Kenya's Artificial Intelligence Bill 2026 Explained: Where It Stands and What It Means for Public Institutions

TL;DR:

• The Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2026) is a proposed law sponsored by nominated Senator Karen Nyamu. It is not law.
• It was published on 19 February 2026 and read a first time in the Senate on 2 April 2026. In mid-October 2026 the Senate ICT Committee reportedly recommended that the Senate not proceed with it (The Star, Techweez). As of 29 October 2026, we found no record of a Senate vote.
• It proposes an Office of the Artificial Intelligence Commissioner, a four-tier risk system, and strict duties for "high-risk" AI, including AI used in public administration.
• It names public entities, including counties, directly. Proposed penalties reach KES 5 million, two years in prison, or both.
• Public bodies do not need to wait. The Data Protection Act 2019 already applies to AI that uses personal data, and the steps in this guide are useful whatever happens to the Bill.

Where the Bill stands today (29 October 2026)

What it is. The official name is the Artificial Intelligence Bill, 2026. It is a Senate Bill, numbered Senate Bills No. 4 of 2026. The Senate's own Bill Digest lists the sponsor as Sen. Karen Nyamu, a nominated senator, and the type as an ordinary Bill. It is a private member's Bill, not a government Bill.

Key dates.

What a committee recommendation means. In Kenya's Parliament, a committee report is tabled in the House and guides the debate, but the full Senate still decides. The Bill would next come up for Second Reading, where senators consider the report and vote. If the Senate votes the Bill down, it falls. If the Senate passes it, possibly with amendments, the steps that remain are the Committee of the Whole House, the Third Reading, consideration by the National Assembly, and presidential assent. Only after assent, and from the date the law says it starts, would any of it bind a public office.

So for now, treat the Bill as a strong signal of where AI rules in Kenya are heading. Do not treat it as a set of legal duties.

How it fits with what already exists

Kenya already has a law, a strategy, a draft policy and draft regulator guidance that touch AI. Here they are side by side.

Two points stand out. First, the Data Protection Act is already the main AI rulebook for most government uses: if a system touches personal data, the Act applies now. Our guide on data protection and AI in the public sector goes into this in detail.

Second, the policy and the Bill are running in parallel. The Senate committee's main recommendation was that government should finish the national AI policy first and let it guide future legislation. The Star's July coverage of the draft policy says it will guide an AI governance law and supporting regulations. So a different Bill, shaped by the policy, may follow.

The main provisions, in plain English

This summary follows the Senate's official Bill Digest. The Digest has no legal status of its own, so the published Bill text is the final word.

1. A new regulator: the Office of the Artificial Intelligence Commissioner

What the Bill says. It creates the Office of the Artificial Intelligence Commissioner as an independent state office. The Commissioner would be its head and accounting officer.

• Appointment: the Public Service Commission recruits and sends three names to the President, who nominates one for Parliament's approval. The term is five years, renewable once.
• Functions include risk assessments, conformity audits, guidelines and codes of practice, regulatory sandboxes, complaints, a public register of high-risk AI systems (including county systems), and AI literacy.
• Powers include inspecting premises, systems and records, requiring information, issuing enforcement notices or fines, and summoning witnesses.

An Advisory Committee on Artificial Intelligence, chaired by the Commissioner, would include the Ministry of ICT, the Office of the Data Protection Commissioner, NACOSTI, Council of Governors nominees and civil society.

What it would mean for a public institution. A second regulator, alongside the Data Protection Commissioner, able to inspect your systems and review your AI risk assessments.

A note on conflicting summaries. Some commentary describes a separate "AI Authority" and fines linked to turnover. The Senate's Bill Digest describes one Office, an Advisory Committee and fixed maximum fines. We have followed the Digest.

2. Risk-based classification

What the Bill says. The Commissioner would classify AI systems by the risk they pose to health, safety, fundamental rights, the environment or societal welfare. There are four tiers:

Detailed criteria would come later, through regulations.

What it would mean for a public institution. "Public administration" is named as high-risk. A tool that helps decide eligibility for a service, ranks applicants, flags cases for audit or triages patients could fall in that tier. Until regulations exist, assume any AI that shapes a decision about a person is high-risk.

3. Duties on providers and deployers of high-risk AI

What the Bill says. The Bill places duties on both providers (those who build and supply AI) and deployers (those who use it in their work). For high-risk AI they would have to:

• carry out risk assessments and human rights impact assessments before deployment, and put mitigation measures in place;
• ensure transparency, traceability and explainability of how the system reaches decisions;
• keep datasets and system documentation (EY's summary of the Bill reports a minimum retention period of five years);
• comply with the Data Protection Act;
• ensure robustness and cybersecurity; and
• obtain consent when using a person's likeness or voice.

Two clauses matter especially for government. The Commissioner would review the assessments for AI systems used in the public sector. And the Digest states plainly that all public entities, including counties, must comply with the Act when using AI systems.

What it would mean for a public institution. When a ministry buys AI from a vendor, the vendor is likely the provider and the ministry the deployer. Both would carry duties, so the ministry would need its own assessment and records, beyond the vendor's assurances.

4. Transparency and human oversight

What the Bill says. Under section 28, providers and deployers would have to disclose the nature and purpose of the system, how much automation is involved and what has been done to reduce bias. Where automated decisions affect individuals, people keep the right to human intervention.

A "human-centric AI" provision requires that a qualified person can intervene or override outputs in critical decisions affecting rights, safety or societal well-being. Regulations would define which decisions count as critical.

What it would mean for a public institution. Citizens would be told when AI is involved, and each AI-assisted decision affecting someone's rights would need an officer who can overturn it. This matches section 35 of the Data Protection Act on decisions based solely on automated processing.

5. Synthetic media and personal likeness

What the Bill says. Creating, deploying or distributing AI-generated content that uses a person's image, voice or likeness without explicit consent, where it causes or is likely to cause harm, misinformation, defamation or invasion of privacy, would be an offence. The Commissioner's ethical guidelines would also cover harmful synthetic media.

What it would mean for a public institution. Communications teams using AI images, voice-overs or video of real people would need written consent and clear labelling.

6. Workforce impact, sandboxes and AI literacy

What the Bill says. Under section 32, where AI affects employment, providers must assess possible job displacement and offer mitigation such as reskilling. Under section 29, the Commissioner could run regulatory sandboxes for supervised testing, with priority for solutions meeting national needs. The Commissioner would also run AI literacy programmes through schools, ICT hubs and counties.

What it would mean for a public institution. Planning for staff when AI changes how a department works, a supervised route to pilot new tools, and a formal push to build AI skills.

7. Offences and penalties

The Senate Bill Digest lists two penalty levels:

Where a body corporate offends, directors or officers who knew and did not exercise due diligence would also be guilty.

What it would mean for a public institution. One offence targets misuse of AI in the public sector directly, and accountability would reach individuals.

8. Regulations and review

Most detail would come later through regulations made by the Cabinet Secretary with the Commissioner. The Act would be reviewed every three years.

What public bodies can do now, whatever happens to the Bill

Every item below is good practice under the Data Protection Act and the ODPC's draft AI guidance today. Each would also put you ahead if an AI law does pass. Our pillar guide on AI in the public sector in Kenya gives the wider picture.

The checklist

1. Inventory every AI use. List each AI tool in use, official or informal, who uses it, for what, and whether personal data goes in.
2. Rate each use by risk. Ask one question first: does this AI shape a decision about a person? If yes, treat it as high-risk.
3. Write a short AI use policy. Say which tools are approved, what data must never go into them, who approves new tools and who signs off outputs. Keep it to a few pages so people read it.
4. Run impact assessments before deployment. The Data Protection Act already requires a Data Protection Impact Assessment (section 31) for high-risk processing. The ODPC draft guidance includes a trigger table for AI use cases. Add a simple rights and fairness check for high-risk uses.
5. Put clauses in procurement contracts. The ODPC draft guidance says buyers should write privacy-by-design requirements into procurement and reject systems that cannot show compliance. Ask vendors for documentation, data location, security, bias testing and deletion at contract end.
6. Require human sign-off. Name the officer accountable for each AI-assisted decision. Give them the authority and information to overrule the system, and record when they do.
7. Tell people when AI is involved. Update privacy notices and service charters. Give citizens a clear way to ask for a human review.
8. Keep records. Store assessments, approvals, system documentation and incidents in one place.
9. Get consent for likeness and label synthetic content. Communications teams should never generate a real person's face or voice without written consent.
10. Train staff. Practical training on safe use, data handling and checking outputs reduces risk fastest. See our AI training for government teams in Kenya.
11. Assign an owner. One senior officer, working with the Data Protection Officer and the head of ICT, should own AI governance and report to management.

Why the committee reportedly said no, and other critiques

The Senate ICT Committee. Chaired by Trans Nzoia Senator Allan Chesang, the committee reportedly said the Bill may regulate AI "too broadly, too early and too punitively" for Kenya's stage of development, according to The Star. It warned that heavy penalties could push small local developers abroad, that the new office could overlap with the Office of the Data Protection Commissioner and the Communications Authority of Kenya, and that it would add public cost. It also said the Bill does not adequately cover cross-border AI or general-purpose models.

Industry. The Star reports that Microsoft Kenya suggested placing AI regulation within existing institutions rather than a standalone office, and that Google and Safaricom raised concerns about the Bill's definitions and obligations.

Free expression. Writing in Tech Policy Press, Liz Orembo of Research ICT Africa argued that the Bill does not scale penalties to risk, so a minor labelling failure and a prohibited system can face criminal sanctions. She also noted the lack of a clear exemption for satire and civic commentary, and argued that a privately sponsored Bill risked getting ahead of the policy it should rest on.

Legal and cybersecurity review. A detailed review by lawyer Mutheu Nyagah Khimulu, published on KICTANet, credits the Bill's four-tier risk model, its rights to explanation and human review, its deepfake provisions and its reach into county government AI. It criticises the number of new bodies in an already crowded regulatory space, and the Bill's silence on attacks on AI systems such as model poisoning and prompt injection.

The case for acting. Supporters, including that same review, argue that Kenyans currently have limited legal recourse against algorithmic harms, and that some framework is needed. Techweez read the committee outcome as a delay to AI regulation in Kenya, with the need for a framework still standing.

Questions still open for public bodies:

• How would the AI Commissioner and the Data Protection Commissioner divide their roles?
• Which public administration uses would count as high-risk once regulations are written?
• Who carries liability when a ministry uses a foreign vendor's system?
• How would counties fund compliance?

How public participation works, and whether it is still open

Article 118 of the Constitution requires Parliament to facilitate public involvement. After First Reading, the committee handling a Bill usually invites written memoranda through newspaper notices and the Parliament website, and may hold hearings.

For this Bill, the Senate Bill Digest invited comments to the Clerk of the Senate (1st Floor, Main Parliament Buildings, P.O. Box 41842-00100, Nairobi) or by email to ictcommittee.senate@parliament.go.ke. The committee has now considered 143 submissions and reported, so that formal window has effectively closed.

You can still:

• follow the Senate Order Paper and Hansard on parliament.go.ke to see when Second Reading is scheduled;
• write to your senator before the debate; and
• watch for a fresh call for views. If the Senate passed the Bill, the National Assembly would consider it and would normally invite public input of its own. A new government Bill based on the national AI policy would also go through public participation.

The consultations on the draft AI policy (closed 4 August 2026) and the ODPC draft AI guidance (reported closed 17 August 2026) are also over.

Frequently asked questions

Is Kenya's AI Bill 2026 law? No. It is a proposed law in the Senate. It has not passed either House and has not received presidential assent.

Who sponsored the Artificial Intelligence Bill, 2026? Nominated Senator Karen Nyamu. It is Senate Bills No. 4 of 2026, published on 19 February 2026.

Did the Senate reject the AI Bill? Not yet. The Senate ICT Committee reportedly recommended in October 2026 that the Senate not proceed with it. The full Senate still has to vote. As of 29 October 2026, we found no record of that vote.

Would the Bill apply to counties and state corporations? Yes, as drafted. The Digest says all public entities, including counties, must comply when using AI, and the Commissioner would keep a register of high-risk systems used by county governments.

What penalties does the Bill propose? Up to KES 5 million, two years in prison, or both for the more serious offences, and up to KES 1 million, six months, or both for others. These are proposals only.

What rules apply to government use of AI today? The Constitution and the Data Protection Act 2019, including its rules on impact assessments and automated decisions. The ODPC's July 2026 draft Guidance Note on AI shows how the regulator reads those rules for AI.

Where FuKazee fits in

Whatever form Kenya's AI law takes, institutions whose officers already understand the tools, the data rules and when a human must check the output will cope best.

FuKazee trains public and private teams in practical, responsible AI. We assume nobody in the room knows AI yet, we avoid jargon, and we show the free version of every tool so teams can practise without a budget. Since 2022 we have trained more than 3,000 people across Kenya. For ministries, counties and state corporations, our sessions cover safe daily use, data protection, human sign-off and how to write a simple AI use policy. Read more about our AI training for government teams.

To discuss training for your team, email us at lead@fukazee.com

This article is general information, not legal advice. The Bill may change, or fall away, before any AI law is enacted.

Sources

• Parliament of Kenya, The Senate, Bill Digest: The Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2026)
• Kenya Law, The Artificial Intelligence Bill, 2026 (Senate, 19 February 2026)
• The Star, Senate committee shoots down Nyamu's Bill on AI, warns of Sh5 million fines (15 October 2026)
• Techweez, Senate Committee Rejects AI Bill, Sending It Back to the Drawing Board (16 October 2026)
• EY, Kenya publishes Artificial Intelligence Bill, 2026, proposing a formal framework for AI governance (17 June 2026)
• Mzalendo, The Artificial Intelligence Bill: Bill Tracker
• Office of the Data Protection Commissioner, Guidance Note on Artificial Intelligence (July 2026)
• Digital Policy Alert, ODPC opened consultation on draft Guidance Note on Artificial Intelligence
• Ministry of ICT, Draft Kenya AI and Other Emerging Technologies Policy, 2026
• Ministry of ICT, Public Participation: Draft Kenya AI and Other Emerging Technologies Policy
• The Star, State tightens rules on AI use of Kenyans' data (24 July 2026)
• Ministry of ICT, ICT Ministry set to launch National Artificial Intelligence Strategy 2025–2030
• Bowmans, Kenya: Unveiling of the National AI Strategy 2025–2030
• Tech Policy Press, Liz Orembo, What Kenya's AI Bill Gets Wrong About Political Expression (22 May 2026)
• KICTANet, Mutheu Nyagah Khimulu, Legal and Policy Review of the Kenya Artificial Intelligence Bill (March 2026)
• HapaKenya, A summary of the Artificial Intelligence Bill 2026 (16 March 2026)