Kenya - Robotics and AI Society Bill (2023)

Overview

The Kenya Robotics and Artificial Intelligence Society Bill, 2023 proposes creation of a statutory Kenya Robotics and Artificial Intelligence Society (the "Society") to promote, regulate and standardise robotics and AI practice across Kenya. The publicly available draft text (reproduced and discussed by stakeholder platforms) sets out objects that include curriculum development, capacity building, county-level data centres, a sandbox policy and standards-setting. The Bill was introduced to Parliament via a citizen petition in November 2023 and attracted wide industry attention during hearings convened by the National Assembly’s Communication, Information and Innovation Committee on 6 February 2024. Coverage and the draft text are available online (see the consolidated draft at Kenya AI — Bill text) and contemporaneous reporting by national media (see Business Daily Africa and other outlets).

Definitions

The Bill defines core terms narrowly for its purpose: "Society" (the statutory body to be established), "Robotics" (engineering and application of robots), "Artificial Intelligence (AI)" (machines performing tasks associated with human intelligence), "Officer", "Council", "Practitioners", "Code of Conduct" and "Standards". These definitions frame the Society’s mandate to cover both robotics hardware and software-driven AI systems, but stakeholder commentary notes several draft definitions remain vague where international practice distinguishes data-driven AI systems, foundation models, automated decision-making and high-consequence systems. The draft also ties the definition of Cabinet Secretary to the Ministry responsible for information and digital economy policy.

Governance and Institutional Framework

The Bill establishes a multi-tier governance framework: a national Kenya Robotics and Artificial Intelligence Society with appointed office-bearers; powers to create committees and working groups; headquarters in Nairobi; and functions to advise the Cabinet Secretary. It envisages partnerships with the ICT Authority, the Office of the Data Protection Commissioner (ODPC), Communications Authority (CA) and other sector regulators. The Society would be a corporate body with powers to sue and be sued, hold property, contract and invest funds subject to Cabinet Secretary approval. The Bill also contemplates a national commission, R&D centre and county-level roles — but stakeholders have raised concerns about institutional overlap, multiplicity of regulators and the need to clarify which functions are delegated to which public agency. The Parliament website and committee communications record the bill’s referral and public participation processes; for committee information see the National Assembly Committee on Communication, Information and Innovation page (Parliament — Committee page).

Key Focus Areas

The Bill’s substantive coverage includes: (1) registration and licensing of robotics/AI practitioners and undertakings; (2) standards-setting and codes of conduct; (3) a risk-based regulatory approach distinguishing high-, moderate- and low-risk systems with commensurate obligations (including proposed prohibitions on public facial recognition, social crediting and behaviour manipulation); (4) enforcement tools including fines and criminal sanctions for non-compliance; (5) capacity building via master trainers, school clubs and curricula; (6) sandbox policy provisions for experimental deployments; (7) surveillance, inspections and conformity assessment powers for the Society; and (8) incentives and grants for startups, NGOs and county-level activities. The draft’s emphasis on schools, solar-powered labs and county data centres shows a socio-economic development orientation, while the regulatory articles emphasize compliance and surveillance. Media reporting has flagged the licensing and penalty provisions (reports indicate fines up to KES 1,000,000 and potential imprisonment) as particularly controversial.

Implementation Framework

The draft envisages phased implementation: establishment of the Society and initial appointments; development of rules, codes, national standards and a sandbox policy; registration and licensing roll-out; and coordination with county governments for local-level registration and infrastructure. The Bill empowers the Society to develop regulations pursuant to Parliament and to collaborate with public agencies for enforcement. Implementation would require budgeting, staffing, an IT register and a compliance function; the Bill sets out financial provisions (funds, accounts, audits and annual reports). Stakeholders note that effective implementation would require clear MoUs with existing regulators (ICT Authority, CA, ODPC) and alignment with the Data Protection Act, Computer Misuse and Cybercrimes Act and other sector laws (ODPC, Communications Authority, Ministry of Information, Communications & The Digital Economy).

Monitoring and Evaluation

The Bill mandates annual reporting, audits and surveillance powers for compliance checks. The Society is to prepare annual estimates, keep audited accounts and publish annual reports. It may also carry out periodic research to determine emerging trends. The draft signals a role for inspections and market surveillance, but the specifics of independent oversight, performance metrics, KPI timelines and external review mechanisms are not fully articulated in the draft; stakeholder submissions to the parliamentary committee called for transparent M&E and judicial review safeguards.

Penalties, Liability, and Appeals

Reported draft provisions include civil and criminal penalties for failure to register or comply with rules, with press reporting noting fines up to KES 1,000,000 and imprisonment up to two years in the most-publicised draft versions. The Bill also provides for protection of Society officers from personal liability in specified circumstances and contemplates internal appeals against decisions, but it lacks a detailed administrative appeals process and precise liability allocation rules for harm caused by automated systems — an area industry commentators recommended be expanded to mirror international best practice for redress and liability.

Relationship to Other Instruments

The Bill explicitly references and proposes collaboration with existing statutes and agencies — notably the Data Protection Act (2019) and ODPC, the Computer Misuse and Cybercrimes Act, the Communications Authority and the ICT Authority — but its institutional design risks duplication of roles. Commentators have urged harmonisation with the Data Protection Act, sector telecoms and aviation rules (for drones), and clarity on the interface with county-level legislation. See ODPC guidance (Office of the Data Protection Commissioner) and CA resources (Communications Authority).

International Alignment

The Bill attempts to align with international AI governance trends by proposing risk-based categorisation and prohibitions on sensitive high-risk uses. However, stakeholders have noted it lacks references to international standards for algorithmic transparency, model evaluation, conformity assessment schemes (CE-type or third-party certification) and cross-border data transfer safeguards. NGOs and industry urged better alignment with international instruments and multi-stakeholder standards so Kenya can both protect rights and maintain competitiveness.

Implementation Timeline

Sources and References