Skip to main content

    AI by country · East Africa

    AI in Kenya: the rules, the readiness and where to start

    Last checked: 26 October 2026

    What should a company in Kenya know before starting with AI?

    Kenya has no dedicated AI law as of 26 October 2026. The Data Protection Act, 2019 is the law that applies to AI today, and the Data Protection Commissioner and the Central Bank of Kenya have both put out draft AI guidance this year. A company should work out which decisions about people it automates, what data leaves Kenya, and whether its sector regulator is about to issue new rules.

    At a glance

    Kenya at a glance

    Key facts about Kenya
    Data protection lawData Protection Act, 2019, in force since 25 November 2019
    RegulatorOffice of the Data Protection Commissioner (ODPC)
    AI policyKenya Artificial Intelligence Strategy 2025 to 2030 (March 2025). No dedicated AI law as of 26 October 2026; a draft AI policy and a Senate AI Bill are both unfinished
    Time zoneEAT, UTC+3 (India is 2.5 hours ahead)
    CurrencyKES (Kenyan shilling)
    Business languageEnglish and Kiswahili

    Why now

    Why Kenya is worth watching

    Each point links to the document it comes from.

    • The Kenya Artificial Intelligence Strategy 2025 to 2030 is dated March 2025 and rests on three pillars: AI digital infrastructure, data, and AI research and innovation.[2]

    • The strategy reports 22.71 million internet users (40.8% penetration) in March 2024 and a plan to lay over 100,000 km of fibre by 2027.[2]

    • The ODPC ran a consultation on a draft Guidance Note on Artificial Intelligence from 1 to 17 August 2026.[4]

    • The Central Bank of Kenya opened consultation on a draft AI guidance note for banks on 10 September 2026, closing 7 November 2026.[6]

    • A CBK survey reported in November 2025 that about half of financial institutions already use some form of AI.[7]

    • A Senate committee rejected the Artificial Intelligence Bill, 2026 in October 2026, so the direction of AI legislation is open.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Data Protection Act, 2019

    In force2019People have a right not to be subject to a decision based solely on automated processing that has legal or significant effects. Exceptions apply for contracts, authorising law and consent, and the person must be told in writing and may ask for the decision to be reconsidered (section 35). A data protection impact assessment is required before high-risk processing (section 31), and a breach with a real risk of harm must be reported to the Commissioner within 72 hours (section 43).[1]

    Data Protection Act, 2019: transfers, registration and penalties

    In force2019Sending personal data abroad needs proof of safeguards given to the Commissioner, or another listed ground (section 48), and sensitive data needs the person's consent plus safeguards (section 49). The Cabinet Secretary can require some processing to happen on servers in Kenya (section 50). Controllers and processors must register (section 18). Penalty notices can reach KES 5 million or 1% of annual turnover, whichever is lower (section 63).[1]

    ODPC draft Guidance Note on Artificial Intelligence

    Draft2026The ODPC consulted on this draft from 1 to 17 August 2026 and describes it as applying to those who develop, deploy or procure AI. A trade report says it lists use cases needing a DPIA, such as credit scoring and recruitment screening. The note was not on the ODPC guidelines page when we checked, so its final status is unclear as of 26 October 2026.[4]

    CBK draft Guidance Note on AI in the Banking Sector

    Draft2026It would apply to institutions licensed under the Banking Act. Consultation runs from 10 September to 7 November 2026. We could not open the draft itself, so we do not state its requirements; press reports of a written pre-approval rule are unconfirmed.[6]

    Where AI fits first

    Where AI fits first

    Banking and mobile money

    Fraud detection, credit risk review and customer service in English and Kiswahili.

    The CBK draft guidance on AI is open for comment until 7 November 2026. The AI Strategy notes Kenya's mobile money leadership has driven research on machine learning for financial inclusion.[6]

    Digital lending

    Automated affordability checks, always with a way for a person to review.

    The ODPC publishes a Guidance Note for Digital Credit Providers. Section 35 of the Data Protection Act gives people the right to ask for a decision to be reconsidered.[3]

    Health care

    Drafting clinical summaries and imaging support, with clinicians making decisions.

    The ODPC publishes a Guidance Note on the Processing of Health Data. Health data is a sensitive category under the Act, so transfers abroad need consent and safeguards.[3]

    Agriculture

    Crop disease detection from photos and local-language advice for farmers.

    The AI Strategy names crop disease detection as a research use. We found no AI rule specific to agriculture.[2]

    Your first steps

    Your first steps

    1. Register as a data controller or processor with the ODPC if you have not, and keep the registration current.
    2. List each decision your AI makes about a person and whether a human reviews it, because section 35 gives people the right to ask for reconsideration.
    3. Run a data protection impact assessment before launching AI that touches credit, health, hiring or monitoring of people.
    4. Map where data is stored and processed, and get proof of safeguards before any transfer abroad.
    5. Prepare a breach process that can reach the ODPC within 72 hours.
    6. If you are a bank, read the CBK draft AI guidance and send comments before 7 November 2026.
    7. Read the ODPC's Guidance Notes on DPIAs and the draft AI note, and check the ODPC site for the final version.

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Kenya is on UTC+3 and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 17:00 day in Kenya and 9:30 to 18:30 in India, the overlap is about 7 hours, from 09:00 to 16:00 Kenyan time.

    Questions

    Common questions about AI in Kenya

    Does Kenya have an AI law?

    Not as of 26 October 2026. A Senate committee rejected the Artificial Intelligence Bill, 2026 in October. A draft national AI policy was open for comment until 4 August 2026, and we found no final version.

    Which law covers AI that uses personal data?

    The Data Protection Act, 2019. Its section 35 covers decisions based solely on automated processing, section 31 covers impact assessments, and sections 48 to 50 cover data going abroad.

    What does a breach cost me?

    The Commissioner can issue a penalty notice of up to KES 5 million, or up to 1% of annual turnover for an undertaking, whichever is lower. Other offences carry fines of up to KES 3 million or up to ten years in prison under section 73.

    Is the ODPC AI guidance final?

    We could not confirm that. The ODPC consulted on a draft until 17 August 2026, and it did not appear on the ODPC guidelines page when we checked on 26 October 2026.

    Free tools

    Try these first

    Three free tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 26 October 2026. Numbers in square brackets above match this list.
    1. [1] Republic of Kenya, via the Office of the Data Protection Commissioner, 2019-11-25. The Data Protection Act, No. 24 of 2019(odpc.go.ke)
      Full title and what we used it for

      The Data Protection Act, No. 24 of 2019. Primary. Read in full text. Used for sections 18, 31, 35, 43, 48 to 50, 63 and 73, and the commencement date of 25 November 2019. Our copy is the ODPC's original; later amendments, if any, were not checked.

    2. [2] Ministry of Information, Communications and the Digital Economy, 2025-03-01. Kenya Artificial Intelligence Strategy 2025 to 2030(api.oecd.ai)
      Full title and what we used it for

      Kenya Artificial Intelligence Strategy 2025 to 2030. Primary document, read in full text via the OECD.AI-hosted copy; it is dated March 2025 on its cover. Used for the pillars, internet and fibre figures, mobile money and crop disease references. The ministry's own page was blocked by a certificate error, so we did not rely on it.

    3. [3] Office of the Data Protection Commissioner, 2026-10-26. ODPC guidelines and guidance notes page(odpc.go.ke)
      Full title and what we used it for

      ODPC guidelines and guidance notes page. Primary. Used to confirm which guidance notes exist (digital credit providers, health data, DPIA and others) and that no AI guidance note was listed on the day we checked.

    4. [4] Digital Policy Alert, 2026-10-26. Guidance Note on Artificial Intelligence (Kenya ODPC)(digitalpolicyalert.org)
      Full title and what we used it for

      Guidance Note on Artificial Intelligence (Kenya ODPC). Secondary tracker, accessed on this date. Used for the consultation dates of 1 to 17 August 2026 and the intended audience. A trade report (PPC Land, 'Kenya forces impact assessments on recommendation engines and 7 other AI uses') was used for the DPIA use cases; that report says the draft is dated July 2026.

    5. [5] Eastleigh Voice, 2026-07-23. Kenya opens draft AI policy for public consultation, invites public pro…(eastleighvoice.co.ke)
      Full title and what we used it for

      Kenya opens draft AI policy for public consultation, invites public proposals until August 4. Press report. Used for the draft AI and Other Emerging Technologies Policy and its 4 August 2026 comment deadline. We found no news of a final policy.

    6. [6] Digital Policy Alert, 2026-09-10. Central Bank of Kenya opened consultation on the draft Guidance Note on…(digitalpolicyalert.org)
      Full title and what we used it for

      Central Bank of Kenya opened consultation on the draft Guidance Note on Artificial Intelligence in the Banking Sector. Secondary tracker. Used for the consultation dates and that it applies to institutions licensed under the Banking Act. The full description was behind a sign-in, and we could not open the CBK's own draft.

    7. [7] Business Today Kenya, 2025-11-21. CBK sets new tone for responsible AI(businesstoday.co.ke)
      Full title and what we used it for

      CBK sets new tone for responsible AI. Press report of remarks by the CBK Director of Bank Supervision. Used for the CBK survey result that about half of financial institutions have adopted some form of AI.

    8. [8] Techweez, 2026-10-16. Senate committee rejects AI Bill, sending it back to the drawing board(techweez.com)
      Full title and what we used it for

      Senate committee rejects AI Bill, sending it back to the drawing board. Press report. Used for the rejection of the Artificial Intelligence Bill, 2026 by the Senate ICT committee and for the point that Kenya has no dedicated AI law.

    This is general information, not legal advice. Laws and drafts change quickly, and several items here are drafts known only from trackers or press reports. Check with a qualified Kenyan lawyer before you act. Facts checked on 26 October 2026.

    Other country guides

    Starting with AI in Kenya?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score