Kenya's AI Bill 2026, explained for business owners

Kenya is debating how to regulate artificial intelligence. The Artificial Intelligence Bill, 2026, sponsored by nominated Senator Karen Nyamu, is before the Senate. It has not been passed, and it may change. But its proposals are significant enough that businesses using AI should understand them.

This is not legal advice. It summarises public reporting, including from TechCabal, Citizen Digital and HapaKenya.

What the bill proposes

• An Office of the AI Commissioner, with the Commissioner appointed by the President and confirmed by Parliament, and powers to compel testimony, access records and inspect AI systems in the public and private sectors.
• Approval for high-risk AI: developing, deploying or operating a high-risk system without approval would be an offence.
• High-risk sectors, classified by the Cabinet Secretary on the Commissioner's advice, reportedly including healthcare, education, agriculture, finance, security, employment and public administration.
• Obligations for providers of high-risk systems, including risk and impact assessments and keeping records of data inputs and outputs for five years.
• Penalties: fines of up to KES 5 million and prison terms, which reports give as up to two or three years.

Alongside a draft national policy

Separately, the ICT ministry has published a draft Kenya AI and Emerging Technologies Policy, 2026, which would tie together the National AI Strategy, the Digital Master Plan and the Data Protection Act, and create an AI and Emerging Technologies Council supported by a coordinating office. The bill and the policy are different instruments, and how they will fit together is part of the debate.

What critics say

Critics, including commentary on HapaKenya, argue that the high-risk categories are so broad they cover almost every major sector, that criminal penalties could chill innovation, and that a new regulator alongside existing ones (the Data Protection Commissioner, the Communications Authority, sector regulators) could fragment oversight. Some legal commentators have asked how small businesses using everyday AI tools would be affected.

Supporters argue Kenya needs a framework before AI spreads further into health, finance and government.

What it could mean for businesses

If passed in a form close to the current text, businesses would need to know:

1. Whether their AI use is "high-risk". A clinic using AI for diagnosis would differ from a shop using AI to make adverts.
2. Who is the "provider": the company that builds the tool or the one that uses it.
3. What records to keep, and for how long.

What to do now

• Follow the bill through public participation and committee stages.
• Comply with the law that already applies: the Data Protection Act covers personal data used in AI.
• Keep good records of how you use AI. In Tari Studio, every result keeps the prompt the model received.
• Use AI responsibly: consent for faces and voices, honest claims, no impersonation. Our privacy approach.

Regulation done well can build trust in AI. The details will decide whether this bill does.