office of the AI Commissioner as regulator, a risk-based classification of AI systems, a register for high-risk systems, and obligations around transparency, data protection, and record-keeping. As drafted, it carries penalties of up to KES 5 million, up to two years in prison, or both.

Worth knowing: the two tracks aren't perfectly aligned — the Bill was privately sponsored and arrived while the ministry's policy process was still running, and legal analysts have flagged concerns about overlap, scope, and whether it's moving ahead of the policy meant to ground it. So expect the details to shift. The shape of it, though — a regulator plus risk tiers — is unlikely to change.

Why this matters even for a small team

Here's the part developers tend to miss: the Bill, as drafted, would apply to any business operating AI systems in Kenya, including cross-border and multinational operators. "We just call an external API" is not an exemption. If your app uses AI and serves Kenyan users, you're plausibly in scope.

And the obligations scale with risk. The domains treated as high-risk — where you'd face the tightest rules — include finance, healthcare, education, agriculture, employment, security, and public administration. Look at that list through a builder's eyes: a fintech using AI for credit scoring, an HR app screening candidates, a health app triaging symptoms. A lot of ordinary Kenyan software lands in the high-risk tier without anyone thinking of it as "high-risk AI."

What builders should actually do now

None of this is law yet, but the smart move is to build as if sensible rules are coming — because they are, and because most of this is just good engineering:

• Know your risk tier. Does your AI make or heavily influence decisions about people's money, health, jobs, or rights? If yes, treat it as high-risk and hold it to a higher bar.
• Be transparent. Tell users when they're interacting with AI or when AI shaped a decision. Don't disguise it.
• Keep a human in the loop for consequential outcomes — a person should be able to review and override an automated decision.
• Respect data and privacy. The Data Protection Act, 2019 already applies to what you're doing; AI doesn't get a pass on consent and data handling.
• Log your decisions. Keep records of how your AI reaches outputs. Record-keeping runs through every version of these rules, and it's what you'll need if you ever have to explain a decision.
• Track the process. Follow the Bill's progress and groups like KICTANet; the rules will keep evolving, and builders who stay informed adapt cheaply instead of scrambling.

Concretely, that's less scary than it sounds — often it's a disclosure line, an audit log, and a review step:

if (feature.usesAI) {
  disclose(user); // tell them AI is involved
  const output = model.run(input);
  logDecision({ input, output, model: model.id, at: Date.now() });
  if (isHighRisk(feature)) requireHumanReview(output); // don't auto-act
}

The honest bigger picture

There's a real debate underneath all this, and it's worth seeing both sides. Move too slowly and Kenya risks harm going unchecked — a court has already weighed in on gaps around high-risk systems. Move too fast or too broadly and you risk chilling the very innovation and investment that make Kenya "Silicon Savannah," and adding compliance weight that small teams feel most. There's also a distinctly Kenyan angle: the country hosts a large AI data-labelling workforce, and the policy's push for labour standards there matters as much as the model-level rules.

Where does that leave you as a builder? Pragmatic. You don't have to take a side in the policy fight to make the right call for your product: build AI features that are transparent, accountable, and respectful of users' data — and whatever the final rulebook says, you'll already be most of the way there.

Adding AI to your product — the right way?

I build AI-integrated features into mobile and web products from Nairobi, and I care about doing it responsibly, not just impressively. If you're adding AI to your app and want it useful and built to hold up as the rules land, reach out, or find me on Fiverr and Upwork.