Laws/Regulations directly regulating AI (the “AI Regulations”)
Between January 14 and January 19, 2025, the Ministry of Information, Communications, and Technology (the "Ministry") held a consultation on a draft of Kenya's National Artificial Intelligence (AI) Strategy 2025-2030. This strategy aims to position the country as Africa's leading AI hub, driving sustainable development, economic growth, and social inclusion through innovative AI solutions.1
On March 27, 2025, the Ministry formally launched the "National Artificial Intelligence Strategy 2025-2030" (the "Strategy").2
The Strategy outlines a comprehensive framework developed with input from various stakeholders including government agencies, private sector entities, academia, civil society, international partners, and local communities. Key objectives include establishing a robust AI governance framework; enhancing AI adoption in critical sectors such as agriculture, healthcare, education, and public service delivery; and fostering local AI ecosystems. The Strategy is anchored on three main pillars: (i) AI Digital Infrastructure, (ii) Data, and (iii) AI Research and Innovation, supported by enablers such as governance, talent development, investment, and ethical AI practices.3 With a phased implementation approach, Kenya aims to harness AI's potential while ensuring ethical, inclusive, and equitable deployment, ultimately improving the quality of life for its citizens and positioning the country as a regional leader in AI research and innovation.
Under its governance theme, the Strategy recommends the development of a comprehensive AI policy framework to provide coherence and direction in Kenya's AI sector. The recommendations, if realized, may result in the development of the following AI-related policies:
- National data policy (i.e., to guide the formulation of a legal data access and sharing framework)
- National AI and emerging technologies policy
- National cybersecurity policy4
Status of the AI Regulations
In addition to the above, the Kenya Bureau of Standards (KEBS) published the Draft Information Technology Artificial Intelligence Code of Practice (the "Draft Code") on April 8, 2024.5 The Draft Code was developed to help organizations develop, provide and use AI in a responsible way, ensuring that the rights of citizens are not to be compromised in the course of developing AI systems. The Draft Code is still in draft form, and KEBS had invited members of the public to submit comments by June 13, 2024.6 However, there has been no further progress in relation to its approval and release.
The Robotics Society of Kenya has also developed the Kenya Robotics and Artificial Intelligence Society Bill 2023 (the "Robotics and AI Bill "),7 which aims to develop a framework that would regulate AI in Kenya. The Robotics and AI Bill is still in draft form and has not been published in the Kenya Gazette, nor introduced before Kenya's Parliament. Additionally, it has also not received support from the Kenyan government and has faced opposition from key private sector players and stakeholders.
Lastly, the Cabinet Secretary for ICT in 2019 established the Distributed Ledgers Technologies and Artificial Intelligence Taskforce (the "Taskforce "). The mandate of the Taskforce was to explore and analyze upcoming digital technologies that demonstrated potential to transform Kenya's economy. This included disruptive technologies such as distributed ledger technologies (e.g., blockchain and hashgraph), AI, 5G wireless technology, and the internet of things. The Taskforce noted in its report that the challenge for the regulation of AI is how to balance supporting innovation and competition, while protecting customers, market integrity, financial stability, and human life.8
Other laws affecting AI
Some of the other laws that are expected to impact artificial intelligence include:
- The Data Protection Act, 2019 – This Act, inter alia, recognizes that every data subject has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning, or significantly affects, the data subject
- The Computer Misuse and Cybercrimes Act, 2018 – This Act, inter alia, provides for the protection of critical information infrastructure and creates obligations for owners or operators of a system designated as critical infrastructure. It will therefore apply to AI systems to the extent that they are considered to constitute critical information infrastructure
- Consumer Protection Act, 2012 – This law will be applicable to AI because of the need to ensure the protection of consumers who use AI products and systems
Definition of “AI”
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. None has been provided so far as there is no law in Kenya that defines "AI." However, the Strategy defines AI as:
"A collection of emerging technologies that leverage machine learning, data processing, and algorithmic systems to perform tasks that typically require human intelligence. AI encompasses a range of capabilities, including automated decision-making, language processing, and computer vision."9
The Strategy further defines AI to be "a powerful tool for sustainable development, designed to assist and simplify human tasks, solve critical challenges, and drive sustainable growth."10
The Draft Code by KEBS does not define AI, but has enumerated the three characteristics of AI which include:
- Built with the capabilities of an AI system that implements a model to acquire information and processes with or without human intervention by algorithm or programming
- Applies optimizations or inferences made with the model to augment decisions, predictions, or recommendations in a timely manner to meet specific objectives
- Updates and improvements made to the model, system, or application by evaluation of interaction outcomes11
In addition, the Robotics and AI Bill defines the term AI as "the ability of machines to perform tasks that are typically associated with human intelligence, such as learning and problem-solving".12
Territorial scope
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, it is expected that once the Strategy and the Draft Code are finalized, they will only be applicable in Kenya and will not have extra-territorial application. However, the Taskforce recognized in its report that national AI regulations are likely to have transnational effects and can potentially cause cross-national conflicts.
The Strategy recommends the harmonization of regional domestic data, tax and cybersecurity laws for compliant data transfer, which is deemed crucial to meet the demand for AI.13
Sectoral scope
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. As such, there are no specific regulatory requirements that apply to the various sectors in Kenya.
Compliance roles
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, some of the roles provided under the Draft Code include an obligation for stakeholders to understand the ecosystem in which the AI systems will operate and ensure that risk management and security systems are in place.
In addition, the Robotics and AI Bill seeks to require persons who carry out the business of a robotics and artificial intelligence society or association to register with the government explaining the relevant business activities that will be undertaken.14
Core issues that the AI Regulations seek to address
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI.
One of the core issues under the Strategy relates to the establishment of a data governance framework to promote ethical and acceptable data access, sharing, as well as utilization in the development and use of AI.15
Risk categorization
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. Risk categorization is expected to become clearer once the once the Strategy and the Draft Code are finalized.
The Strategy prioritizes the need for AI-related risks and safety frameworks and recommends the development of a framework to control the risks related to the use of AI.16
Key compliance requirements
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, the Draft Code provides that developers and stakeholders in the AI space must comply with and maintain high standards of transparency, accountability, security and privacy measures, risk management capacity and governance of the AI systems.17
The Strategy provides an indication of the direction Kenya will take in relation to AI, and recommends data access, sharing, and governance in relation to AI as key focus points for future legislation.18
Regulators
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. As such, there are no Regulators that oversee the development and use of AI in Kenya at present.
Enforcement powers and penalties
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. The elements of enforcement and penalties have not been expressly developed.
1 See the Draft National Artificial Intelligence Strategy 2025-2030 (circulated for the purpose of the consultation) here.
2 Read the National Artificial Intelligence Strategy 2025-2030 here.
3 See the Strategy here, pg.8.
4 See the Strategy here, pg.76.
5 See the Draft Code here.
6 Read the Public Review Cover Letter here.
7 See the Robotics and AI Bill here.
8 See the Strategy here, pg. 40.
9 See the Strategy here, pg. 15.
10 See the Strategy here, pg. 15.
11 See the Draft Code here, p.8 and 9.
12 See the Robotics and AI Bill here, p.5.
13 See the Strategy here, p.76.
14 See Robotics and AI Bill here, Article 21.
15 See the Strategy here, pg.76.
16 See the Strategy here.
17 See the Draft Code here.
18 See the National AI Strategy 2025 here.
[View source.]
