Kenya: AI Policy and Governance

Kenya is entering a new era of AI governance. Building on existing laws for data protection, cybersecurity, and consumer rights, the country has launched its National AI Strategy 2025–2030 and a Draft AI Code of Practice. These steps put data sovereignty and responsible innovation at the center of Kenya’s AI future — and signal important changes for organizations operating in the market.

 

Current state of AI policy in Kenya​

As of April 2025, Kenya has no legislation that is AI‑specific and already in force. The country instead depends on existing cross‑sector laws that affect how AI systems are used, especially with respect to data, privacy, consumer rights, and ICT. Key laws include:

• Data Protection Act, 2019 – regulates how personal data is processed, collected, stored and gives individuals rights. It also limits decisions made solely by automated means in cases where such decisions have legal or significantly adverse effects.
• Computer Misuse and Cybercrimes Act, 2018 – addresses offences involving misuse of computer systems, which may cover AI systems that interfere with critical infrastructure.
• Consumer Protection Act, 2012 – ensures rights of consumers are protected when using AI-enabled products/services.
• Kenya Information and Communications Act (KICA) and KICA (Consumer Protection) Regulations, 2010 – regulates ICT services and consumer safeguards relevant to AI deployment.

 

In addition, Kenya has taken steps towards AI‑specific guidance:

• The Kenya Bureau of Standards (KEBS) published a Draft Code of Practice for Artificial Intelligence Applications. This draft was opened for public consultation on 8 April 2024 and the consultation period closed on 13 June 2024.
• The National AI Strategy 2025‑2030 was launched by the Ministry of Information, Communications, and Technology (MICT) on 27 March 2025. This document sets out a roadmap for AI development, oversight, and alignment with socio‑economic priorities.

​

The Focus of Kenya’s AI Strategy

The Kenya National Artificial Intelligence (AI) Strategy 2025‑2030, as launched, contains the following vision and priority themes:

• To position Kenya as a regional leader in AI research, innovation, and commercialization.
• To leverage local talent, datasets, and creativity to transform key sectors (e.g. agriculture, healthcare, public services).
• To uphold ethical and responsible AI through clear, inclusive guidelines.
• To prioritize data sovereignty – namely ensuring Kenya has control over its data, rather than being reliant on foreign legal systems or platforms.
• To collaborate with both local and international stakeholders to adopt best practices that ensure Kenya’s AI ecosystem remains secure, equitable, and globally competitive.

 

​

Regulatory Reforms Articulated in the Strategy

The Strategy acknowledges that while existing laws offer partial protection, they are insufficient for today’s AI challenges. Regulatory reform is thus a core goal. Key reform components include:

• Legal review and reform: The Strategy tasks Parliament with creating and/or amending laws to strike a balance between fostering innovation and ensuring safety, accountability, and citizen protection. Areas flagged for review include data protection, cybersecurity, consumer rights, intellectual property, and whistleblower protection.
• Policy frameworks and standards: Beyond statutes, the Strategy anticipates the use of policy instruments like codes of practice, national data policies, emergence of AI/emerging technologies policies, and harmonization of cybersecurity rules.

​

How will AI be Regulated?

The Strategy does not yet fully define which AI systems or applications will be regulated under which rules. However, it draws inspiration from international risk‑based regulatory models (such as the European Union’s AI Act) that classify AI systems by the level of potential harm (to privacy, safety, rights, etc.). Systems in higher‑risk categories are subject to stricter rules. Adopting such an approach would improve clarity for developers and users.

 

International and Regional Alignment

Kenya aligns its Strategy with continental and global developments:

• African Union (AU): Kenya’s Strategy refers to principles coming from the AU AI Strategy framework, including ethics, inclusion, and data sovereignty.
• Global models / best practices: Kenya watches regulatory regimes like the EU AI Act and similar legislative experiments in other jurisdictions as guides.

​

Outlook - How should you act?

​Kenya stands at a pivotal moment in defining its AI governance regime. For now, organizations operating in Kenya must comply with existing cross‑sector laws (Data Protection Act, Computer Misuse and Cybercrimes Act, Consumer Protection Act). Over the next 1–2 years, the National AI Strategy and KEBS’s Code of Practice are expected to establish more dedicated regulatory instruments.

 

Recommendations for organizations:

• Map out which datasets or AI applications may implicate data protection, privacy, consumer rights, or cybersecurity.
• Monitor developments of the Strategy, the KEBS Draft Code of Practice, and any new legislative proposals.
• Prepare for risk‑based compliance models: some AI systems may need stricter controls depending on potential harms.
• Incorporate flexibility into planning, procurement, and deployment so that when new obligations become law, organizations can adapt without substantial disruption.

 

Why let us help you?

Navigating this fast-changing regulatory landscape requires both technical expertise and regulatory foresight. Nemko Digital supports companies working with AI-enabled products and services by:

• Tracking and interpreting emerging AI regulations in Kenya and globally.
• Integrating AI governance, functional safety, and cybersecurity into a unified compliance strategy.
• Offering pre-compliance assessments to identify gaps before laws come into effect.
• Helping organizations build trustworthy AI systems that align with local expectations on data sovereignty, accountability, and transparency.

Contact our team today to discuss how your organization can prepare for Kenya’s upcoming AI laws and standards — and ensure your AI systems are both compliant and competitive.