On this page
TL;DR:
- An AI governance framework is a written answer to one question: who decides what? This post gives you a decision table, a small committee, a tool approval route, a register and an incident log.
- As of 10 November 2026 we found no AI-specific law in force in Kenya. The Data Protection Act 2019 and its Regulations already bind you. They set several duties and leave most job titles to you.
- The AI Bill 2026 is a Bill. The ODPC's AI guidance, the national AI policy and the CBK's AI guidance are drafts.
- In our view, a firm of under 20 people does not need a committee. One accountable person and a monthly check will do.
- Every decision needs one named owner, even where a group gives advice.
Who this guide is for
This is for chief executives, operations and risk leads, company secretaries, data protection officers and IT heads in Kenyan companies. It suits an organisation where AI use has started and nobody can say who is allowed to approve what.
Other guides of ours cover the neighbouring questions, and we will not repeat them here:
- What directors must own: AI governance for Kenyan boards.
- What a staff policy should cover: AI usage policy for Kenyan organisations.
- Lawful basis, vendors and data transfers: Can staff use ChatGPT under the Data Protection Act?
- Lawyers and in-house teams: AI for law firms in Kenya.
This is general information from a training company. It is not legal advice. Have a lawyer qualified in Kenya review the tables and templates here before you adopt them.
What is law, what is a Bill, what is draft and what is good practice?
Only the first group below can bind you today. Sort every document your team quotes into one of these groups before you build anything.
Law: in force now
| Instrument | What it says that affects governance |
|---|---|
| Data Protection Act, 2019, section 42 | Choose processors with sufficient guarantees, have a written contract, and take all reasonable steps to make sure staff follow security measures |
| Section 31 | Do a data protection impact assessment (DPIA) before processing likely to result in high risk |
| Section 35 | People have a right not to be subject to solely automated decisions that significantly affect them, with listed exceptions |
| Section 43 | Notify the Data Commissioner within 72 hours of becoming aware of a qualifying breach, and record the facts, effects and remedy |
| Section 24 | Covers data protection officers (DPOs) and their tasks |
| General Regulations, 2021 | Regulation 24 lists vendor contract terms. Regulation 22 covers automated decisions. Regulation 49 lists high-risk processing |
| Employment Act, section 41 | Requires an explanation before termination for misconduct, poor performance or physical incapacity, and a hearing before dismissal for misconduct or poor performance. Section 42(1) excludes probationary contracts |
| Companies Act, 2015, section 145 | Directors owe reasonable care, skill and diligence |
The law tells you what must happen. It rarely says which job title does it. Most of the table further down is your own choice.
Bill: proposed and not law
The Artificial Intelligence Bill, 2026 (Senate Bill No. 4) would regulate AI systems. The Star reported on 15 October 2026 that the Senate ICT committee recommended the Senate not proceed with it. We found no report of a full Senate vote by 10 November 2026. See our AI Bill explainer.
Draft: a signal of direction
| Document | Status on 10 November 2026 | Why it matters here |
|---|---|---|
| ODPC Guidance Note on AI | Digital Policy Alert records a consultation from 1 to 17 August 2026. We found no final version | PPC Land reports it expects an incident register and DPO involvement in high-risk uses |
| Draft Kenya Artificial Intelligence and Other Emerging Technologies Policy, 2026 | Consultation closed 4 August 2026. The Star reported in October 2026 that the Ministry told the Senate committee it was in its final stages | Bowmans lawyers say it creates no binding obligations itself, and to expect duties on incident reporting and human oversight later |
| CBK Guidance Note on AI in banking | Consultation was scheduled to close on 7 November 2026. We found no final version | Banks only. Deloitte's summary is covered below |
We could not open the ODPC's own copy of its draft on 10 November 2026, so what we say about its content comes from PPC Land and Business Daily. We have not read the CBK's draft either, and rely on Deloitte's summary. Check both documents before you rely on them.
Voluntary standards
These are references you may choose to follow.
- NIST AI Risk Management Framework (United States). The Govern section asks for documented roles and lines of communication (2.1), executive responsibility for AI risk decisions (2.3) and a way to inventory AI systems (1.6).
- ISO/IEC 42001:2023. An international standard for an AI management system, published on 18 December 2023, which the publisher says applies to organisations of any size.
- Kenya's AI code of practice. KEBS consulted on draft DKS 3007:2024 from 8 April to 13 June 2024. One tracker, regulations.ai, describes that draft as non-binding and says it recommends senior management accountability, named AI risk owners and cross-functional oversight committees. The tracker also says KEBS later listed a published standard, KS 3007:2025, but flags that it found no official page confirming the change of status. Digital Policy Alert still shows the draft's consultation as being processed. We could not open KEBS's own documents and have not seen the final text, so confirm the status and the wording with KEBS before you cite it.
Good practice: everything else
The committee, the three approval lanes, the register fields and the severity levels below are our suggestions. Nothing in Kenyan law that we found prescribes them.
Who owns which decision?
Give every decision below one named owner. Copy this table, then change the titles to match your organisation.
| Decision | Who decides | Ask first | Basis |
|---|---|---|---|
| What AI will never do here | Board or owners | Chief executive, DPO | Good practice |
| Who the accountable executive is | Board or owners | None | Good practice |
| Approve or change the AI policy | Accountable executive | Committee, HR, DPO | Good practice |
| Approve a tool with no personal or confidential data | AI lead | IT | Good practice |
| Approve a tool touching personal data | AI committee | DPO, IT, legal | Law requires the contract and guarantees (s.42). Who approves is your choice |
| Whether a DPIA is needed | DPO or data protection lead | The team proposing it | Law requires the DPIA where risk is high (s.31, reg. 49) |
| Accept the risk left after a DPIA | Accountable executive | DPO | Law requires the assessment. Sign-off is good practice |
| Consult or submit to the ODPC | DPO or data protection lead | Legal | Law sets the duty (s.31(3) and (5)). Who does it is your choice |
| Sign a vendor contract | Person with delegated authority, after DPO and IT agree | Legal, procurement | Law on contents (reg. 24) |
| Use AI in decisions about people | Accountable executive with HR head | DPO | Law sets the limits (s.35, reg. 22). Who decides is your choice |
| Give out licences and access | IT | Line manager | Good practice |
| Grade an incident | Incident lead | DPO, IT | Good practice |
| Notify the Data Commissioner | DPO or data protection lead, with the chief executive told | Legal | Law sets the duty (s.43). Who does it is your choice |
| Tell affected people | DPO with communications | Legal | Law sets the duty (s.43). Who does it is your choice |
| Switch off a tool | Any one of: accountable executive, DPO, IT head | None | Good practice |
| Switch a tool back on | AI committee | Whoever switched it off | Good practice |
| Discipline a staff member | HR under the disciplinary procedure | Line manager | Law on the hearing (Employment Act s.41) |
Two rows deserve a second look. Stopping a tool should be easy and restarting it should be harder. And the person who wants a tool should never be the only person who approves it.
Which roles do you need, and who holds them?
You need five roles at most, and one person can hold several in a small firm.
| Role | What it does | Usually held by |
|---|---|---|
| Accountable executive | Answers to the board for AI outcomes | Chief operating officer, chief executive or a senior director |
| AI lead | Runs the register, the requests and the committee | Operations, strategy or digital lead |
| DPO or data protection lead | Advises on data, DPIAs and breaches | DPO, or the person doing that job |
| IT and security lead | Checks tools, settings and access | Head of IT, or your IT provider |
| Use owner | Answers for one AI use in one team | The manager whose team uses it |
Do you need a data protection officer?
The Act says "may". Section 24(1) says a controller or processor may designate a DPO in listed cases, including where core activities involve regular and systematic monitoring of people or processing sensitive data. PPC Land reports that the ODPC's draft calls designation "strongly advisable" in some large-scale cases, and lists DPO involvement as a minimum for high-risk uses. It also reports that the draft does not resolve the tension between the Act's "may" and those mandatory-sounding lists, so take advice.
Whoever holds this role, section 24(2) allows other duties as long as there is no conflict of interest. Do not make your DPO the person championing or buying the AI tool. Section 24(6) also requires a DPO's contact details to be published on the website and given to the Data Commissioner.
How the set-up changes with size
| Size | Structure | Rhythm |
|---|---|---|
| Under 20 staff | Founder or director is accountable. One person keeps the register. No committee | 30-minute check each month |
| 20 to 100 staff | Committee of three or four | Monthly, plus urgent requests by email |
| Over 100 staff, or regulated | Committee of five to seven, reporting to a board committee. Internal audit checks it without deciding | Monthly, with a quarterly board report |
These sizes are our suggestions. Check first where you stand with our AI readiness assessment.
What should a small AI committee do?
An AI committee makes the decisions that need more than one view, and passes everything else to a named person. We found no Kenyan rule requiring one for companies.
A committee can also slow work down. Three protections help: a deadline for every request, a fast lane for low-risk tools, and a named person who can act alone in an emergency.
Paste this into a document and adapt it.
AI Committee: terms of reference
Purpose. To approve AI tools and uses that carry more than low risk, and to review incidents.
Members. [Accountable executive] (chair), [AI lead] (secretary), [DPO or data protection lead], [IT lead], [HR lead]. Legal joins when contracts are discussed.
Quorum. Three members, including the DPO or data protection lead for anything touching personal data.
Deciding. The chair decides if members disagree, and the reasons are written down. The DPO's advice is recorded, even when it is not followed.
Conflicts. A member with an interest in a supplier says so and leaves that discussion.
Deadlines. Standard requests get a decision within [10] working days. If a decision is late, the secretary tells the chair.
Records. Every decision goes in the AI register with the date, conditions and review date.
Reporting. The chair reports to [board or committee] each [quarter].
Review. These terms are reviewed once a year.
A 45-minute agenda is enough: open incidents (10 minutes), new requests (20), register items due for review (10), and what to tell the board (5).
How should a new AI tool get approved?
Sort every request into one of three lanes by what the tool touches, whatever the brand.
| Lane | What falls in it | Who decides | Target time |
|---|---|---|---|
| Fast | No personal or confidential data, for example a tool for drafting from public material | AI lead | 2 working days |
| Standard | Internal confidential data or limited personal data | AI committee | 10 working days |
| High | Decisions about people, sensitive data, customer-facing bots, AI that takes actions on its own | AI committee and accountable executive, after a DPIA where needed | Plan for at least 60 days if a DPIA goes to the ODPC |
Section 31(5) says DPIA reports are submitted sixty days before processing. Regulation 52(3) says that if you hear nothing within sixty days of submitting, you may start.
A one-page request form to copy
- Tool name, supplier and plan (free, business or enterprise)
- Who asked for it, and who will be the use owner
- What task it will do, in one sentence
- What data goes in (none, internal, personal, sensitive)
- Will it affect a decision about a person?
- Will customers see or talk to it?
- Can it act on its own (send, pay, delete, change records)?
- How will a person check its work?
- What happens if it fails or the price doubles?
- What is the lane? (AI lead completes)
Five checks before anyone says yes
- Contract. If the supplier handles personal data for you, section 42(2) and regulation 24 require a written contract covering instructions, confidentiality, security, deletion or return of data, and audit.
- Sub-suppliers. Regulation 25 says a processor cannot bring in a third party without your prior authorisation.
- Location. Sections 48 and 49 set conditions for data leaving Kenya. Our Data Protection Act guide explains them.
- Training and retention. Find out from the supplier's current terms whether your data trains its models and how long it is kept.
- Your own settings. Someone must confirm the settings, because the plan you bought may leave features switched on or off.
Draft. Business Daily reports that the ODPC's draft says deploying entities "bear accountability" for compliance across the system's life. Buying from a large supplier leaves that duty with you.
What goes in the AI register?
An AI register is one spreadsheet listing every AI tool and use, with its owner. Nothing in Kenyan law that we found requires one for ordinary companies. NIST's framework asks for an inventory, and Deloitte says the CBK draft would require banks to submit an annual AI deployment register.
| Field | Made-up example |
|---|---|
| Use and team | Summarising supplier invoices, finance |
| Tool and plan | [Tool], business plan |
| Use owner | Finance manager |
| Lane | Standard |
| Data involved | Supplier names and amounts, no individuals |
| Personal data? DPIA? | No personal data. DPIA not needed, reason recorded |
| Contract on file? | Yes, with date |
| Human check | Accounts officer checks each total |
| Approved by and date | AI committee, [date] |
| Review date | Six months later |
Start with what staff already use. Ask each team without blame, because a survey that feels like an investigation gets false answers. A poll taken in October 2026 during a keynote at the Safaricom Cybersecurity Summit, reported by TechTrends Kenya, found 42% of about 150 attendees knew unapproved AI was in use at work. The report itself says the poll does not represent Kenyan businesses as a whole, and the keynote speaker leads Akili AI, a company that offers AI governance tools.
How should you log and handle AI incidents?
Log anything that went wrong or nearly did, grade it, and let the grade decide who gets called. Most entries will be small. They are the early warning for the serious ones.
| Level | What it means | Who is told | Target |
|---|---|---|---|
| 1. Near-miss | Caught before it reached anyone | AI lead | Logged within 2 working days |
| 2. Error reached someone | A wrong figure went to a client, or a bot gave bad advice | Use owner and AI lead | Same day |
| 3. Serious | Personal or confidential data exposed, unfair treatment of a person, or financial loss | Incident lead, DPO and accountable executive | Immediately, as the legal clock may be running |
These levels are our suggestion. The legal part is narrower.
Law. Section 43 applies where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm. The controller notifies the Data Commissioner within 72 hours of becoming aware and, if later, gives reasons. A processor notifies the controller without delay and, where reasonably practicable, within 48 hours. Section 43(8) requires a record of the facts, the effects and the remedial action. Regulation 37 says a breach is taken to carry a real risk of harm in two cases. One is where it involves a person's full name or identification number together with any data listed in the Second Schedule, such as pay or bank account numbers. The other is where it involves a person's account identifier together with a password, security code, access code or similar.
Many AI errors fall outside section 43. A wrong figure in a report is an accuracy problem. Whether a staff member pasting data into a public tool meets the test depends on the facts, so the DPO decides quickly, with legal advice where needed.
Draft. PPC Land reports that the ODPC's draft expects an incident register covering discriminatory outcomes, systemic inaccuracies and privacy harms. Deloitte says the CBK draft would have banks report material AI incidents within 24 hours, with quarterly incident reports. See our page on AI training for banks.
Fields for the log
Date and time found. Date and time the company became aware. Who reported it. Tool and account. What happened. Whose data or which customers. Level. Who was told and when. Whether a notification was made, and why or why not. What was fixed. Date closed.
Keep the "became aware" field exact. That is when the 72 hours start.
A worked example (invented)
This company and its request are made up to show how the table works.
A 60-person Nairobi distributor has a sales manager who wants an AI note-taker for client calls. She fills in the form.
- Lane. The recordings hold client names and voices, so it is personal data. The AI lead places it in Standard.
- DPO. The data protection lead checks the DPIA question against regulation 49, including its item on innovative use of new technology. In this invented case she takes advice, decides a DPIA is not needed because the use is small in scale and affects no decisions about people, and records why. Your facts may lead to a different answer.
- IT. The IT provider confirms settings and who can see the recordings.
- Contract. The supplier's terms are checked against regulation 24. Data leaves Kenya, so the transfer basis is written down.
- Committee. It approves with conditions: clients are told at the start of each call, as section 29 expects, HR and legal meetings are excluded, and recordings are deleted after 30 days.
- Register. The sales manager is named as use owner, with a six-month review.
Three weeks later a summary misstates a discount given to a client. A rep catches it before sending. It goes in the log as a near-miss, and the team adds a rule that prices are always checked against the quote.
What should the board see?
The board needs a short report on a schedule. Our board guide covers directors' duties and questions. From this framework it needs five lines: tools in use by lane, high-lane approvals, incidents by level, overdue reviews, and regulatory changes.
Section 145 of the Companies Act holds directors to reasonable care, skill and diligence, so give them something they can actually read.
A 30-day set-up
| Week | What happens | Owner |
|---|---|---|
| 1 | Board or owners name the accountable executive. Copy and adapt the decision table | Chief executive |
| 2 | Each team lists what it already uses. Start the register | AI lead |
| 3 | Set up the committee or monthly check. Sort existing tools into lanes | Accountable executive |
| 4 | Publish the request form and the incident contact. Brief managers on both | AI lead, HR |
Then review it after three months. Ask where requests got stuck and which rows nobody used.
Three prompts to help you build it
These use the four Cs we teach: Clarity, Context, Constraints, Customisation. Remove names and confidential details first.
1. Adapt the decision table
Below is an AI decision table. Context: we are a [sector] company in Kenya with [number] staff and these roles: [titles]. Constraints: replace each role with one of our titles, flag any row where one person would approve their own request, and do not say what the law requires. Mark anything a lawyer should check with [CHECK]. Customisation: return a table for a one-page handout. Table: [paste]
2. Run a practice incident
Write a 20-minute practice exercise for our AI committee. Context: an invented staff member at a [sector] company has pasted a customer list into a public AI tool. Constraints: reveal the facts in four stages, ask at each stage who decides what, and invent every detail. Customisation: at the end, list what we should record in the incident log.
3. Draft the quarterly board note
Below are our AI register totals and incident counts, with no names. Write a one-page note for directors. Constraints: plain English, use only these numbers, flag overdue reviews, and end with one decision the board needs to make, if any. Customisation: readers have no technical background. Data: [paste]
What usually goes wrong
| What goes wrong | Why | What to do |
|---|---|---|
| The committee becomes a queue | No deadlines, no fast lane | Set target times and use the Fast lane |
| Everyone owns it, so nobody does | The owner is a group | One name per decision |
| The DPO is also the project sponsor | The small team doubled up | Separate the roles, as section 24(2) warns of conflicts |
| The register goes stale | Nobody has a review date | Put a review date on every row |
| Staff hide near-misses | Reporting brought blame | Thank people who report |
| Drafts treated as law | Someone quoted a news story | Keep the law, Bill, draft and good practice labels |
| Governance exists only for big systems | Staff tools felt too small to count | Put everyday tools in the register too |
More on this pattern is in our piece on why corporate AI rollouts fail.
Questions people ask
Does Kenyan law require an AI governance framework?
We found no law that uses those words as of 10 November 2026. The Data Protection Act already requires contracts, assessments, breach handling and reasonable steps with staff. A framework is a tidy way to show who does each of them.
Do we need an AI committee?
We found no Kenyan requirement for companies. Under about 20 staff, one accountable person and a monthly check is usually enough. Banks should read the CBK draft. Deloitte says it sets out roles for the board, senior management, risk and audit.
Who is responsible if a supplier's AI makes a mistake?
Section 42 expects you to choose and contract with suppliers with care, and reports of the ODPC's draft say deployers stay accountable across the system's life. For banks, Deloitte says the CBK draft keeps institutions accountable for third-party AI. Your contract may let you claim against the supplier, so ask a lawyer to look at it.
Should we get ISO/IEC 42001?
In our view, only if a client, regulator or your own risk team needs it. It is a full management system and a real commitment. Most small and mid-sized firms should get the decision table, the register and the incident log working first.
What should we do about the draft guidance?
Read it as a guide to direction and design for it where it costs little, such as an incident register. Do not tell staff or clients it is law. Check for final versions every few months.
Can the same person be AI lead and DPO?
In a small firm, sometimes. Section 24(2) allows other duties if they cause no conflict of interest. Trouble starts when that person is also the one pushing for the tool, so have someone else review those requests.
Where does HR fit?
HR owns anything that affects staff: monitoring, hiring tools, discipline and job changes. HR should sit on the committee, and no AI use affecting employees should go ahead without HR.
Sources
All last checked 10 November 2026.
- Data Protection Act, No. 24 of 2019 (ODPC)
- Data Protection (General) Regulations, 2021 (ODPC)
- Employment Act, section 41 (Sheriaplex)
- Companies Act, section 145 (Sheriaplex)
- The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026)
- Techweez, report on the Senate committee and the AI Bill (16 October 2026)
- Mzalendo, The Artificial Intelligence Bill (Senate Bill No. 4 of 2026)
- PPC Land, report on the ODPC's draft AI guidance note (3 August 2026)
- Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026)
- Digital Policy Alert, ODPC consultation on the draft Guidance Note on AI
- Digital Policy Alert, consultation on the draft AI and Emerging Technologies Policy
- Bowmans Kenya, on the draft AI and Emerging Technologies Policy (via IT Edge News, 3 August 2026)
- Digital Policy Alert, CBK consultation on draft AI guidance for banks
- Deloitte Kenya, CBK's Draft Guidance Note on Artificial Intelligence in the Banking Sector
- NIST, AI Risk Management Framework Core
- IEC Webstore, ISO/IEC 42001:2023
- regulations.ai, Kenya AI Code of Practice (DKS 3007:2024)
- regulations.ai, Kenya AI Regulation Overview (updated 12 September 2026)
- Digital Policy Alert, KEBS draft standard DKS 3007:2024
- TechTrends Kenya, "Shadow AI is exposing a governance gap inside businesses" (15 October 2026)
- Hapa Kenya, on Akili AI's governance tools (22 May 2026)
Where FuKazee fits in
FuKazee trains teams to use AI on the work in front of them, and governance is part of that. We assume nobody in the room knows AI yet, we avoid jargon, and we do not promote one tool. We have trained more than 3,000 people since 2022.
For leaders, our corporate AI training includes helping you work out governance and internal rules, and our page on AI training for executives shows what that session looks like. We can run a working session where your own people fill in the decision table and practise an incident. We do not replace your lawyer or data protection officer, and a workshop will not keep a register up to date, so someone in your company needs to own that.
To talk through a governance session for your leadership team, email lead@fukazee.com
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
