What AI Training Does an HR Team in Kenya Need?

TL;DR:

• This guide is for HR managers and HR teams in Kenyan organisations, including companies with 100 or more staff, who are deciding what AI training for HR teams should cover.
• A good programme teaches seven things: writing clear prompts, removing personal data, checking outputs, testing for bias, questioning vendors, knowing the law, and agreeing a team playbook.
• AI can safely help with job descriptions, policy drafts, onboarding plans, staff communications and spreadsheet formulas. People must make hiring, promotion, discipline and dismissal decisions.
• Kenya has no AI law yet, as of November 2026. The Data Protection Act 2019 and the Employment Act 2007 already apply to everything HR does with AI.
• CVs, staff files, medical details, payroll and grievance records stay out of public AI tools.

What should AI training for an HR team cover?

AI training for HR should cover seven skills, practised on the team's own tasks using invented data. A general ChatGPT workshop rarely gives HR what it needs, because HR handles sensitive personal data every day and its decisions affect people's livelihoods.

Different roles need different depth.

Nobody becomes an expert in a few days. A good session gives your team safe habits and a set of tasks they can repeat on Monday morning.

Where can AI help HR, and where should it stop?

AI is most useful for first drafts and structure, and it should stop where a decision about a named person begins.

What does Kenyan law require when HR uses AI?

Kenya had no AI-specific law as of November 2026, so HR's duties come from data protection and employment law that is already in force. We are trainers, not lawyers. Use this section to prepare good questions for your legal adviser or Data Protection Officer.

The Data Protection Act 2019

CVs often contain sensitive data. Section 2 defines sensitive personal data to include health status, ethnic social origin, belief, marital status, property details, and family details such as the names of a person's children, parents or spouse. A typical staff file holds several of these. Many CVs do too.

People must be told. Section 26 gives people the right to be informed how their data will be used. Section 29 lists what they must be told before collection, including third parties who will receive it. If AI is part of your recruitment process, your applicant privacy notice should say so.

You need a lawful basis. Section 30 lists the options, including consent, contract, legal obligation and legitimate interests. Be wary of relying on consent from staff. The ODPC's draft guidance says consent is not appropriate where there is a significant power imbalance, and it gives employer-employee AI monitoring as its example.

Solely automated decisions are restricted. Section 35 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them. There are three exceptions: where the decision is necessary for a contract, authorised by a law with suitable safeguards, or based on consent. Where a solely automated decision is made, the person must be told in writing as soon as reasonably practicable, and can ask you to reconsider or to take a new decision that is not solely automated.

Regulation 22 goes further. Organisations using automated decision-making must explain the logic involved, prevent errors, process data "in a way that eliminates discriminatory effects and bias", and make sure a person can obtain human intervention and express their point of view.

Impact assessments. Section 31 requires a Data Protection Impact Assessment (DPIA) before processing likely to create high risk. Regulation 49 includes automated decisions with significant effects, sensitive personal data, and innovative technology among the triggers.

Most AI tools sit abroad. Section 48 sets conditions for transferring personal data out of Kenya. Section 49 says sensitive personal data may be processed outside Kenya only with the person's consent and confirmation of appropriate safeguards. Pasting a CV that mentions marital status into a tool hosted overseas can engage both.

Keep data only as long as needed. Section 39 limits retention. Unsuccessful applicants' CVs sitting in an old AI chat history are a retention problem as well as a security one.

Consequences are real. Under section 63, the Data Commissioner can impose a penalty of up to KES 5 million or 1% of the previous year's annual turnover, whichever is lower. Under section 65, a person can claim compensation for damage, which includes distress. Employers are already being held to account on staff data: Kenyans.co.ke reported in September 2026 that the ODPC ordered an employer to pay a former employee KES 500,000 for keeping his photo in commercial use after he left. We have not seen the determination itself. That case had nothing to do with AI, but it suggests staff can complain and win.

An organisation with 100 staff is also too large for the exemption from registering as a data controller, which covers only entities with both turnover under KES 5 million and fewer than ten employees.

The Employment Act 2007

Discrimination covers the hiring stage. Section 5(3) bars direct or indirect discrimination against an employee or prospective employee in recruitment, training, promotion and termination. The grounds are race, colour, sex, language, religion, political or other opinion, nationality, ethnic or social origin, disability, pregnancy, marital status and HIV status.

The burden falls on the employer. Under section 5(7), in proceedings alleging discrimination, the employer must prove it did not happen. Section 5(6) makes a contravention an offence. Section 5(8) extends "employee" to applicants, "employer" to employment agencies, and "employment policy or practice" to recruitment procedures, advertising and selection criteria.

Our practical reading: if a tool you bought filters out applicants unfairly, expect to answer for it yourself. Ask your lawyer how this applies to your contract with the vendor.

Dismissal needs a person and a process. Before a termination for misconduct, poor performance or physical incapacity, section 41 requires the employer to explain the reason in a language the employee understands, and to hear and consider what the employee and their chosen colleague or union representative say. Section 43 requires the employer to prove the reason. Section 45 makes a termination unfair unless the employer proves a valid and fair reason and a fair procedure. AI can help you format a letter. It cannot hear an employee, weigh their explanation, or genuinely believe a reason exists, which is what section 43(2) looks for.

Records and policies. Section 74 requires written employment records, including warning letters and other evidence of misconduct. Keep AI-drafted documents to the same standard: a named person checks and signs them. Section 6(2) requires employers with twenty or more staff to issue a sexual harassment policy after consulting employees or their representatives, so an AI first draft is only the start of that work.

What the regulator's draft says about AI in hiring

The ODPC's draft guidance treats AI in employment screening and monitoring as a high-risk application. It names the risks as discriminatory filtering of candidates, covert monitoring and automated disciplinary decisions.

It calls for a DPIA, disclosure of AI screening tools to candidates and employees, human review of AI-recommended hiring decisions, and a way to contest the outcome. Its annex marks recruitment screening and candidate ranking, and AI-based employee productivity monitoring, as needing a DPIA. PPC Land reports that a generative chatbot goes in a review tier, because personal data can reach prompts by accident.

Note the word "recommended". Section 35 of the Act applies to decisions based solely on automated processing, while the draft appears to reach decisions where AI only makes a recommendation. It also defines automated decision-making as having no meaningful human involvement, so a manager who clicks approve on every AI ranking may offer little protection.

This is a draft, so treat it as the clearest signal available of where the regulator is heading.

What should HR never paste into an AI tool?

Keep anything that identifies a real applicant or employee out of public AI tools. A simple test: if you would not pin it on the office noticeboard, do not paste it.

Never paste:

• CVs, application forms and cover letters
• National ID, passport, KRA PIN, NSSF and health insurance numbers, and bank details
• Payroll, salary and benefits data linked to a person
• Medical records, sick notes, HIV status, pregnancy and disability information
• Grievance, harassment, whistleblowing and disciplinary files
• Performance reviews with names attached
• Next-of-kin and family details
• Interview notes about named candidates
• Restructuring or redundancy plans before they are announced
• Passwords and HR system logins

How to remove personal data properly. Replace names, employers, branches, dates and job titles with neutral labels. Here is an invented example.

Before: Wanjiru Kamau (ID 12345678), Finance Manager at our Kisumu branch, returned from maternity leave in June and has missed three month-end deadlines.

After: A manager in a support function has missed three monthly deadlines this quarter. Help me plan a supportive first conversation about expectations.

The second version removes more than the name. "The only finance manager in Kisumu" identifies someone in most organisations, and the maternity detail adds sensitive data the task does not need. The draft ODPC guidance flags re-identification from surrounding context as a risk.

What happens to what you type (as of November 2026)

Free does not mean approved. Each tool has its own rules, and they change often, so check the current terms before your team relies on them.

Work accounts are a stronger starting point, and even they need a decision from your organisation. Microsoft's documentation says Copilot Chat prompts are logged for audit and eDiscovery, generated web queries go to Bing under separate terms, and processing can happen in other countries. The section 48 question still needs an answer, and the draft ODPC guidance expects proper contracts with AI vendors. Business Daily reported in August 2026 that it calls for a written data processing agreement with offshore vendors.

Ask your IT team two things before training begins: which tools are approved, and which settings are switched on.

How does bias show up in AI hiring tools?

Bias enters when a system learns from past patterns or picks up on details that stand in for protected characteristics. An AI tool can do this without ever being told a person's ethnicity or sex.

The research. University of Washington researchers tested three text-embedding models on 554 CVs and 571 job descriptions across nine occupations, in more than three million comparisons. White-associated names were favoured in 85.1% of race tests, and Black male names were disadvantaged in up to 100% of intersectional tests. In August 2026 the authors added a correction: a coding error had inverted their gender-only results, while the race and intersectional findings were replicated by another team. This was a research simulation using American names, so the numbers do not carry over to Kenya. What carries over is the method, and the reminder that models need testing.

The courts. In Mobley v. Workday in the United States, applicants allege that Workday's screening tools discriminated against them. Workday denies this. On 22 June 2026 a federal judge in California largely refused to dismiss the claims, though some were thrown out. We found no ruling that Workday is liable as of November 2026, and the case does not bind Kenyan courts. It matters because the fight has reached the software vendor as well as the employer.

The Kenyan gap. We could not find a published audit of AI hiring tools using Kenyan names or CVs. Vendor claims of fairness tested elsewhere tell you little about how a tool treats surnames from different Kenyan communities.

In our judgement, these details deserve the closest attention on Kenyan CVs because they can stand in for grounds listed in section 5:

• Surname and home county, which can signal ethnic origin
• Secondary school and university names, which can signal region and social origin
• Languages listed
• Career gaps, which can signal pregnancy or illness
• Marital status, which many CVs still state
• Disability-related accommodations or organisations

A paired-CV test your team can run in an hour

Run this only on invented CVs, and only in a tool your organisation has approved for the exercise.

1. Write one realistic CV for a role you hire for often. Use invented details throughout.
2. Make copies that differ in one detail only: surname, home county, a career break, or a "Ms" and "Mr".
3. In a fresh chat for each copy, ask the tool to score the CV against the same job description.
4. Repeat several times, because AI answers vary from run to run.
5. Record the scores in a table and compare the groups.

A small test like this cannot prove a tool is fair. It can catch obvious problems, and it teaches recruiters to doubt a confident score. For a tool you intend to use on real applicants, ask for proper testing as part of your DPIA.

Ten questions to ask an AI hiring vendor

1. Does the tool score, rank or reject candidates, or does it only organise information?
2. Has it been tested for bias on Kenyan applicants? Can we see the results?
3. Which details about a candidate does it use, and can we switch some off?
4. Can you explain why a particular candidate received a particular result?
5. Can a recruiter review and overturn every outcome, and is that recorded?
6. Where is applicant data stored and processed, and in which countries?
7. Is applicant data used to train your models?
8. Will you sign a data processing agreement and support our DPIA?
9. How long is data kept, and how is it deleted when a candidate asks?
10. How would we respond if a candidate contests a result under section 35?

For wider buying criteria, see our AI training procurement checklist, which applies the same discipline to training providers.

Which prompts can HR use in the free tools?

These eight prompts work in the free versions of ChatGPT, Gemini and Claude, and in Microsoft Copilot Chat. They follow the four Cs. Replace the square brackets with invented or non-identifying details, and check every output before you use it.

1. Job description and advert

I am an HR officer at a [sector] company in Nairobi with about [number] staff. Write a job description and a separate job advert for a [role]. Context: the person will [three main duties] and report to [title]. Constraints: list only requirements truly needed to do the job, separate "must have" from "nice to have", under 400 words for the advert, and do not ask for age, marital status, gender, tribe, a photo or home county. Customisation: applicants will read this on LinkedIn on their phones, so use short paragraphs.

2. Reviewing an advert for bias

Review the job advert below for wording that could discourage qualified applicants or discriminate on grounds of sex, ethnic or social origin, language, religion, disability, pregnancy, marital status or HIV status. Context: the job is based in Kenya. Constraints: quote each phrase you are concerned about, explain the concern in one sentence, suggest a replacement, and tell me if a requirement looks stricter than the job needs. Do not rewrite the whole advert. Advert: [paste advert]

3. Structured interview guide and scoring sheet

Create a structured interview guide for a [role]. Context: we will interview [number] candidates and want every candidate treated the same way. Constraints: eight questions linked to these criteria: [list criteria]; give a 1 to 4 scoring guide for each with a description of a weak and a strong answer; leave out any question about family plans, health, religion or ethnic background. Customisation: panel members are line managers with no HR training, so put it in a table they can print.

The panel does the scoring, and each member records their own reasons.

4. First draft of a workplace policy

Draft a hybrid working policy for a Kenyan company with about [number] staff. Context: office days are [days] and staff handle [type of information]. Constraints: under two pages; sections for purpose, who it applies to, eligibility, expectations, equipment, data security and review date. Do not quote any law or section number; where a legal check is needed, write [LEGAL CHECK] and say what should be checked. Customisation: clear plain English for staff who will read it once.

The [LEGAL CHECK] marker stops the tool inventing citations. When you want a comparison with a statute, paste the public text in yourself and read the sections it points to.

5. Staff announcement in English and Kiswahili

Turn the policy change below into a short staff announcement. Context: it goes by email and on the staff WhatsApp group. Constraints: under 150 words, warm and respectful, say what is changing, from when, why, and who to ask [job title only]. Customisation: give an English version and a Kiswahili version that reads naturally, not word for word. Change: [describe change, no names]

A fluent Kiswahili speaker should read the second version before it goes out.

6. 30-day onboarding plan

Build a 30-day onboarding plan for a new [role] at a [sector] company. Context: they will work with [teams] and need to learn [systems or processes]. Constraints: week-by-week table with task, owner by job title, and how we know it is done; include our AI use rules in week one. Customisation: the line manager has about two hours a week to give.

7. Performance feedback from anonymised notes

Below are a manager's rough notes about an employee, with all identifying details removed. Rewrite them as feedback for a review conversation. Constraints: separate observed behaviour from opinion, mark anything vague with [EXAMPLE NEEDED], do not suggest a rating and do not add facts. Customisation: direct but respectful; the employee should leave knowing what to do next. Notes: [paste anonymised notes]

8. Excel formulas without sharing the data

I have an Excel table with these columns: Department, Start Date, Exit Date, Contract Type. Give me formulas to calculate headcount at the end of each month, leavers per department, and monthly attrition rate. Explain each formula in one sentence. I am comfortable with basic formulas but not pivot tables.

Share the column headings only. The formulas come to you and the staff data stays in your spreadsheet.

What goes wrong when HR teams adopt AI?

The usual failures are invented law, rubber-stamping, shadow use and quiet monitoring, and clear rules prevent many of them.

How should an HR team run this training?

Start small: one policy, one session built on real tasks, and a review after 30 days. If you are unsure whether the organisation is ready, our AI readiness assessment is a useful first step.

Before the session

• List the ten HR tasks that take the most writing time.
• Confirm with IT which tools are approved. Training on tools people cannot use is one of the reasons corporate AI training does not stick.
• Build practice material from invented CVs and staff scenarios.

In the session

• Work on those tasks using the four Cs, in the free version of each tool.
• Practise removing personal data, then swap and try to re-identify each other's examples.
• Run the paired-CV test together.

Within 30 days, agree a one-page HR playbook

• Approved tools and accounts
• The never-paste list
• Tasks AI may help with, and decisions reserved for people
• Who signs off AI-assisted documents
• What applicants and staff are told about AI use
• When a DPIA is needed and who leads it
• Who to contact with a concern or suspected data breach
• A review date

Link this to your organisation-wide rules. Our guide to an AI usage policy for Kenyan organisations covers what those should contain.

After 60 to 90 days, time the same tasks again, and include the minutes spent checking and correcting. Keep a log of errors caught and use it as practice material for the next group.

Where training will not help. It will not repair a recruitment process without clear criteria, and it will not replace your lawyer or Data Protection Officer on a DPIA. AI will not correct unfair decisions by managers, and it can speed them up.

Questions people ask

Is it legal to use AI to screen CVs in Kenya?

No Kenyan law bans it. Section 35 of the Data Protection Act restricts decisions made solely by automated means, and section 5 of the Employment Act bars direct and indirect discrimination in recruitment. The ODPC's draft guidance treats recruitment screening as high risk and expects a DPIA, disclosure to candidates and human review.

Can we paste a CV into ChatGPT?

Not into a public tool. A CV is personal data and often contains sensitive data, and sending it abroad engages sections 48 and 49 of the Act. Use invented or properly anonymised text, or a tool your organisation has approved and assessed for that purpose.

Do we have to tell applicants we use AI?

Section 26 gives people the right to know how their data is used, and section 29 sets out what to tell them before collection. If a decision is solely automated, section 35 requires written notice. The draft ODPC guidance goes further and expects disclosure of AI screening tools to candidates and employees, so we suggest including AI use in your applicant privacy notice.

Can AI write a warning or termination letter?

It can help with structure using anonymised facts. The facts, the reason and the decision must come from a person, and sections 41, 43 and 45 of the Employment Act require a real hearing, a provable reason and a fair procedure. Have the letter reviewed as you normally would.

Can we use AI to monitor staff productivity?

Proceed with great care. The ODPC's draft guidance lists AI-based employee productivity monitoring as needing a DPIA, and says consent is not an appropriate basis where there is a power imbalance such as employer-employee AI monitoring. Take legal advice first and tell staff clearly what is collected and why.

Which AI tool should an HR team use?

Use whichever tool your organisation has approved. If you already have Microsoft 365, Copilot Chat with a work account is a sensible place to start because enterprise data protection applies at no additional cost on eligible plans. ChatGPT, Gemini and Claude all have free plans that are good for practice on non-sensitive tasks.

How long does HR AI training take?

A focused session can establish safe habits, but practice over the following weeks is what makes them last. Plan a follow-up within 30 days. Anyone promising expertise in a few days is overselling.

Sources

• Data Protection Act, No. 24 of 2019 (ODPC copy) (last checked 8 November 2026)
• Data Protection (General) Regulations, 2021 (ODPC copy) (last checked 8 November 2026)
• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (ODPC copy) (last checked 8 November 2026)
• Employment Act, No. 11 of 2007, Revised Edition 2022 (last checked 8 November 2026)
• ODPC, draft Guidance Note on Artificial Intelligence, July 2026 (archived copy from 8 October 2026; the ODPC link returned an error when we checked) (last checked 8 November 2026)
• Digital Policy Alert, ODPC closes consultation on draft AI guidance (last checked 8 November 2026)
• PPC Land, report on the ODPC draft and its DPIA annex (3 August 2026) (last checked 8 November 2026)
• Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026) (last checked 8 November 2026)
• The Star, "State tightens rules on AI use of Kenyans' data" (24 July 2026) (last checked 8 November 2026)
• Techweez, "Senate committee rejects AI Bill" (16 October 2026) (last checked 8 November 2026)
• Kenyans.co.ke, former employee awarded KES 500,000 by the ODPC (20 September 2026) (last checked 8 November 2026)
• Wilson and Caliskan, "Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval" (corrected version, August 2026) (last checked 8 November 2026)
• Bloomberg Law, "Workday Loses Bid to Toss AI Discrimination Suit in California" (23 June 2026) (last checked 8 November 2026)
• UC Today, background on Mobley v. Workday (14 January 2026) (last checked 8 November 2026)
• OpenAI Help Center, "Data controls in ChatGPT" (last checked 8 November 2026)
• ChatGPT plans and pricing (last checked 8 November 2026)
• Google, Gemini Apps Privacy Hub (last checked 8 November 2026)
• Google, Gemini subscriptions (last checked 8 November 2026)
• Google Workspace, Generative AI Privacy Hub (last checked 8 November 2026)
• Claude Help Center, sensitive data and who can view conversations (last checked 8 November 2026)
• Claude plans and pricing (last checked 8 November 2026)
• Microsoft Learn, "Microsoft Copilot Chat Privacy and Protections" (last checked 8 November 2026)
• Microsoft, Copilot Chat plans and availability (last checked 8 November 2026)

Where FuKazee fits in

FuKazee has trained more than 3,000 people since 2022, and we build AI training for teams in Kenya around the work in front of them. For HR teams, that means your recruitment, policy, onboarding, performance and staff communication tasks, practised on invented data so nothing sensitive enters the room.

We assume nobody knows AI yet and we avoid jargon. We show the free version of every feature, we do not push one tool, and we include Microsoft 365 and Copilot because that is where much HR work happens. We teach the four Cs first, then how to check every output, test for bias and agree a playbook your team will use. Sessions can run on-site in Nairobi, online or as a hybrid.

To talk through what your HR team needs, email us at lead@fukazee.com