What Exactly is AI?
When most people hear ‘Artificial Intelligence’ they think of Chat GPT, Google, Gemini or Claude, tools that generate text, images and ideas on demand. But AI is a much broader category than generative tools. Under this Bill, AI encompasses any machine-based system that uses data, algorithms or machine learning to make predictions, recommendations or decisions, with varying levels of human involvement. This is manifested in our daily lives through the bank system approving or rejecting loans, the hospital tools used to flag medical diagnoses, and the systems used to screen job applications. Regulation of AI then surpasses being a niche technology concern and becomes a matter touching the everyday lives of ordinary Kenyans.
Why This Bill exists
For a country that proudly positions itself as a technology hub, Kenya has lacked regulation of Artificial Intelligence (AI) for a long time. That silence has not meant absence, with AI systems making decisions in various sectors such as banks, hospitals and government offices simply meaning that those decisions have gone largely unchallenged. The Artificial Intelligence Bill, 2026 introduced in the Senate in February, is the first serious attempt to change that.
The Bill does not emerge in isolation. Globally, in 2024, the European Union enacted the world’s first comprehensive AI law, the EU AI Act, establishing a binding, risk-based framework that has since become the international reference point. The African Union followed suit with its Continental AI Policy Framework. Kenya, for its part, published its own National Artificial Intelligence Strategy 2025-2030, setting out a vision for ethical, innovative and inclusive AI adoption in the country. The Bill is the legislative arm of that ambition giving the strategy, a force of law.
Proposals of the Bill.
The Bill seeks to do five principal things.
- Alignments with the Kenya National Artificial Intelligence Strategy 2025-2030
The Bill anchors itself to the strategy, which envisions Kenya as a leader in ethical and innovative AI adoption on the continent. The Bill poses as the legislative arm of that policy ambition, giving it teeth that a strategy document alone cannot provide. However, its legislation becomes questionable as discussed further on.
- Risk-based Framework
Drawing directly from the EU AI Act, the Bill classifies AI systems into four risk tiers which are; unacceptable, high, limited and minimal, ranking from prohibited use to those safe and acceptable to use. High risk systems, deployed in public sectors including education, healthcare and public administration face the most stringent requirements including mandatory risk assessment and human rights impact assessments. This ranking, at the current moment, speaks only towards the requirements needed for each tier, lacking criteria guiding the classification, which may prove difficult in implementing this limb of the Bill.
- Office of the Artificial Intelligence Commissioner
The Bill seeks to establish a new independent regulator, the Office of the Artificial Intelligence Commissioner as a state office. Appointed by the President and approved by Parliament, the Commissioner would oversee compliance, investigate complaints, conduct risk audits, run regulatory sandboxes and advise both national and county governments. The Commissioner must hold a master’s degree in a relevant field and bring at least ten years of experience in AI governance and data protection.
- Criminal and administrative penalties
The Bill in meeting one of its major objectives, seeks to criminalise the distribution of harmful AI-generated content without consent amongst other non-compliance violations including deploying prohibited AI system with fines of up to Kenya shillings five million (Ksh. 5,000,000). This sets Kenya apart from many jurisdictions, including the EU which rely primarily on administrative fines rather than criminal sanction.
- Regulatory sandboxes
To avoid strangling innovation, the Bill proposes the creation of regulatory sandboxes, which are supervised testing environments where startups and developers can pilot AI products under official oversight before full market deployment. Priority is given to innovations that address national priorities, with collaboration encouraged across county governments.
What This Means for You
For Citizens
Citizens would have codified rights when AI makes decisions that affect personal lives. They include a right to an explanation to the decision made by AI, right to human review of decisions made by AI, particularly those that heavily impact one’s life and most importantly, protection from deepfakes and subsequent consequences such as defamation, misinformation or harm. Citizens who rely on AI-powered services may also find their options quietly narrowed if the providers exit the Kenyan market due to high compliance costs or if familiar tools are classified as high risk with prohibited obligations.
For Businesses
Companies deploying AI systems, in regulated sectors such as health and finance systems will face new compliance obligations including risk assessment, transparency disclosures and data protection requirements. For those in the innovation space, the suggested regulatory sandbox offers a pathway to test and scale AI solutions without the full weight of compliance. Compliance is not uniform and may end up affecting small and medium AI providers and developers who may not be sufficiently prepared for the compliance costs and the changes necessary to their infrastructure to be aligned with the Bill’s requirements. Furthermore, businesses that rely on AI tools may incur an extra cost as providers will absorb the compliance costs and pass them down through price alterations.
Criticisms
A Skeleton in Search of a Body: The Law vs Policy Problem
The most fundamental criticism of this bill is structural. Legislation is expected to provide binding, enforceable rules with sufficient certainty that concerned members can arrange their affairs accordingly. A policy document, by contrast, directs and guides, leaving room for future detail. The problem with this Bill, is that it largely currently reads like the latter. Considering the ambiguity in the Bill on: the criteria for classifying AI systems by risk level; evidence to be relied on to establish harmful intent in a deepfake case; undefined ‘national priorities’ that fall under the regulatory sandbox. There is a necessity of tightening these sections to avoid deferring them to future regulations, making the Bill stable and sound.
What about foreign AI?
The vast majority of AI systems affecting Kenyans daily, from social media algorithms to mobile lending applications to search engines are built and controlled by companies headquartered abroad. The bill’s definitions are broad enough to technically capture foreign providers whose systems are deployed in Kenya. The bill, however, is silent on whether foreign companies must establish physical offices in Kenya. The EU AI Act, which the Bill draws inspiration from, explicitly requires non-EU providers to appoint an authorised representative within the European Union. Without such a mechanism, Kenya’s bill would foreign companies in theoretical breach of this law with no practical way to compel their compliance.
Criminal penalties without criminal justice capacity
The Bill criminalises deepfakes and other AI harms, a commendable ambition in the region and continent at whole. But a law without enforcement is just a strong opinion. Without an outline on how the crime could be justiciable, this limb of the Bill would be setting itself for ineffective implementation.
Conclusion
Kenya is on the right track. With this Bill, it steps forward as a continental trendsetter on AI governance, and that step deserves recognition. But leadership is not just about moving first, it is about moving well. The Bill must be contextualised to Kenya’s realities and its rough edges sanded down into precise, enforceable law. The continent is watching, not just to see whether Kenya regulates Artificial Intelligence but whether it regulates it well enough to see whether it regulates it well enough to set a model worth following.