AI in Kenya: Navigating the Future of Technology and Regulation

Have you ever wondered why that advertisement for the restaurant you just visited, or the toothpaste you searched for, keeps popping up on your social media feed? This isn't a coincidence; it's a classic example of Artificial Intelligence (AI) at play.

IBM defines AI as a field that combines computer science and robust datasets to enable problem-solving. This is achieved through a combination of machine learning and deep learning, leading to the creation of algorithms that generate expert systems capable of making predictions based on input data.

Marketing firms are increasingly adopting AI technologies, using customer and brand experience data to gain precise insights into customer preferences and market trends. One popular tool is social media listening, where an AI algorithm processes and analyzes online conversations about a brand or industry to understand audience sentiment. This helps brands anticipate customer behavior and take strategic actions to achieve specific results.

The Double-Edged Sword: Benefits and Concerns of AI

Despite the numerous benefits of AI, public concern has grown regarding the potential abuse of personal data, such as identity theft and fraud, through digital technologies. This distress stems from how companies can track online movements, collect credit card numbers, addresses, and other critical information, evident in the targeted web ads that appear after a simple internet search.

Global Efforts in AI Regulation

Various jurisdictions worldwide have introduced regulations and acts to grant internet users a level of control over their personal data and images. A notable example is the European Union's 2018 General Data Protection Regulation (GDPR). More recently, on May 16, 2023, the US Senate held a hearing on AI regulation, with a specific focus on ChatGPT, an artificial intelligence chatbot.

AI Regulation in Kenya: A Developing Framework

Kenya currently lacks dedicated legislation specifically governing artificial intelligence. Instead, AI practices fall under existing statutes like the Data Protection Act (2019), the Computer Misuse and Cybercrimes Act (2018), and the Copyright Act (2001), all of which require interpretation for AI-specific applications.

The Data Protection Act 2019

The Data Protection Act 2019 came into effect following concerns about the safety of citizens' personal data during the Huduma Namba registration exercise. This Act gives effect to Article 31 (c) and (d) of the Constitution, which provide for the right to privacy. Key features of the Act include:

• Establishing the Office of Data Commissioner.
• Regulating the processing of personal data.
• Providing the rights of data subjects.
• Creating obligations for data controllers and processors.

Organizations are now required to appoint an independent, adequately qualified data protection officer to ensure accountability and compliance, particularly in data masking, pseudonymization, and encryption. They must also maintain audit trails and data journeys to demonstrate compliance. Additionally, organizations are mandated to obtain freely given, specific, informed, and unambiguous consent, necessitating the construction and review of their public-facing privacy policies.

Individuals' rights are also protected, with the right to opt out of and object to online profiling and tracking. This will significantly impact direct-to-consumer businesses that rely on AI data to understand their customers better.

We anticipate that the data protection field will continue to grow as more regulations are passed and court pronouncements on personal data control are made.

Upcoming and Proposed AI Regulations in Kenya

In addition to existing laws, Kenya is actively working on new frameworks:

a) The Draft National AI Strategy (2025–2030)

Published in early 2025 by the Ministry of ICT, this strategy proposes definitions, ethical guidelines, and a future AI Code for Responsible Use. Its key pillars include:

• Data governance: Emphasis on data sovereignty, sharing protocols, privacy, and cybersecurity.
• Risk-based regulation: Plans to categorize AI systems by risk, aligning with international best practices like the EU AI Act.
• Transparency, accountability, and ethics: Developers are expected to implement comprehensive impact assessments, transparency in decision-making, and risk mitigation frameworks.
• Multistakeholder collaboration: Legislative reform efforts driven by Parliament, experts, and international alignment.

The National AI Strategy (2025–2030) is built around three key pillars:

1. AI Digital Infrastructure: Expanding fiber networks, AI-ready data centers, and green energy support.
2. Data Ecosystem: Policies on ethical data usage, privacy, sovereignty, and digitization of public records.
3. AI Research & Innovation: Establishing research hubs, supporting African-centric Natural Language Processing (NLP) models, and computer vision applications in critical sectors.

b) Proposed Robotics & AI Society Bill (2023)

This bill aims to establish a statutory "Kenya Robotics and Artificial Intelligence Society"—a licensing and oversight entity for practitioners, with enforcement powers, standards enforcement, compliance notices, and penalties (up to KES 1 million or two years’ imprisonment). Its roles and functions include developing ethical codes, technical standards, training programs, auditing, and public education.

However, the bill has faced criticism, with some warning that it might be overly restrictive, potentially stifling innovation due to stringent licensing and compliance requirements. Kenya's civil society is urging that AI regulation incorporate risk categorization based on human rights, similar to global frameworks that allow appeals or human review in sectors like healthcare, judiciary, or employment. Additionally, existing biometric and facial recognition deployments lack comprehensive legal safeguards, and regulators and courts have flagged the absence of mandatory data protection impact assessments.

c) Draft Kenya Bureau of Standards (KEBS) AI Code of Practice

Released in April 2024, this code provides voluntary guidelines for transparency, accountability, and citizens' rights in AI. It remains in a draft stage, with no active updates since public comments in mid-2024.

d) Regulatory Sandboxes & Existing ICT Laws

The Communications Authority's sandbox framework allows for safe AI testing in partnership with innovators. Existing statutes like the Data Protection Act 2019, Computer Misuse & Cybercrimes Act, Consumer Protection Act, and ICT regulations apply to AI through provisions on data rights, consent, cybersecurity, and consumer protection.

Regional & International Alignment

Kenya's national plans align closely with the African Union’s Emerging AI Strategy, which emphasizes equitable innovation, data sovereignty, and capacity-building. Although Kenya has not yet signed global AI instruments like the CoE’s Framework Convention on AI and Human Rights (September 2024), its 2025–2030 Strategy suggests an intent to harmonize with international norms.

Global Landmark Cases and Their Impact on Kenya

Recent global court cases highlight the complexities of AI and its legal implications:

Global Landmark Cases

• Misuse of AI in Legal Submissions (May 2025): A Supreme Court judge cautioned lawyers and judges against using tools like ChatGPT when drafting submissions after discovering fabricated legal citations in filings. This underscores the judiciary’s concern about AI misuse and signals a need for guidelines or regulation governing AI in legal processes.
• Getty Images v. Stability AI (UK & US): In January 2023, Getty Images filed suit in London and Delaware, alleging Stability AI used over 12 million copyrighted images to train its AI model without permission, evidenced by distorted Getty watermarks in generated images. The London High Court began hearings in June 2025, and the outcome could set a major global precedent on image scraping and copyright in AI.
• Andersen v. Stability AI (USA): A Northern District of California case questions whether AI-generated images violate artists’ copyrights. The court is evaluating if AI output is a “piece-together” reproduction infringing on original works.

• UK Supreme Court: DABUS Patent Case (Thaler v. Comptroller-General): In December 2023, the UK Supreme Court ruled that AI cannot be named as a patent "inventor"—only natural persons are eligible. Courts in the US, EU, Australia, and New Zealand have affirmed this principle. South Africa is the only exception, granting a patent involving DABUS but naming the human operator as the inventor. The main issue is whether an AI (DABUS) can be named as an “inventor” in a patent filing.

  The UK Supreme Court unanimously ruled that: * Only natural persons (humans) can be inventors under UK patent law. * DABUS, an AI system designed to generate inventions, cannot be recognized as an inventor. * The human applicant (Stephen Thaler) was not deemed the inventor either, since he admitted DABUS created the invention.

  Similar rulings have come from: * USA: USPTO & Federal Courts rejected DABUS patents. * EU: EPO dismissed the application. * Australia: Initially allowed, then overturned on appeal. * South Africa: The only country to accept it—by naming the human as the de facto inventor.

Impact on Kenya

Kenya's pending AI policy includes data governance and transparency, partly inspired by global IP disputes. It emphasizes the need for:

• Ethical training data sourcing.
• Consent-based data acquisition.
• Licensing requirements for commercial models.

Kenya’s draft strategy upholds the "human-in-the-loop" principle:

• Inventorship and authorship require human accountability.
• Any AI-assisted innovation must still credit the human developer or user.

Kenya’s intellectual property office (KIPI) is evaluating updates to explicitly exclude AI from being listed as the primary inventor, aligning with global consensus.

Emerging Themes in AI Regulation

• Copyright & IP: Legal battles over AI training data (Getty, Midjourney, Kneschke) may define the boundary between permissible Text and Data Mining (TDM) and infringement.
• Inventorship: Courts globally continue to affirm that patents require human inventors. AI cannot hold such rights.
• Legal malpractice & ethics: Kenya’s Professional Regulatory Commission (PRC) ruling warns against AI in legal submissions, highlighting the need for reliability and trustworthiness.
• Global variability: Cases in the EU, UK, USA, China, South Africa, and India (for personality rights in AI-generated images) show divergent approaches, influencing future frameworks.

Key Challenges Ahead

1. Absence of AI-specific legislation: The current framework is fragmented across existing laws.
2. Balancing innovation with ethical safeguards: Especially concerning bias, accountability, and data privacy.
3. Limited capacity in technical oversight: Within regulatory bodies.
4. Low public digital literacy: Undermining informed adoption.
5. Need for robust enforcement mechanisms: And monitoring of AI use.
6. Ensuring cross-border coherence: Harmonizing policies with international norms.

Way Forward for Kenya

Kenya needs to take the following steps:

• Finalize the AI Society Bill and Strategy: These are currently under review in Parliament, with adoption expected in 2025–2026.
• Review existing laws: Including the Data Protection Act, IP regime, and Cybercrimes Act, to ensure AI compliance.
• Formalize implementing regulations: Once primary laws pass, covering licensing, risk categorizations, and guidelines for impact assessments.
• Gradual ecosystem development: Stakeholders will adapt via compliance programs, licensing schemes, ethics oversight, and public-private partnerships.

Compiled and edited by Robinson Nthuli Munyalo FCIArb

Advocate