On this page
TL;DR:
- Before you approve a company-wide AI rollout, ask ten questions. They cover the problem, the people, the data, the tool contract, decisions about people, jobs, training, measurement, incidents and exit.
- Your staff are probably using AI already. The choice in front of you is whether that use has rules and support.
- Kenya's Data Protection Act applies today. The AI Bill 2026 is not law, and the data commissioner's AI guidance is still a draft.
- Approve a pilot first if any answer on data, jobs or training is vague. Name a review date in the approval itself.
- A plan that cannot answer these questions in one page is not ready for your signature.
Who this guide is for
This guide is for chief executives, managing directors and executive directors in Kenya who have an AI plan on their desk. It fits companies, NGOs, SACCOs, schools and family businesses. You do not need any technical background.
Boards have a different job. If you want the directors' side of this, read our guide to AI governance for Kenyan boards. This guide is about the person who has to say yes, and then live with the result.
Why does this decision belong to the CEO?
An AI rollout touches money, customer data, staff morale and your reputation at the same time. No single department owns all four. IT sees the systems. HR sees the people. Finance sees the bill. Only you see the whole picture.
Three facts make this urgent.
Your staff may be ahead of you. In Microsoft and LinkedIn's 2024 global survey of about 31,000 knowledge workers, 75% said they used AI at work. Of those users, 78% brought their own tools. Only 39% of people using AI at work had received AI training from their company. That survey is global and two years old, so treat it as a warning. Your own number may be higher or lower. Question three below shows how to find it.
Kenyan institutions are moving before their rules are ready. The Central Bank of Kenya surveyed banks, microfinance banks, digital credit providers and credit reference bureaus on AI, with data as of 31 December 2024. Half said they had adopted it. Yet 70% had no AI strategy, and only 41% of adopters had put an AI policy in place. Shortage of skills tied for the biggest challenge, at 46%.
The results depend on the task. Harvard and Boston Consulting Group ran an experiment with 758 consultants. On tasks AI handled well, consultants using it finished 12.2% more tasks, worked 25.1% faster and produced quality more than 40% higher. On one task chosen to be beyond AI's ability, they were 19 percentage points less likely to get the right answer than colleagues without AI. A blanket rollout treats both kinds of task the same.
The ten questions at a glance
Print this table and take it into the meeting.
| # | Ask this | A good answer sounds like | Warning sign |
|---|---|---|---|
| 1 | What problem are we paying to solve? | "Monthly branch reports take six days. We want three." | "Everyone is adopting AI." |
| 2 | Who from the front line helped design this? | Names of staff who do the work | "IT and the vendor designed it." |
| 3 | What are staff already doing with AI? | Results of an anonymous survey | "Our people don't use it." |
| 4 | What data will this touch, and who signed off? | A list of data types and a named person | "The vendor says it's secure." |
| 5 | Whose files can the tool see, and what does the contract say? | Permissions checked, written terms read | "We'll sort out access later." |
| 6 | What decisions about people will AI influence? | "None without a human deciding." | "It only shortlists." |
| 7 | What happens to staff whose work changes most? | A role-by-role view and an agreed message | "Nobody will be affected." |
| 8 | Is training funded, and who goes first? | Managers first, budget approved | "The tool is easy to use." |
| 9 | How will we know it worked, and when do we check? | Baseline taken, date in the diary | "We'll see how it goes." |
| 10 | What do we do when it goes wrong, and how do we leave? | Named incident owner, exit terms | Silence |
1. What problem are we paying to solve?
Ask the sponsor to name one task, one owner and one number. If they cannot, the plan is still an idea.
Good targets are specific: slow turnaround on monthly reports, repeated customer questions, long onboarding documents, tender checklists. Each has a before and an after that someone can measure.
The evidence supports starting narrow. A study of 5,179 customer support agents found that an AI assistant raised issues resolved per hour by 14% on average. Novice and low-skilled agents gained 34%. Highly experienced agents gained very little. So the same tool can help your new hires a lot and your best people hardly at all. Ask the sponsor who is expected to gain, and why.
2. Who from the front line helped design this?
Ask for names. A plan built only by leadership and the vendor will miss what actually slows the work down.
The people who process the invoices know which step takes the time. The branch officer knows the customer writes in Sheng. The driver knows the delivery note arrives as a photo on WhatsApp. If none of them were consulted, send the plan back for one more week. A short workshop with six front-line staff is cheap, and it tends to change the plan.
3. What are staff already doing with AI?
Find out before you write any rules. Run a short anonymous survey and promise that nobody will be punished for an honest answer.
Ask four things: which tools they use, for which tasks, whether they use a personal or work account, and whether they have pasted company or customer information into a tool. The last answer tells you where your real exposure sits today. Our free AI readiness assessment can help you think through the wider picture.
If the survey shows heavy private use, a ban is unlikely to work. Staff will move to their phones, and you will lose sight of it. A clear AI usage policy with approved tools is the safer path.
4. What data will this touch, and who signed off?
Ask for a list of data types and the name of the person who approved each one. Do not delegate this question entirely to IT, because the legal duty sits with the organisation.
As of November 2026, here is where Kenyan law stands.
| Rule | Status | What it means for you |
|---|---|---|
| Data Protection Act, 2019 | In force | Applies to personal data in any AI tool |
| AI Bill, 2026 (Senate Bill) | Not law. In October 2026 the Senate ICT committee recommended that the Senate not proceed | Watch it; do not plan around it |
| ODPC draft Guidance Note on AI (July 2026) | Draft. Consultation closed 17 August 2026 | Read it as a sign of what the regulator expects |
Five parts of the Data Protection Act matter most for a rollout:
- Section 31: if processing is likely to result in high risk to people's rights, you must carry out a data protection impact assessment before you start.
- Section 35: people have a right not to be subject to a decision based solely on automated processing that significantly affects them. There are limited exceptions.
- Sections 48 and 49: these set conditions for moving personal data out of Kenya. Sensitive personal data, such as health data, needs the person's consent and confirmation of appropriate safeguards. Most popular AI tools run on servers abroad, so ask where your data goes.
- Section 43: you must notify the Data Commissioner of a reportable breach within 72 hours, or give reasons for the delay. A processor must tell you within 48 hours where reasonably practicable.
- Sections 63 and 65: the commissioner can fine up to KES 5 million or, for an undertaking, up to 1% of the previous year's turnover, whichever is lower. People who suffer damage, including distress, can claim compensation.
The ODPC's draft goes further. Business Daily reports that it would require a written data processing agreement with offshore AI vendors, and that the local organisation stays accountable. PPC Land reports that its annex lists eight uses needing an impact assessment, including recruitment screening and employee productivity monitoring. This is a draft and may change.
A simple sorting rule helps everyone. This table is our suggestion, so adapt it with your lawyer.
| Colour | Examples | Rule |
|---|---|---|
| Green | Public information, marketing drafts, general questions | Approved tools, normal care |
| Amber | Internal reports, draft policies, anonymised figures | Work accounts on approved tools only |
| Red | Customer records, payroll, health data, bids, legal matters, passwords | Stays out unless the tool has passed a specific review |
5. Whose files can the tool see, and what does the contract say?
Ask IT to show you who can open what today. Tools that connect to company files inherit your existing permissions, including your mistakes.
Microsoft says Copilot respects your identity model and permissions. It also strongly recommends setting up governance to "remediate oversharing". In plain terms: if a payroll folder is open to everyone in the company, a search assistant can bring it up in seconds. Staff may have had access for years without knowing. Fix this first. The same question applies to any tool you connect to your files.
Then look at the account type, because the terms differ a lot as of November 2026.
| Tool and account | What the provider says |
|---|---|
| Microsoft Copilot Chat, signed in with a work account | Enterprise data protection applies; prompts and responses are not used to train foundation models. Needs an eligible Microsoft 365 subscription |
| Microsoft Copilot, paid licence | Adds full reasoning across work emails, meetings, chats and files |
| Google Gemini, Workspace editions with enterprise-grade protections | Chats are not reviewed by people or used to improve generative AI models |
| Google Gemini, editions without those protections | Chats may be reviewed by human reviewers and used to improve Google's products |
| Claude, Free, Pro and Max | Users choose whether their data helps improve Claude |
| Claude for Work, API | Under commercial terms, separate from the consumer choice above |
We do not recommend one tool over another. Start with what you already pay for. If your organisation has an eligible Microsoft 365 subscription, Copilot Chat lets staff begin without buying new licences. Check any provider's current terms yourself before you sign, because they change often.
Also ask how you would leave. What happens to your prompts, files and custom assistants if you change provider next year?
6. What decisions about people will AI influence?
The safe answer is that AI may help prepare information, and a named person makes the decision. Hiring, promotion, discipline, credit and benefits all fall in this group.
Watch the phrase "it only shortlists". A shortlist decides who a human ever sees. Section 35 is about decisions based solely on automated processing, and a tick-box human who never disagrees is weak protection in practice.
Ask whether anyone can explain how the tool reached its output. In the CBK survey, only 56% of institutions that had adopted AI had measures in place to ensure their models were explainable. If your team cannot explain a decision to the customer or employee it affects, keep AI out of that decision.
7. What happens to staff whose work changes most?
Answer this before staff ask you, because they are already asking each other. Go through the plan role by role and sort each one: little change, big change, or role at risk.
Then decide what you will say, and say it yourself. "Nobody will be affected" is rarely true, and people know it. A better message says which tasks will change, what support people will get, and what you do not yet know.
If a role truly disappears, you are in redundancy territory. Section 40 of the Employment Act governs this and provides for severance of at least 15 days' pay for each completed year of service. Take legal advice before any announcement. Using AI as a quiet way to shrink a team, without following that process, puts you at legal risk and damages trust.
Middle managers need separate attention. They carry the anxiety of their teams and their own. See our guide on getting middle managers to use AI.
8. Is training funded, and who goes first?
Check that training has its own budget line. Software access alone rarely changes how people work.
Start with managers, then the pilot team. A manager who has never tried the tool cannot coach anyone or judge the output. Training should use the staff's real tasks, cover the free version of each feature, and include how to check an answer. Our article on why corporate AI training doesn't stick covers the follow-up that makes the difference.
Be honest about depth. Nobody becomes an expert in a few days. A good first programme makes people safe, useful and curious enough to keep going.
9. How will we know it worked, and when do we check?
Require a baseline before anyone starts, and put a review date in the approval. Without a date, a rollout simply carries on until something breaks.
Three measures are enough to begin:
- Time: how long the chosen task takes now, including checking the AI's work.
- Use: how many people are still using it after 30, 60 and 90 days.
- Quality and incidents: errors caught, complaints, and any data mistakes.
Measure at team level where you can. Tracking individuals can feel like surveillance, and the ODPC's draft is reported to list employee productivity monitoring as needing an impact assessment.
Ask what result would make you stop. Decide this now, while nobody has anything to defend.
10. What do we do when it goes wrong, and how do we leave?
Name one person who owns AI incidents, and tell every member of staff how to report one without fear. Something will go wrong eventually: a wrong figure in a client letter, or a customer list pasted into a personal account.
Your incident plan should cover who is told first, how you check whether personal data was involved, and who decides on notifying the Data Commissioner within the 72-hour window in section 43. Run through one made-up incident with your team before launch. It takes half an hour and shows you the gaps.
Approve, pilot or wait: a decision table
Score each of the ten questions: 2 for a clear answer with a name attached, 1 for a partial answer, 0 for none. These bands are our own rule of thumb, so adjust them to your risk appetite.
| Score | Decision |
|---|---|
| 16 to 20, and no zero on questions 4, 6 or 7 | Approve a phased rollout with a review date |
| 10 to 15 | Approve one pilot only, on one low-risk task |
| Under 10 | Wait. Fund the groundwork first: survey, data list, policy, manager training |
| Any zero on questions 4, 6 or 7 | Do not go wider than a green-data pilot until it is fixed |
Worked example: a one-page approval note
Ask for the decision in one page. This sample is entirely made up. It describes an invented 150-person distribution company, and every figure is for illustration.
Decision requested: approve a 90-day pilot of AI drafting for the customer service team (12 people). Problem: replies to routine delivery queries take 11 minutes on average, measured over two weeks. Target: 7 minutes, including checking, with complaints no higher than now. Tool: the Copilot Chat already available through our Microsoft 365 subscription. Work accounts only. Data: green and amber only. Customer names and phone numbers are removed before drafting. Approved by the data protection lead on [date]. People: no role is at risk in this pilot. Team leader briefs staff on [date]. Training: two half-days, managers first. Budget approved. Review: [date]. We stop if complaints rise or if fewer than half the team are still using it at day 60. Incident owner: head of operations.
Three prompts a CEO can copy
These follow the four Cs we teach: Clarity, Context, Constraints and Customisation. Remove names, figures and anything confidential before you paste.
Prompt 1: stress-test the plan
I am the CEO of a [type of organisation] in Kenya with about [number] staff. Below is a summary of a proposed AI rollout. Act as a sceptical finance director and a sceptical head of HR, in turn. For each, list the five weakest points in this plan and the one question you would ask me about each point. Do not praise the plan. If information is missing, say what is missing and do not assume it. Keep it under 500 words, in plain English. Plan: [paste summary with confidential details removed]
Prompt 2: draft the staff message
Draft a short message from me, the CEO, to all staff about a 90-day AI pilot in [team]. Context: some staff fear for their jobs. Facts I can confirm: [list]. Things we do not yet know: [list]. Constraints: under 200 words, warm and direct, no jargon, no promise I have not listed, and say plainly what we do not yet know. Customisation: it will be read on phones, so use short paragraphs, and end with who to ask.
Read and rewrite it in your own voice before you send it. People can tell.
Prompt 3: build the anonymous survey
Write an anonymous staff survey of no more than eight questions about current AI use at work. Context: we want an honest picture, and we have told staff nobody will be punished. Constraints: multiple-choice where possible, no question that could identify a person, include one question on whether company or customer information has been pasted into a tool. Customisation: readers range from drivers to accountants, so use simple English and offer a Kiswahili version.
Have a fluent speaker check the Kiswahili.
What goes wrong, and how to avoid it
| What goes wrong | Why it happens | How to avoid it |
|---|---|---|
| Licences bought, little use | No task chosen, no training | Pick one task, train first, then buy |
| Private tools carry on alongside | Approved tool is harder to use, or nobody explained it | Survey first, then make the approved route the easy one |
| Confidential file surfaces in a search | Old folder permissions | Audit access before connecting any tool |
| Staff resist quietly | They learned about it from rumour | CEO speaks first, role by role |
| Pilot never ends | No review date, no stop rule | Write both into the approval |
| A wrong figure reaches a client | Nobody was responsible for checking | A named person signs off every output that leaves the building |
More on the structural side is in our article on why AI rollouts fail.
When AI and training will not help
Some problems look like AI problems and are something else. If your data is scattered across paper files, sort that first. If a process has seven approvals, an AI draft saves little. If a team is short of people or managed badly, AI will not repair it. A CEO who hears this early saves money.
Questions people ask
Is there a law in Kenya that stops a company rolling out AI?
No law bans it. As of November 2026, Kenya has no AI-specific Act. The Data Protection Act applies to personal data used in any AI tool, and sector regulators may have their own rules.
Should the CEO be personally trained on AI?
Yes, even briefly. You cannot judge a plan or spot a weak answer without having used the tools on your own work. Even a couple of hours of guided practice will sharpen your questions.
Should we ban ChatGPT and other public tools?
A blanket ban tends to push use onto personal phones, where you cannot see it. We think most organisations do better with a short list of approved tools, clear data rules and an easy way to ask for help.
How big should the first pilot be?
Small enough to supervise and large enough to learn from. One team of about 10 to 20 people on one low-risk task, for 60 to 90 days, is a sensible start. This is our guidance, based on what can be supervised closely.
Who should own AI in the organisation?
One senior person should own it, with HR, IT, legal and a front-line manager in the working group. It often goes wrong when IT alone owns it, because most of the hard questions are about people and process.
Do we need a data protection impact assessment before using AI?
Section 31 requires one where processing is likely to result in high risk to people's rights. Drafting marketing copy probably does not reach that level. Screening job applicants may well do so. Ask your data protection adviser about each use.
Sources
All links last checked 9 November 2026.
- Data Protection Act, 2019 (official text on the ODPC website), sections 31, 35, 43, 48, 49, 63 and 65
- The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026)
- Digital Policy Alert, status of the ODPC draft Guidance Note on Artificial Intelligence
- Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026)
- PPC Land, report on the impact assessment annex in the ODPC draft
- Central Bank of Kenya, Survey on Artificial Intelligence in the Banking Sector
- Microsoft and LinkedIn, 2024 Work Trend Index: AI at Work Is Here. Now Comes the Hard Part
- Dell'Acqua and others, Navigating the Jagged Technological Frontier (working paper, September 2023)
- Brynjolfsson, Li and Raymond, Generative AI at Work (NBER Working Paper 31161)
- WageIndicator Kenya, notice and severance under the Employment Act
- Sheriaplex, section 40 of the Employment Act
- Microsoft Learn, Microsoft Copilot requirements
- Microsoft Learn, Enterprise data protection in Microsoft Copilot and Copilot Chat
- Microsoft Support, Copilot Chat with and without a Microsoft Copilot licence
- Google, Use Gemini Apps with a work or school Google Account
- Anthropic, Updates to consumer terms and privacy policy
Where FuKazee fits in
FuKazee is a Nairobi company that trains teams to use AI in their daily work. Since 2022 we have trained more than 3,000 people. We assume nobody in the room knows AI yet, we avoid jargon, and we show the free version of every feature. We do not sell software, so we can help you compare tools without a stake in the answer.
We can work with you and your leadership team on the people side of a rollout: a guided session for executives, hands-on training built around real tasks, and support with an AI usage policy. See how this works on our AI training in Kenya page.
If you have a rollout plan on your desk, send us the problem you are trying to solve, the number of people involved and your timeline. Email lead@fukazee.com.
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
