The EU AI Act slips to 2027: why Kenyan exporters should still prepare

The European Union's AI Act, the world's most comprehensive AI law, has been partly delayed. Under the "Digital Omnibus" package, obligations for standalone high-risk AI systems that were due on 2 August 2026 move to 2 December 2027, and obligations for AI embedded in regulated products move to 2 August 2028, according to analyses by Sidley Austin and the Cloud Security Alliance. The European Parliament voted on the provisional agreement in June, with Council approval reported shortly after. Commentators differ on some details, including the timing of transparency obligations, so businesses should check the final published text.

The headline is "delay". The real message is "deferred, not cancelled".

Why a European law matters in Kenya

The AI Act applies to AI systems placed on the EU market or whose outputs are used in the EU, wherever the provider is based. Kenyan businesses can be affected if they:

• export products that include AI to European customers
• provide services to European clients using AI, such as business process outsourcing, customer support or data processing
• build software used by European companies
• work with EU-funded programmes that require compliance

Kenya's large BPO and tech-services sector, which serves clients in Europe, is directly in scope for some of these obligations.

What "high-risk" covers

The Act's high-risk categories include AI used in areas such as employment and recruitment, education, access to essential services like credit, and some public-sector uses. A Kenyan firm screening CVs for a European employer with AI, or scoring creditworthiness for a European lender, may find itself handling a high-risk system.

Using the extra time

1. Map your AI. List the AI systems you build or use, and which touch European clients or data.
2. Check the categories. Work out whether any could be high-risk.
3. Document now. Data sources, testing, human oversight, how decisions can be explained. This is good practice anyway.
4. Watch transparency rules. Requirements to tell people they are dealing with AI, and to label AI-generated content, may apply on a different timeline from the high-risk rules.
5. Align with Kenyan rules. Kenya's Data Protection Act already applies, and an AI Bill is before the Senate. Kenya's AI Bill explained.

AI-generated content and labelling

For marketers, the most relevant parts of AI regulation worldwide are transparency rules: telling audiences when content is AI-generated, especially when it depicts real people or events. Whatever the EU timeline, labelling synthetic content honestly is becoming an expectation of platforms and audiences. When to say an ad was made with AI.

Tari Studio asks users to include only people who agreed to appear, never to imitate a real person without permission, and to follow the rules of the platforms they publish on. Privacy and your data.