Executive summary

The Artificial Intelligence Bill, 2026 (AI Bill) would introduce a risk-based regulatory framework for artificial intelligence (AI), establishing an independent Artificial Intelligence Commissioner (AI Commissioner), and imposing enhanced governance, transparency and accountability obligations for high-risk AI systems.

Kenya's AI governance environment has, until now, been shaped largely by general legislation, most notably the Data Protection Act, together with sector-specific regulation and policy instruments. The National Artificial Intelligence Strategy 2025 to 2030 expressly recognizes the absence of a dedicated AI legal framework and envisages a gradual evolution toward structured AI regulation as adoption increases across the economy. (For background, see EY Global Tax Alert, Kenya releases the National AI Strategy 2025--2030, dated 30 October 2025.)

The AI Bill represents a significant step in that evolution. The Memorandum of Objects and Reasons (at the end of the Bill text) frames the AI Bill as a response to gaps in existing laws and highlights the need for a dedicated oversight institution to manage AI risks while promoting responsible innovation.

Key features of the AI Bill

Establishment of the AI Commissioner and advisory oversight

The AI Bill proposes establishing the Office of the Artificial Intelligence Commissioner as an independent State Office responsible for overseeing the implementation and enforcement of the Data Protection Act. The AI Commissioner's functions would include (1) conducting risk assessments, conformity audits and post-market surveillance, (2) developing policies, guidelines, codes of practice and standards on AI governance, and (3) promoting AI literacy and public awareness.

The AI Bill would also establish an Advisory Committee on Artificial Intelligence, drawing representation from relevant government entities, the Office of the Data Protection Commissioner, scientific and innovation bodies, the private sector and civil society. The committee's mandate would include advising on emerging AI risks, ethical considerations and workforce transition arising from AI deployment.

Risk-based classification of AI systems

A core pillar of the AI Bill is the introduction of a risk-based framework for AI governance. The AI Bill would classify AI systems based on the risks they pose to health, safety, fundamental rights, the environment and societal welfare.

The AI Bill would define a high-risk AI system as one posing significant risks in these areas but would leave the detailed scope and categorization of high-risk systems to be prescribed through regulations. It nevertheless signals that AI systems deployed in critical sectors, including healthcare, education, agriculture, finance, employment, security and public administration, would likely fall within the high-risk category.

Crucially, the classification function would be entrusted to the AI Commissioner, enabling risk determinations to be refined over time through regulatory instruments and guidance.

Regulatory clarification and the role of secondary instruments

The AI Bill would adopt a framework-based approach, establishing high-level principles and obligations but anticipates that detailed compliance requirements will be developed progressively.

The Cabinet Secretary, acting on the recommendation of the AI Commissioner, would be empowered to issue regulations covering classification criteria, assessment methodologies, compliance procedures and enforcement mechanisms. Separately, the AI Commissioner would be mandated to develop guidelines, standards and codes of practice on AI governance, ethics, safety and risk management. This structure would allow regulatory expectations to evolve in response to technological change, while providing a formal mechanism for clarifying compliance obligations.

Compliance obligations for high-risk AI systems

The most challenging obligations under the AI Bill would apply to providers and deployers of high-risk AI systems, including requirements to (1) conduct pre-deployment risk assessments and human rights impact assessments, (2) implement mitigation measures including human oversight, and (3) ensure transparency, traceability and explainability of AI-driven decision-making.

High-risk systems would also have to be supported by robust record-keeping, with documentation relating to data inputs, training datasets, system outputs and performance metrics retained for at least five years. Compliance with cybersecurity and robustness standards would be mandatory, and all personal data processing would have to comply with the Data Protection Act.

For AI systems that generate or manipulate images, voice or likeness, the AI Bill introduces explicit consent and labelling requirements, particularly if there is a risk of harm, misinformation or infringement of rights.

Transparency safeguards and interaction with the Data Protection Act

Section 28 of the AI Bill plays a central role in integrating AI regulation with Kenya's existing data protection regime.

Providers and deployers would be required to disclose to users and affected persons the nature, purpose and limitations of AI systems, the degree of automation involved and any human intervention, as well as measures adopted to mitigate bias and ensure fairness. Where automated decisions produce legal or similarly significant effects, section 28 would expressly require compliance with safeguards under the Data Protection Act, including the right to human intervention, the ability to express views and the right to contest decisions.

The section would also require annual compliance reporting obligations for high-risk AI systems, reinforcing an ongoing governance and accountability approach rather than one-off compliance.

AI ethics, human-centric design and workforce impact

Ethical AI governance is woven through the AI Bill. The AI Commissioner would be required to develop and publish ethics guidelines addressing bias and discrimination, protection of privacy and human dignity, accountability and redress mechanisms, environmental sustainability and safeguards against harmful or deceptive AI-generated content.

The AI Bill also embeds a human-centric approach, requiring AI systems to enhance, rather than replace, human capabilities and mandating meaningful human oversight in critical decision-making.

In addition, the AI Bill introduces workforce impact obligations. Where AI deployment is likely to affect employment, providers and deployers would have to conduct workforce impact assessments and implement mitigation measures, including reskilling initiatives, in collaboration with relevant government agencies.

Key takeaways for businesses and investors

The AI Bill signals Kenya's shift from policy-based guidance toward a formal statutory regime for AI governance, with compliance expectations extending beyond data protection into risk management, ethics and accountability.

Organizations deploying AI, particularly in critical or high-impact contexts, should anticipate the need for structured governance frameworks incorporating risk and human-rights impact assessments, human oversight, record-keeping and ongoing compliance monitoring.

Compliance under the AI Bill is tightly aligned with the Data Protection Act, reinforcing transparency, explainability and contestability obligations rather than displacing existing data protection requirements. Ethical AI and human-centric design are positioned as regulatory expectations, while workforce impact assessments introduce a new compliance dimension where AI affects employment.

For investors, the AI Bill provides increased regulatory direction and longer-term certainty on Kenya's approach to AI, but places greater importance on governance maturity and responsible AI practices as adoption accelerates. Much of the operational detail will emerge through regulations and guidance issued by the AI Commissioner.

Implications

The AI Bill reflects Kenya's progression from strategic intent to legislative action in AI governance. The National Artificial Intelligence Strategy anticipated this shift, and the AI Bill would give statutory form to many of its governance objectives.

Whether Kenya is fully ready to regulate AI will depend on implementation, including the development of secondary regulations, the institutional capacity of the AI Commissioner's office and the readiness of organizations to operationalize AI governance, ethics and compliance requirements. What is clear, however, is that Kenya has taken a deliberate step toward embedding AI regulation within its broader digital economy and public governance framework.