Kenya AI Regulation Overview

Overview

Kenya's overall approach to AI regulation is transitioning from early strategic planning, voluntary technical standards, and media-specific guidelines toward a comprehensive national regulatory framework. The baseline of Kenya's executive policy is the Kenya National Artificial Intelligence Strategy 2025–2030, officially published and launched by the Ministry of Information, Communications and the Digital Economy (MICDE) on March 27, 2025. The Strategy establishes a five-year roadmap to position Kenya as a regional AI hub, organizing priority actions around digital infrastructure, data ecosystems, and locally relevant research and commercialisation across core economic sectors.

Parallel to executive policy, technical and sectoral governance frameworks have matured rapidly. The Kenya Bureau of Standards (KEBS) developed DKS 3007:2024 (published as KS 3007:2025), establishing a national code of practice for trustworthy AI development, risk management, and lifecycle controls. Meanwhile, the Media Council of Kenya (MCK) has pioneered media-specific governance through a suite of handbooks and guidelines, including the Media Handbook for Reporting on Artificial Intelligence, the Data Governance Guide for Media Practice, and the Guide on the Use of Social Media and the Internet. In June 2025, Parliament passed a National Assembly Motion formally directing the executive to draft a national statutory regulatory framework and launch public awareness initiatives.

Regulatory Approach

Kenya currently employs a soft-law and policy-driven regulatory model supplemented by voluntary standardisation and sector-specific operational guidelines. Rather than relying on a single horizontal statutory AI Act, national authorities have prioritized strategic enablement, ethical guidelines, and risk management aligned with existing cross-cutting laws, notably the Data Protection Act 2019 and the Computer Misuse and Cybercrimes Act. The policy environment focuses on building infrastructure (such as ward innovation hubs and AI-ready data centres) while establishing governance principles like human oversight, explainability, data minimisation, and continuous operational monitoring.

Risk-based governance mechanisms are increasingly embedded across Kenya's AI instruments. The National AI Strategy sets specific ethical checks for "high-impact AI" systems that affect safety, fundamental rights, or public services. Technical standards like DKS 3007:2024 guide deployers through lifecycle risk assessments, verification, and testing regimes. Proposed legislation, such as the Kenya Robotics and Artificial Intelligence Society Bill 2023, attempted a rigid risk classification (prohibiting social scoring and public space facial recognition), though that draft encountered pushback. In media governance, risk-based pre-publication audits and mandatory labelling apply to synthetic media and algorithmic news tools.

Key AI Legislation

Main policies, standards, draft guidelines, and legislative proposals shaping AI in Kenya include:

• Kenya National Artificial Intelligence Strategy 2025–2030 (2025): A national policy blueprint adopted in March 2025 setting a five-year roadmap for AI digital infrastructure, data ecosystems, commercialisation, and institutional governance.
• DKS 3007:2024 / KS 3007:2025 Information technology — Artificial Intelligence — Code of Practice for AI Applications: A national standard adopted by the Kenya Bureau of Standards (KEBS) recommending best practices for lifecycle risk management, system trustworthiness, verification, and performance evaluation.
• National Assembly Motion on the Formulation of a Regulatory Framework on Artificial Intelligence (2025): A parliamentary resolution adopted on June 25, 2025, directing MICDE to draft a national binding regulatory framework, ethical guidelines, and public literacy programs.
• Media Handbook for Reporting on Artificial Intelligence in Kenya (2025): An MCK guideline establishing normative standards for reporting on AI technologies and deploying automated tools ethically within newsroom workflows.
• Data Governance Guide for Media Practice in Kenya (2025 Draft): An MCK draft framework providing journalists and publishers with operational procedures for handling personal data and algorithmic tools in alignment with the Data Protection Act 2019.
• Guide on the Use of Social Media and the Internet for Media Practice in Kenya (2025 Draft): An MCK draft code focusing on content verification, user-generated content, attribution, cybersecurity, and mandatory disclosure of automated news generation tools.
• Kenya Robotics and Artificial Intelligence Society Bill 2023 (Under Review): A proposed statutory bill introduced via citizen petition to establish a regulatory Society, practitioner licensing, and system risk classifications, currently paused following industry consultations.

Governance & Enforcement Bodies

Institutional oversight of AI in Kenya involves a multi-agency architecture led by executive ministries, statutory regulators, and national standards institutes. The Ministry of Information, Communications and the Digital Economy (MICDE) serves as the primary policymaking body, chairing the National AI Steering Committee and leading the drafting of national policy frameworks. The Office of the Data Protection Commissioner (ODPC) provides statutory enforcement on data privacy, ensuring that automated decision-making and AI data processing conform to data subject rights, consent rules, and impact assessment mandates under the Data Protection Act 2019.

Technical and cybersecurity oversight is divided among specialized agencies. The Kenya Bureau of Standards (KEBS) maintains responsibility for formulating and publishing national AI codes of practice and technical management standards. Cybersecurity hygiene, critical information infrastructure protection, and AI incident monitoring fall under the Communications Authority of Kenya (CA), KE-CIRT/CC, and the National Computer and Cybercrimes Coordination Committee (NC4). Sector-specific oversight in journalism is held by the Media Council of Kenya (MCK) and the Media Complaints Commission, which handle accreditation, ethical standard setting, and audience complaint adjudication.

Penalties & Enforcement

Enforcement mechanisms for AI governance in Kenya depend on the specific legal character of each instrument. Policy frameworks like the National AI Strategy and technical codes like DKS 3007:2024 function as voluntary soft law and reliance-based standards, enforced through public sector procurement criteria, model evaluation checkpoints, and organizational self-audits rather than administrative fines or criminal penalties. In the media domain, MCK guidelines rely on professional accreditation, editorial logs, public disclosures, and disciplinary review by the Media Complaints Commission under the Media Council Act.

Where statutory violations occur, enforcement relies on cross-referenced primary legislation. Non-compliance with data processing rules for AI systems falls under ODPC enforcement mechanisms under the Data Protection Act 2019. Cyber offenses and infrastructure manipulation involve sanctions under computer misuses legislation. Notably, the pending Kenya Robotics and Artificial Intelligence Society Bill 2023 contains explicit proposed penalty clauses, including compulsory registration requirements backed by administrative fines widely reported up to KES 1,000,000 and potential criminal imprisonment terms of up to two years for unlicenced practice or prohibited high-risk deployments.

Data Protection Framework

Kenya's data protection architecture is established by the Data Protection Act (2019) and enforced by the Office of the Data Protection Commissioner (ODPC). All major national AI policy documents, standards, and sectoral guides position the 2019 Act as the baseline legal framework for AI data governance. AI developers, deployers, and media practitioners processing personal data must establish a lawful basis for processing, adhere to purpose limitation, observe data minimisation, maintain retention limits, and uphold data subject rights including rights to correction, deletion, and objection.

For high-risk algorithmic processing, automated profiling, and new AI tool integrations, the framework expects deployers to conduct Data Protection Impact Assessments (DPIAs) prior to launch. Sectoral frameworks, such as the MCK Data Governance Guide, mandate technical and organizational measures including pseudonymisation, anonymisation, encrypted data transfers, explicit consent protocols, and contractual vetting of third-party cloud data processors and AI model vendors to guarantee data privacy across the processing lifecycle.

Sector-Specific Rules

Sector-specific AI rules are most fully articulated within the news media and communications sectors. Under the Media Council of Kenya's suite of guidance documents, media organizations using AI for content generation or assistance must provide clear disclosures and visual labelling to audiences. Newsrooms are required to maintain strict human editorial control, conduct rigorous fact-checking and verification of synthetic media, retain prompt and output audit trails, and adhere to conservative editorial thresholds when reporting on sensitive domains such as elections, health, finance, and matters involving minors.

Beyond media, the Kenya National Artificial Intelligence Strategy 2025–2030 targets four core priority sectors for early AI adoption: healthcare (focusing on diagnostic tools and telehealth), agriculture (precision farming and yield prediction), education (adaptive learning systems), and financial services (credit scoring and digital inclusion). Public sector deployments in these domains are subject to ethical review checkpoints, model validation protocols, and alignment with sectoral regulators to protect citizens from algorithmic discrimination or automated service exclusion.

International Alignment

Kenya's AI frameworks reflect deliberate alignment with international standards, regional strategies, and global ethical benchmarks. DKS 3007:2024 explicitly incorporates international technical definitions and management concepts from ISO/IEC frameworks (such as ISO/IEC 22989 and KS ISO/IEC 42001) to ensure technical interoperability and facilitate international trade. Sectoral media guidelines published by MCK align newsroom practices with international human rights standards and draw directly on international resources, including UNESCO's handbook on reporting on artificial intelligence.

At the policy level, the Kenya National AI Strategy 2025–2030 was prepared through technical engagement with international development partners, including the European Union, BMZ/GIZ, UNDP, IDRC, and FCDO. The Strategy commits Kenya to active cooperation with regional initiatives, such as the African Union digital strategy and UNESCO's Readiness Assessment Methodology (RAM), positioning Kenya as a regional hub while establishing compatibility with global risk management norms and international human rights frameworks.

Future Developments

The immediate future of AI regulation in Kenya will be defined by executive drafting mandated by Parliament and the resolution of pending legislative bills. Following the adoption of the June 2025 National Assembly Motion, MICDE is tasked with drafting a comprehensive binding national regulatory framework and ethical guidelines for AI, accompanied by a nationwide public awareness campaign. Additionally, MICDE plans to operationalize an AI Implementation Secretariat to coordinate rolling workplans, model certification, and funding mechanisms under the National AI Strategy 2025–2030.

Concurrently, the legislative pathway for the Kenya Robotics and Artificial Intelligence Society Bill 2023 remains uncertain. Following public hearings in February 2024 before the National Assembly's Departmental Committee on Communication, Information and Innovation, the Bill was paused due to stakeholder pushback regarding mandatory licensing, criminal penalties, and regulatory duplication. Policymakers are expected to evaluate whether to redraft the Bill into a harmonized regulatory instrument or incorporate its statutory objectives directly into the forthcoming MICDE national framework.

Enforcement Bodies