On this page
TL;DR:
- Kenya has no AI law in force as of November 2026. Your duties already come from the Constitution, the Employment Act and the Data Protection Act.
- Fairness: the Employment Act bars discrimination in recruitment and at work, and if a claim is brought, the employer must prove it did not discriminate. Using an AI tool does not change that.
- Disclosure: tell staff and applicants when AI handles their personal data. The law does not require a label on every AI-assisted email.
- Monitoring: recent Kenyan cases have accepted employer access to work systems, and one relied on a clear handbook rule. Hiring a private investigator to look into a manager's private life cost one bank KES 5 million in damages.
- Accountability: a named person owns every decision about a person. "The system said so" will not prove a fair reason for dismissal.
Who this guide is for
This guide is for HR managers, company directors, compliance staff and line managers in Kenyan organisations. It covers four questions that come up once AI touches your people: is it fair, have we told them, how far can we watch them, and who answers when it goes wrong.
It is a practical guide, and it is not legal advice. For the detail of data protection law, including vendor contracts and sending data abroad, read our guide to Kenya's Data Protection Act and AI. This post does not repeat it.
What is law, what is draft and what is good practice?
Throughout this guide we mark each point with one of four labels, because news coverage often blurs them.
- Law: in force now.
- Draft: published by a regulator or ministry, but not final.
- Bill: proposed in Parliament, and not law.
- Good practice: our advice, or a voluntary standard. Nobody can penalise you for skipping it, though it may help you if something goes wrong.
| Document | Status as of 10 November 2026 |
|---|---|
| Constitution of Kenya, Articles 27, 31 and 41 | Law. Article 27(5) applies to private persons too |
| Employment Act, sections 5, 41, 43 and 45 | Law |
| Data Protection Act, 2019 and General Regulations, 2021 | Law |
| ODPC Guidance Note on Artificial Intelligence (July 2026) | Draft. Consultation closed on 17 August 2026, and we found no final version. We could not open the regulator's own copy, so the details below come from PPC Land's report |
| Kenya Artificial Intelligence and Other Emerging Technologies Policy, 2026 | Draft. Public comments closed on 4 August 2026. In October 2026 the ICT ministry said it was in its final stages, and we found no adopted version. The Star reports it would guide an AI Governance Act that does not yet exist |
| The Artificial Intelligence Bill, 2026 | Bill. In October 2026 a Senate committee recommended not proceeding with it, and we found no report of a full Senate vote |
| UNESCO Recommendation on the Ethics of AI (2021) | Good practice for employers. Adopted by UNESCO's 193 member states and addressed to governments |
| NIST AI Risk Management Framework | Good practice. A voluntary US framework |
| EU AI Act | Law in the EU only. It matters if you operate or sell into the EU |
We could not open the Employment Act on Kenya Law's own site, so we read a hosted copy of its 2022 revised edition. Later amendments may exist. Ask your lawyer to check the current version before you rely on any wording.
Fairness: how do you stop AI from discriminating?
Test the tool on your own people, and keep a human in every decision that affects someone's job. The legal duty already exists, and it sits with you.
Law. Section 5(3) of the Employment Act forbids direct or indirect discrimination against an employee or prospective employee. It covers recruitment, training, promotion, terms of employment and termination. The listed grounds are race, colour, sex, language, religion, political or other opinion, nationality, ethnic or social origin, disability, pregnancy, marital status and HIV status. (Older copies of the Act print "mental status" where the 2022 edition has "marital status".) Article 27(5) of the Constitution also bars private persons from discriminating.
Two parts of the section deserve a manager's attention:
- Section 5(7) puts the burden on the employer. If discrimination is alleged, you must prove it did not happen.
- Section 5(6) makes a contravention an offence.
Now imagine a rejected applicant claims a CV tool was biased, and you cannot explain how it scored anyone. That is a difficult position to defend.
Where a decision is made solely by automated means, regulation 22(2)(h) of the Data Protection (General) Regulations also requires processing "in a way that eliminates discriminatory effects and bias".
Draft. PPC Land reports that the ODPC's draft expects accuracy and fairness to be validated before use against representative test data, with attention to differences across demographic groups. It also expects monitoring for discriminatory patterns afterwards.
What the evidence shows
Two examples show why testing matters, and neither is Kenyan.
- Gender Shades (2018). Buolamwini and Gebru tested three commercial gender classification systems. Error rates were up to 34.7% for darker-skinned women and at most 0.8% for lighter-skinned men. This study is old, and it covered face analysis only. Tools may have improved. The lesson for a Kenyan employer is that a tool built and tested elsewhere may perform differently on your staff.
- Mobley v Workday (United States). Applicants allege that an AI screening system disadvantaged people aged 40 and over. On 16 May 2025 a federal judge granted preliminary certification of a collective action. We found no ruling that discrimination took place, and Workday can still ask the court to decertify the group. It does show that the screening tool itself can end up at the centre of a claim.
Where bias hides in a Kenyan setting
This section is our own view. We know of no Kenyan study measuring it. These are the proxies we would check first, because a tool can learn them even if you remove names.
| What the tool sees | What it may stand in for | Listed ground |
|---|---|---|
| Surname, home area, primary school | Ethnic community | Ethnic or social origin |
| Which university, or a town campus | Family income and region | Social origin |
| Fluent, polished English | Schooling and background | Language, unless English is an inherent requirement of the job |
| Career gap of several months | Pregnancy or illness | Pregnancy, disability |
| Phone-only applications, odd formatting | Income | Social origin |
| Date of graduation | Age | Age is not in section 5(3) of the 2022 edition, but Article 27 lists it |
Section 5(4)(b) allows you to distinguish on the basis of "an inherent requirement of a job". So if a role truly needs strong written English, you can test for it. Write down why, and test it directly.
A simple fairness check
Good practice. Run this before you rely on any tool that ranks or scores people.
- Take a past set of applications or appraisals, with outcomes you already trust.
- Run the tool on them without using its results for any live decision.
- Compare the outcomes between groups, such as women and men, or by region of origin.
- Where you see a gap, read those files by hand and find out why.
- Write down what you found and what you changed.
Be careful with step 3. Ethnic origin, health status and sex are sensitive personal data under the Data Protection Act, so a bias test needs its own lawful basis and safeguards. Small numbers can also mislead, so ask your lawyer and someone good with numbers.
Disclosure: what do you have to tell people?
Tell people when AI handles their personal data or shapes a decision about them. You do not need to label every piece of AI-assisted writing.
Law. Section 29 of the Data Protection Act requires you to tell people, before collecting their data, its purpose and which third parties receive it. An AI vendor may be one of those. Regulation 22(2) adds that for automated individual decisions you must inform the person, give meaningful information about the logic involved, explain the consequences and make human intervention available.
Draft. The ODPC's draft says people must be told when a decision was automated, according to PPC Land. The Star reports that the draft national AI policy says people should be told when they are dealing with an AI system and should be able to seek review of important algorithmic decisions.
| Situation | Law | Good practice |
|---|---|---|
| AI helped draft an internal email | We found no rule requiring disclosure | The sender reads it and owns it |
| AI notetaker in a meeting | It collects personal data, so section 29 applies | Announce it at the start and let people object |
| Chatbot answering staff or customers | Draft guidance and policy point to telling them | Say it is a bot, and give a route to a person |
| AI screens or ranks CVs | Section 29 applies, and section 35 if the decision is solely automated | Say so in the advert or privacy notice |
| AI helps write an appraisal | Personal data, so the notice must cover it | The manager writes the final words and says AI assisted |
| AI used on client work | Check your contract and confidentiality terms | Agree a position with each client |
Wording you can copy
Have your lawyer adapt these. Replace the brackets with your own details.
For a job advert:
We use [tool] to help sort applications. A member of our HR team reviews every application before any decision is made. You can ask us for a review by a person at [email address].
For a staff notice:
We use [tools] for [purposes]. Our IT team can see [what is logged] and keeps it for [period]. We do not use AI to make a final decision about anyone's pay, promotion, discipline or employment. Questions go to [role].
Be careful with consent
Consent is a weak basis in the workplace. Regulation 4(4) says consent is not freely given where a person cannot refuse or withdraw it without detriment. A staff member who fears for their job may not be able to refuse. Section 30 offers other grounds, such as performing a contract or legitimate interests, but legitimate interests fall away where the processing is unwarranted given the harm to the person. Get advice on which basis fits each use.
Monitoring: how far can an employer watch staff?
Kenyan courts have accepted inspection of work systems for a legitimate purpose or under a clear policy, and in one case awarded damages for surveillance that reached into private life. We found no Kenyan decision on AI productivity scoring.
What the courts have said
| Case | What happened | What the court decided |
|---|---|---|
| Kendagor v Dig Deep (Africa) [2025] KEELRC 2753, 9 October 2025 | An employer used emails as evidence in a disciplinary case. The employee said it had wrongly accessed her private account. The staff handbook said personal use of its systems was subject to monitoring | Upheld the termination, as summarised by EY (we could not open the judgment itself). Work systems are the employer's property and the handbook gave a basis for monitoring. EY notes that privacy rights remain, within limits |
| A Nairobi hotel case, reported August 2026 | An employer inspected a work computer that an employee had also used for her private business | The inspection was lawful, proportionate and for a legitimate business purpose. The employee still won on unfair dismissal, because she had been dismissed before any process |
| A bank case, Mombasa, 1 October 2024 | A bank hired a private investigator to follow a suspended branch manager in restaurants and pubs | Breach of Article 31, with KES 5 million in damages. The dismissal itself was upheld |
These are single decisions on their own facts. An appeal or different facts could go another way. Together they suggest three working rules: have a written policy, stay on work systems, and keep investigations out of people's private lives.
What AI changes
AI makes monitoring cheap and constant. AlgorithmWatch published a report in June 2026 based on a confidential survey of AI workers in Kenya. Workers at outsourcing firms described being scored on tasks per hour, error rates, decision speed and idle time. They said these scores decided shifts, bonuses and contract renewals, with little room to appeal. The report is based on workers' accounts, and it does not name the firms. It shows what scoring can feel like for the person being scored.
Draft. According to PPC Land, the ODPC's draft would require a DPIA for employee productivity monitoring, and lists employment screening and monitoring as high risk.
Law elsewhere. The EU AI Act bans AI that infers emotions in the workplace, except for medical or safety reasons, from 2 February 2025. It also treats AI used for monitoring performance and behaviour at work as high risk, with those rules applying from 2 December 2027 according to the timeline we checked. This binds you only if you fall under EU law, though we think it is a sensible guide.
| Practice | Legal position in Kenya | Our view |
|---|---|---|
| Security logs on work accounts | Likely fine with notice and a clear purpose | Reasonable |
| Admin audit of AI tool use | Microsoft documents audit of Copilot interactions, and Google lets admins control Gemini activity | Tell staff it exists and who can see it |
| CCTV in work areas | Personal data, so sections 25 and 29 apply | Keep it to clear security needs and never in private areas |
| Biometric attendance | Biometric data is sensitive, and regulation 49(1)(c) lists it as a DPIA trigger | Offer a real alternative where you can |
| Keystroke, screenshot or idle-time scoring | Section 25 limits data to what is necessary, and the draft expects a DPIA | Avoid it. It measures activity and misses the quality of work |
| Webcam or emotion analysis | No Kenyan rule on this that we found. Banned at work in the EU | Do not use it |
| Personal phones and private WhatsApp | Article 31 protects private communications | Stay out, unless a lawyer has advised otherwise on specific facts |
Six tests before you monitor
Good practice. If you cannot answer all six, wait.
- What exact problem are we solving?
- Is there a less intrusive way to solve it?
- Have staff been told in writing what is collected and why?
- Who can see the data, and is that list short?
- How long do we keep it?
- Will a person review the data before anything happens to an employee?
Accountability: who answers when AI gets it wrong?
The employer answers, and so does the manager who relied on the output. A vendor's contract may let you claim against the vendor later, but your staff and applicants will come to you.
Law. Three provisions matter most:
- Section 35 of the Data Protection Act gives people a right not to be subject to a decision based solely on automated processing that significantly affects them, with limited exceptions. If you do take such a decision, section 35(3) requires written notice, and the person can ask you to reconsider or to decide again without automation.
- Sections 41, 43 and 45 of the Employment Act require you to explain the reason for a proposed termination on grounds of misconduct or poor performance, hear the employee's response, prove the reason and show it is valid and fair. An AI score, on its own, will struggle to do that.
- Sections 63 and 65 of the Data Protection Act. The Data Commissioner can impose a penalty of up to KES 5 million, or 1% of annual turnover, whichever is lower. A person who suffers damage from a breach is entitled to compensation.
Draft. The ODPC's draft would require "meaningful human involvement", and says a challenge must reach a person with authority to change the result, according to PPC Land. A reviewer who approves everything without reading is unlikely to count.
A simple ownership table
Good practice. Fill this in for each AI use that affects people.
| Question | Example answer |
|---|---|
| Who decides to use this tool? | Director of HR |
| Who reviews each output? | The hiring manager, with the full application in front of them |
| Who can overrule it? | Any reviewer, without needing to justify it to the tool's owner |
| Who can a staff member complain to? | A named person outside the decision |
| Where do we record errors? | An incident register held by compliance |
| Who checks it for bias, and how often? | HR and an independent colleague, twice a year |
| Who can switch it off? | The Director of HR or the Data Protection Officer |
PPC Land reports that the ODPC's draft also expects an incident register that records discriminatory outcomes.
Be fair when staff misuse AI
Be consistent, and make sure the rule existed first. It is hard to discipline someone for pasting data into a tool if you never said not to. Publish a clear AI usage policy, train people on it, and then apply it the same way to junior and senior staff. Section 41 still applies to any disciplinary process.
Ethics the law does not reach
Some questions have no legal answer yet, and they are still yours to think about. These are matters of good practice. UNESCO's Recommendation offers a useful test: AI systems should not "displace ultimate human responsibility and accountability".
- Junior roles. If AI takes the routine work that trained your graduates, how will they learn? Decide this deliberately.
- Honesty about jobs. Do not tell staff that nobody will be affected unless you are sure. See what a CEO should ask on this point.
- Skill loss. If staff stop checking, they lose the ability to catch mistakes. Keep some work where people still reason it through.
- The people behind the tools. Some AI systems depend on data labellers and content moderators, including people working in Nairobi. Ask suppliers how that work is done and what protections those workers have.
What usually goes wrong?
| What goes wrong | Why it happens | What to do |
|---|---|---|
| The vendor says the tool is "bias-free" | A sales claim nobody tested | Run your own check on your own data |
| A human "reviews" 300 CVs in an hour | The review exists on paper only | Give reviewers time, the file and power to disagree |
| Staff discover monitoring by accident | Nobody told them | Publish the notice before switching it on |
| An AI summary becomes the record of a disciplinary | Convenience | Keep the full notes, and have a person verify the summary |
| A manager pastes an appraisal into a free tool | No rule and no safe alternative | Give approved tools and a clear rule |
| A policy exists but nobody owns it | Written once and filed | Name an owner and review it twice a year |
Three prompts for HR and compliance
Remove names and personal details before pasting. Have a person check every result.
1. Audit a job advert or screening rule
Review the job advert and screening criteria below for possible indirect discrimination under Kenya's Employment Act, section 5. Context: we are a [sector] employer in Kenya. Constraints: list each criterion, say which listed ground it might affect and why, say whether it looks like an inherent requirement of the job, and suggest a fairer wording. Do not give a legal conclusion. Customisation: the reader is an HR manager and will discuss this with our lawyer. Text: [paste]
2. Write a monitoring notice
Draft a one-page notice telling staff about the following workplace monitoring: [describe]. Context: we are a Kenyan employer and the Data Protection Act applies. Constraints: use plain English, say what is collected, why, who can see it, how long it is kept, and who to ask. Do not claim that any practice is legally approved. Mark anything I have not told you with [CHECK]. Customisation: many staff will read this on a phone.
3. Test a decision before you make it
I am a manager considering a decision about an employee, and an AI tool has given me this output: [paste, with names removed]. Context: [brief facts]. Constraints: list what the output does not tell me, what other evidence I should look at, what the employee might say in response, and what questions I should ask them. Do not recommend an outcome. Customisation: be direct and use short sentences.
A one-page rule you can adopt
Good practice. Adapt this for your staff handbook, after legal review.
- We use AI to help people. A person makes every decision about someone's job, pay or discipline.
- We tell staff and applicants when AI handles their personal data.
- We test tools that rank or score people before use, and regularly afterwards.
- We monitor only work systems, only for a stated purpose, and we say so in writing.
- Anyone affected by an AI-assisted decision can ask a person to review it.
- Every AI tool that affects people has a named owner.
- If AI causes harm, we record it, fix it and tell the people affected.
Boards should see this too. Our guide to board-level AI orientation covers what directors should ask.
Questions people ask
Are AI ethics a legal requirement in Kenya?
Some of it is. Discrimination, privacy, fair dismissal and automated decisions are already covered by the Constitution, the Employment Act and the Data Protection Act. Other parts, such as ethics committees or labels on AI-assisted writing, are good practice. Kenya has no AI-specific law in force as of November 2026.
Can my employer read what I type into Copilot or Gemini at work?
It may be able to, if you use a work account. Microsoft documents audit of Copilot interactions, and Google says admins control Gemini activity retention on work accounts. Your employer should tell you what is logged and who can see it. Assume that a work account is not private.
Can a company in Kenya use AI to shortlist CVs?
It can use AI to help, with care. A decision made solely by machine that significantly affects someone engages section 35 of the Data Protection Act. The employer also carries the burden of disproving discrimination under section 5(7) of the Employment Act. Keep a person in the decision, tell applicants, and test the tool first.
Can someone be dismissed because of an AI performance score?
A score alone is a weak basis. The employer must explain the reason, hear the employee and prove a valid and fair reason under the Employment Act. A score can prompt a conversation, and a person must then look at the evidence and decide.
Do we need to tell customers we used AI?
We found no general Kenyan rule requiring it for all AI-assisted work. If AI handles their personal data, the Data Protection Act's notice duties apply. Check your contracts too, because some clients set their own rules.
Does an AI notetaker need everyone's agreement?
It records personal data, so everyone should be told at the start. Whether you need consent or can rely on another basis depends on the meeting, so ask for advice on sensitive ones such as disciplinary or medical discussions. Our good-practice advice is to let people object.
Is the AI Bill 2026 going to change all this?
It is still a Bill and may never become law. In our view, final ODPC guidance is the more likely near-term change, though we found no date for it. See our explainer on the AI Bill.
Sources
- Constitution of Kenya, 2010, full text at Constitute, Articles 27, 31 and 41, last checked 10 November 2026
- Employment Act, No. 11 of 2007 (Revised Edition 2022), hosted copy, sections 5, 41, 43 and 45, last checked 10 November 2026
- The Data Protection Act, No. 24 of 2019, Gazette copy on the ODPC website, last checked 10 November 2026
- The Data Protection (General) Regulations, 2021, ODPC, regulations 4, 22 and 49, last checked 10 November 2026
- PPC Land, report on the ODPC's draft AI guidance note, last checked 10 November 2026
- Digital Policy Alert, status of the ODPC draft Guidance Note on Artificial Intelligence, last checked 10 November 2026
- The Star, "State tightens rules on AI use of Kenyans' data" (24 July 2026), last checked 10 November 2026
- IT Edge News, on the draft national AI policy and its 4 August 2026 comment deadline, last checked 10 November 2026
- The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026), last checked 10 November 2026
- EY Tax News, Kenyan court on employee privacy in the digital workplace (14 November 2025), last checked 10 November 2026
- Business Daily, "Court says employers can inspect work computers used for personal business" (11 August 2026), last checked 10 November 2026
- Business Daily, report on the Mombasa privacy ruling (7 October 2024), last checked 10 November 2026
- AlgorithmWatch, "Scored and silenced: how algorithmic systems govern Kenya's content moderators" (24 June 2026), last checked 10 November 2026
- Buolamwini and Gebru, Gender Shades (2018), last checked 10 November 2026
- CDF Labor Law, preliminary certification in Mobley v Workday, last checked 10 November 2026
- EU AI Act, Annex III, last checked 10 November 2026
- EU AI Act, Article 5, last checked 10 November 2026
- EU AI Act implementation timeline, last checked 10 November 2026
- UNESCO, Recommendation on the Ethics of Artificial Intelligence, last checked 10 November 2026
- NIST, AI Risk Management Framework, last checked 10 November 2026
- Microsoft Learn, Enterprise data protection in Microsoft Copilot and Copilot Chat, last checked 10 November 2026
- Google, Use Gemini Apps with a work or school account, last checked 10 November 2026
Where FuKazee fits in
FuKazee trains teams to use AI well and safely, including HR teams and managers who make decisions about people. We teach staff how to check AI's output, what must stay out of a public tool, and how to keep a person in charge. We are trainers, and your legal questions should go to your own lawyer.
We assume nobody knows AI, we avoid jargon, and we say plainly that nobody becomes an expert in a few days. We show the free version of every feature and never promote one tool. Since 2022 we have trained more than 3,000 people.
See our pages on AI training for HR teams and AI training in Kenya, or read our guide for HR teams using AI.
To talk about responsible AI training for your team, email us at lead@fukazee.com
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
