Need an AI Acceptable Use Policy Template for Kenya?

TL;DR:

• This post gives you a full AI acceptable use policy in 15 plain-English clauses. Copy it, fill in the square brackets and have a Kenyan lawyer review it, with your data protection officer, before you adopt it.
• As of 10 November 2026 we found no AI law in force in Kenya. The Data Protection Act 2019 and the Employment Act 2007 already shape what your policy must do.
• Clause 4 (what may go into a tool) and clause 12 (report mistakes the same day) do most of the work.
• Asking staff to sign is the weakest step on its own. In a 2026 French survey, people at workplaces with only a written policy used personal AI accounts about as often as people at workplaces with nothing.
• So teach first, give staff an approved tool, and collect signatures after the session.

Who this template is for

This is for HR managers, company secretaries, compliance officers, IT leads and founders who need the actual words.

We already have a guide on what an AI usage policy should cover. Read that first if you are still deciding the scope. This post picks up where it stops, with wording you can paste into a document today and a plan for getting people to follow it.

If you only want a short staff notice, our guide to using ChatGPT under the Data Protection Act has a seven-point version.

This is general information from a training company. It is not legal advice. The template is only a starting point. Have a lawyer qualified in Kenya review it against your contracts, your sector and your data before you adopt it.

What is law, what is draft and what is good practice?

We found no Kenyan law, as of 10 November 2026, that requires a document called an AI acceptable use policy. Your policy is still the easiest way to show you took existing duties seriously.

We could not open the ODPC's own copy of its draft on 10 November 2026, so what we say about its content comes from PPC Land and Business Daily. We have not read the CBK's draft either, and rely on Deloitte's summary. Check both documents before you rely on them.

Under each clause below, a label says what it rests on. Law means the clause restates a duty in force. Good practice, resting on law means the law creates the duty, but the wording goes further than the law requires. Good practice means our own suggestion. Draft means not binding.

Why a clear rule helps you in a Kenyan court

Courts do look at written usage rules. In Wenani v Safaricom Limited & another [2025] KEELRC 3628 (KLR), decided on 11 December 2025 and summarised by CM Advocates, the Employment and Labour Relations Court upheld a summary dismissal. The employee had opened a customer's M-PESA account without authority and shared the statement. The court found breaches of the employer's Information Security Acceptable Usage Policy and its Data Protection Policy, and found that a fair procedure was followed under section 41 of the Employment Act.

That case involved no AI. Even so, it shows a written usage rule carrying weight in court when it was applied through a proper hearing.

Five decisions to make before you copy

The template has gaps only you can fill. Settle these first.

1. Which tools are approved, and on which accounts? Our Data Protection Act guide compares what the main providers' terms said for personal and work accounts.
2. Who owns the policy? Name one role.
3. Who do staff tell when something goes wrong? Give one name and one phone number.
4. Do your approved tools keep logs? Microsoft, for example, said as of November 2026 that Copilot Chat logs prompts and responses for auditing and eDiscovery. Check your own suppliers' terms. Staff need to know this.
5. Where does your disciplinary procedure sit? Clause 14 points to it.

The template: 15 clauses you can copy

1. Purpose

1. Purpose. We want you to use AI to do good work faster. This policy explains how to do that while protecting our clients, our colleagues and the company.

Good practice. Open with permission. In our view, a list of bans on the first line puts people off.

2. Who and what it covers

2. Who and what this covers. This policy applies to all employees, contractors, interns and volunteers whenever they do work for [Company], on any device, including personal phones. An "AI tool" is any software that writes, summarises, transcribes, translates, creates images, scores or ranks, or takes actions for you. This includes chatbots, AI features inside email, Word, Excel or a browser, meeting note-takers and browser add-ons.

Good practice. Some people may not think of a feature inside Word as "AI". Name it.

3. Approved tools and accounts

3. Approved tools. Use only the tools on the Approved AI Tools list at [location], and sign in with your work account. Do not use a personal account for company work. To request a new tool, write to [role]. You will get an answer within [5] working days. Until then, do not use it for work.

If you have no paid or work accounts yet, use this version instead:

3. Approved tools (interim). Until we have work accounts, you may use [tool] with your own login for Green material only (see clause 4). Amber and Red material must stay out of it.

Good practice, resting on law. No law we found requires an approved list or work accounts. But where a data controller uses a data processor, section 42(2) of the Data Protection Act requires a written contract, and Regulation 24 lists what it must contain. A staff member's free personal account usually gives the company no such contract.

4. What may go into a tool

4. What you may put into an AI tool.

Green: fine in any approved tool. Published information. General questions. Excel formula questions. Drafts with no names and no confidential facts.

Amber: only after you remove the details, or only in a tool the list marks as cleared for it. Internal reports, meeting notes, customer problems described in general terms, draft plans.

Red: never, unless [role] has approved that exact use in writing. ID numbers, KRA PINs, phone numbers, M-PESA and bank details. Payroll. Health information. Anything about children. CVs, appraisals and disciplinary files. Client lists. Contracts and anything under a non-disclosure agreement. Passwords and system keys. Unpublished financial results. Board papers. Tenders and bids.

If a colleague could guess who it is, it is still personal data. If you are unsure, treat it as Red and ask [contact].

Good practice, resting on law. The colours and the lists are ours, and much of the Red list (contracts, board papers, tenders) is about confidentiality, which the Data Protection Act does not cover. For personal data, section 25(d) of the Act limits it to what is necessary. Section 25(h) and section 48 restrict sending it outside Kenya, and section 49 requires consent and confirmation of safeguards for sensitive personal data. Sensitive data is wider than many people expect: section 2 includes property details, marital status and the names of a person's children, parents or spouse.

5. You answer for the result

5. You are responsible for the result. AI can be wrong and still sound certain. Read everything before you use it. Check every fact, figure, name, quote, legal reference and link against a source you trust. If you send it, sign it or file it, it is your work.

Good practice. Business Daily reports that the ODPC's draft, which is not binding, holds the deploying organisation accountable for compliance across the system's life, so your staff are the checking layer.

6. When a second person must review

6. Second review. A second person must read the following before they leave the company: public statements, client contracts, financial figures reported outside the company, and any legal or regulatory filing. Anything going to a court or regulator must go through [legal contact] first.

Good practice, with a legal edge. Oxford's AI tracker reports that the Judiciary's draft AI policy, which was not binding as at September 2026, would require disclosure and independent verification of AI-assisted filings. Our guide for legal and compliance teams explains what has already happened in Kenyan courts.

7. Decisions about people

7. Decisions about people. AI must never make the final decision on a person's hiring, pay, promotion, discipline, dismissal, loan, insurance claim or access to a service. That decision belongs to a person who has the file, the time to read it and the power to disagree. Using AI to screen, score or rank people needs written approval from [role] before it starts.

Good practice, resting on law. This clause is stricter than the law. Section 35 of the Data Protection Act gives people a right not to be subject to a decision based solely on automated processing that has legal effects or significantly affects them, with exceptions for contract, another law, or consent. Regulation 22 requires, among other things, that people can obtain human intervention. Regulation 49 lists automated decisions with significant effect among high-risk processing that needs an impact assessment.

Draft. PPC Land reports that the ODPC's draft lists recruitment screening and employee productivity monitoring among uses that always need one.

8. Being open about AI

8. Being open. If a customer, client or colleague sincerely asks whether AI was used, tell the truth. Never let someone believe they are talking to a person when they are talking to a bot. If a client contract, funder, regulator, school or court requires you to disclose AI use, follow that rule.

Good practice, resting on law in part. Where a decision with legal or significant effects is based solely on automated processing, section 35(3) of the Data Protection Act already requires you to tell the person in writing, and Regulation 22 requires people to be informed about automated decision making. The rest of this clause is good practice. PPC Land reports that the ODPC's draft also says people must be told when a decision was automated.

9. Meeting recorders and note-takers

9. Recording and note-takers. Do not switch on an AI recorder or note-taker unless the meeting organiser agrees and everyone present has been told. Do not use one in disciplinary, medical, legal or board meetings without approval from [role]. Check the summary before you share it.

Good practice, resting on law. Section 29 of the Data Protection Act requires people to be told before collection, in so far as practicable, that their personal data is being collected, why, and who receives it. The specific rules in this clause go further and are our suggestions.

10. Other people's work and our own

10. Copyright. Do not upload material you have no right to use. Do not ask a tool to copy a named person's work or a brand's style. For anything we will rely on commercially, such as a logo, a product name or a published report, a person must add real creative work, and you must keep your drafts.

Good practice, informed by a Tribunal judgment. In Aryeh Movement Limited v Akoth & another [2025] KECOT 6 (KLR), dated 22 August 2025, Kenya's Copyright Tribunal observed that any aspects of works generated by AI are not eligible for copyright unless the author can show enough human intervention or effort to give the work an original character. The Tribunal did not decide whether the works in that dispute qualified, and it noted that the Copyright Act does not address AI, so treat this as still developing. Business Daily reported the case in September 2026 and gave a ruling date of 24 August 2026; the copy of the judgment we read is dated 22 August 2025.

11. AI that takes action

11. AI that acts for you. Do not let an AI tool send messages, make payments, change records, delete files or read your inbox on its own unless [role] has approved that set-up. A person approves every payment. Never change bank details or release money because of a voice note, a video call or an email alone. Confirm on a number you already hold.

Good practice. For banks, Deloitte's summary of the CBK draft says agentic AI would be classed as high risk.

12. Report mistakes the same day

12. If something goes wrong, tell us the same day. If you paste Red material into a tool, see a wrong or harmful output reach someone, or see a tool behave strangely, tell [name, phone, email] the same day. Take a screenshot first. Do not delete anything until you are told to. Prompt, honest reporting will count in your favour. Hiding a mistake is a breach of this policy.

Good practice, resting on law. The same-day rule is ours. Under section 43 of the Data Protection Act, where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm, the controller must notify the Data Commissioner within 72 hours of becoming aware. Every hour a mistake stays hidden makes that harder to manage.

13. Logs and privacy

13. Logs. Your prompts and outputs on company tools may be logged and reviewed by [role] for security, audit and legal reasons. Keep private matters out of work tools.

Good practice, resting on law. Staff are data subjects too, so section 29 of the Data Protection Act applies to them. Telling staff about logging does not on its own make monitoring lawful, so check your lawful basis under section 30 with your lawyer.

14. If the policy is not followed

14. Breaches. A breach may lead to action under our disciplinary procedure at [location]. We will look at what happened, whether you knew the rule and whether you reported it. Before any decision to end your employment, we will explain the reason in a language you understand and hear your side. You may have a colleague or shop floor union representative with you.

Law, in part. Section 41 of the Employment Act requires the explanation where an employer is considering termination for misconduct, poor performance or physical incapacity. It also requires the hearing, and section 41(2) applies even to summary dismissal. Section 42(1) excludes probationary contracts, so ask your lawyer how to treat those. Section 12 applies where the employer had fifty or more employees on the date the employee started work. It requires the written statement to set out the disciplinary rules, or point to an accessible document that does. The sentence on what we will look at is good practice.

15. Owner and review

15. Owner and review. [Role] owns this policy. Send questions to [contact]. We review it every six months, and whenever we add a major tool, change a supplier or the law changes. This version is dated [date].

Good practice. Tools change faster than an annual review cycle.

The acknowledgement

I attended the briefing on this policy on [date]. It was explained to me and I had the chance to ask questions. I know where to find it, what Red material is, and who to tell if something goes wrong.

Name: ............ Signature: ............ Date: ............

The first sentence matters most. It records that someone explained the policy, which proves more than a tick in a box.

How should you adapt it for your sector?

Add a short annex for your sector, and leave the 15 clauses alone so everyone shares one core document.

How do you get staff to read, sign and follow it?

Give people a safe tool and teach them with examples from their own work. Collect signatures after that.

The evidence is limited but points one way. IntoTheMinds surveyed 500 working people in France who use generative AI (published 5 October 2026). This table shows the share who use only personal accounts for work.

Treat this with care. It covers one country, it only counts existing AI users, and it comes from a firm that sells research. It relies on what people report about themselves. The firm gives a margin of error of about 4 points for the whole sample, and it will be wider for each row. It shows a link and cannot prove a cause. We found no comparable Kenyan survey.

The closest Kenyan signal is a poll of about 150 people, taken in October 2026 during a keynote at the Safaricom Cybersecurity Summit and reported by TechTrends Kenya. In it, 42% said they knew unapproved AI was in use where they work, and 6% said their organisation had a fully developed AI strategy and governance policy that had been reviewed and supported by staff training. The report itself says this does not represent Kenyan businesses as a whole. The keynote speaker leads Akili AI, a company that offers AI governance tools, so read the poll as a signal only.

Seven steps that help

1. Sort out the tool first. Your staff will use something. Check what your current subscriptions already include, because some come with an AI tool that has work-data protections. For example, Microsoft said as of November 2026 that enterprise data protection is available in Copilot Chat at no extra cost. Compare suppliers on their current terms, and our Data Protection Act guide shows how those terms differ.
2. Make a one-page version. Clause 4, clause 12 and the contact name. Offer it in English and Kiswahili. Have a fluent colleague check the Kiswahili.
3. Run a 30-minute briefing per team. Ten minutes on why, ten on the quiz below, ten on questions.
4. Have managers go first. Staff watch what their manager does.
5. Sign after the briefing. Keep the signed forms and the attendance list. Section 42(4) of the Data Protection Act expects "all reasonable steps" to make sure staff follow security measures, and these records help show yours.
6. Build it into induction. Every new joiner gets the same briefing in the first week.
7. Keep it alive. Share one question from staff each month, with the answer. Update the policy when the questions show a clause is unclear.

A practice quiz for the briefing

These situations are invented for training. Swap in examples from your own teams.

Does the policy need to go into employment contracts?

Usually keep it as a separate policy that contracts refer to, so you can update it without reissuing every contract. Section 10(5) of the Employment Act says that where a matter in the written particulars changes, the employer must revise the contract in consultation with the employee and tell them in writing. Ask your lawyer where your own contracts draw that line.

A 30-day rollout

Track simple things: who has been briefed, how many questions came in, how many near-misses were reported. A long silence on near-misses usually means people are not reporting them.

Three prompts to adapt the template

These use the four Cs we teach: Clarity, Context, Constraints, Customisation. The policy itself is safe to paste only if you have removed anything confidential.

1. Find the gaps

Review the AI acceptable use policy below. Context: we are a [sector] employer in Kenya with [number] staff, using [tools]. Constraints: list unclear wording, missing situations and any clause two employees could read differently. Do not state what Kenyan law requires. Mark anything a lawyer should check with [CHECK]. Customisation: the reader is an HR manager. Policy: [paste]

2. Make the one-page staff version

Turn this policy into one page for staff who will read it on a phone. Context: it is for [team]. Constraints: under 200 words, short sentences, keep the Green, Amber and Red lists and the reporting contact, add nothing that is not in the text. Customisation: give an English version and a Kiswahili version that reads naturally. Policy: [paste]

3. Build a quiz from real work

Write eight short "Can I do this?" situations for a [team] in a Kenyan [sector] company, based on this policy. Constraints: invent every detail, use no real names, give the answer and the clause number for each. Customisation: make them match daily tasks such as [tasks]. Policy: [paste]

Have a person read every result before you use it.

What usually goes wrong

Questions people ask

Is an AI acceptable use policy a legal requirement in Kenya?

We found no Kenyan law that requires one by that name as of 10 November 2026. The Data Protection Act does expect reasonable steps to make sure staff follow security measures, and a clear policy with training is a practical way to take them.

How is this different from our data protection policy?

Regulation 23 of the 2021 General Regulations requires you to develop, publish and regularly update a policy on how you handle personal data. This one tells staff how to behave with AI tools. You usually need both, and they should agree with each other.

Can we dismiss someone for pasting customer data into ChatGPT?

Possibly, depending on the facts, the rule they were given and the procedure you follow. We found no reported Kenyan decision on that exact situation. If you dismiss for misconduct, section 41 of the Employment Act applies, even to summary dismissal, so take advice before acting.

Should we just ban ChatGPT?

TechTrends Kenya's report warns that blanket bans may push staff towards unapproved tools, where you cannot see what they do. Approve something, set the data rules and teach people.

How long should the policy be?

About two pages, with a one-page staff version. Length is fine while each clause answers a question staff really ask.

Does the policy cover personal phones?

It should, whenever someone is doing company work. Clause 2 says so. Without that line, people may assume the rules stop at the office laptop.

Who should write it?

HR or compliance can lead, with IT and whoever handles data protection. A lawyer should read it before it goes out. Ask staff from at least two teams to test the wording.

Sources

All last checked 10 November 2026.

• Data Protection Act, No. 24 of 2019 (ODPC)
• Data Protection (General) Regulations, 2021 (ODPC)
• Employment Act, section 10 (Sheriaplex)
• Employment Act, section 12 (Sheriaplex)
• Employment Act, section 41 (Sheriaplex)
• CM Advocates, "Data Protection in the Workplace: Employee Access to Customer Data" (on Wenani v Safaricom Limited & another)
• Copy of the judgment, Aryeh Movement Limited v Akoth & another [2025] KECOT 6 (KLR), 22 August 2025
• Business Daily, "Tribunal: No copyright protection for AI works without human creativity" (7 September 2026; gives a different ruling date)
• PPC Land, report on the ODPC's draft AI guidance note (3 August 2026)
• Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026)
• Digital Policy Alert, ODPC consultation on the draft Guidance Note on AI
• Digital Policy Alert, CBK consultation on draft AI guidance for banks
• Deloitte Kenya, CBK's Draft Guidance Note on Artificial Intelligence in the Banking Sector
• The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026)
• regulations.ai, Kenya AI Regulation Overview (updated 12 September 2026)
• University of Oxford, "AI in Kenya's Judiciary and Law Enforcement"
• Microsoft Learn, Copilot Chat privacy and protections
• IntoTheMinds, survey of generative AI use at work in France (5 October 2026)
• TechTrends Kenya, "Shadow AI is exposing a governance gap inside businesses" (15 October 2026)
• Hapa Kenya, on Akili AI's governance tools (22 May 2026)

Where FuKazee fits in

FuKazee trains teams to use AI on the work in front of them, and safe use is part of every programme. We assume nobody in the room knows AI yet, and we avoid jargon. We show the free version of every feature and we do not promote one tool. We have trained more than 3,000 people since 2022.

If you have a policy, we can build the briefing and practice around it, using invented or cleaned examples from your own teams. If you do not have one yet, our corporate AI training can help leadership work out clear internal rules. We teach the habits. Your lawyer gives the legal sign-off, and a training session will not fix a policy that has no approved tool behind it.

To talk through a policy briefing for your team, email lead@fukazee.com