When news broke of an AI Bill, dubbed Artificial Intelligence Bill, 2026, sponsored by Nominated Senator Karen Nyamu, the big question was whether the bill’s ambition matched Kenya’s actual reality.
That question still lingers, except that what has changed is that the bill is now formally in motion.
The bill received its first reading in the Senate on April 2 and has since been committed to the Standing Committee on Information, Communication, and Technology.
The public has until May 5 to submit written memoranda, either by hand at Parliament Buildings or by email to the Clerk of the Senate.
That window is short, and given how much this bill could affect the country’s digital economy, the participation it draws will say a lot about how seriously Kenya takes this kind of governance.
The bill wants to create rules for how AI tools are built and used in Kenya, with more oversight for uses that carry greater risk to people’s lives.
For instance, a bank algorithm deciding whether you get a loan would face tougher scrutiny than the tool that keeps junk mail out of your inbox, and that is a reasonable place to draw the line.
The Data Protection Act of 2019 covers how your personal data is collected and stored, but it has nothing to say about what happens when a machine uses that data to make a decision about you.
The AI Bill tries to close that gap by giving Kenyans the right to ask why an automated system made a particular decision and the right to have a human being review it.
For a country where mobile credit, insurance, and even health services are increasingly driven by automated tools, that protection is seemingly long overdue.
The bill also proposes an entirely new office of an AI Commissioner with the power to inspect systems, summon people for questioning, issue fines, and run a public registry of high-risk AI deployments. On paper, that sounds decisive.
In practice, Kenya already has the Office of the Data Protection Commissioner and the Communications Authority, both of which have mandates that stretch into this territory.
Adding a third regulator without clearly defining where one’s authority ends and another’s begins is a recipe for bureaucratic delay and conflicting instructions for companies trying to comply.
There is also the problem of jurisdiction reach. The AI systems that affect the most Kenyans daily, the tools used in banks, hospitals, and government offices, are largely built by companies headquartered in the United States, Europe, and Asia, which do not answer to Nairobi.
No Kenyan regulator can compel a Silicon Valley firm to open its code for an audit. Where local jurisdiction is real and meaningful is over how those tools are deployed here, and that is the area where the bill’s protections for citizens are most defensible.
The compliance burden is where the bill risks doing the most unintended damage. Many Kenyan developers are not building AI from scratch. They adapt open-source models created elsewhere for local applications in agriculture, lending, and healthcare.
The bill requires audit trails for training data and impact assessments for high-risk systems. For a developer working with a model they did not build, that information simply does not exist.
Criminalizing failure to produce records that a developer cannot access is a drafting problem that the Standing Committee needs to fix before this passes.
Kenya is not running ahead of the curve on the idea of AI regulation. That conversation is necessary, and the bill has usefully forced it into the open.
Where it is running ahead is on institutional architecture and penalty structures that do not match the scale of the local market. The 2027 elections give the deepfake provisions real urgency, and those are worth keeping.
The three-body governance structure and the criminal penalties for compliance failures that are structurally impossible to meet are not.
The public participation window is open. If you work in tech, finance, health, or policy in this country, this is a law that will touch your work. The Senate’s inbox is waiting.
