The Artificial Intelligence Bill 2026, sponsored by Senator Karen Nyamu, represents Kenya’s first comprehensive legislative attempt to regulate the lifecycle of AI systems. It seeks to balance the promotion of technological innovation with the mitigation of risks like algorithmic bias, deepfakes, and privacy violations.
Below is a summary of the bill’s key components:
1. New regulatory institutions
The bill establishes a three-tier governance structure to oversee the AI sector:
- Office of the Artificial Intelligence Commissioner: The primary enforcement body responsible for registering AI systems, conducting audits, and investigating compliance breaches.
- Artificial Intelligence Authority: Tasked with creating national AI strategies, promoting research, and setting technical and ethical standards.
- Artificial Intelligence Advisory Council: A consultative group of experts that advises the government on global AI trends and emerging risks.
2. Risk-based classification
The bill categorizes AI systems based on their potential for harm, imposing different levels of oversight:
- Prohibited AI: Systems that pose an “unacceptable risk,” such as those used for social scoring by governments or those that deploy subliminal techniques to manipulate human behavior.
- High-Risk AI: Systems used in critical areas (e.g., healthcare, law enforcement, education, and essential infrastructure). These require mandatory registration, annual impact assessments, and strict “human-in-the-loop” oversight.
- Limited/Minimal Risk: Systems like basic chatbots, which face lighter transparency requirements (e.g., disclosing to the user that they are interacting with an AI).
3. Measures against deepfakes and misinformation
A significant portion of the bill targets the misuse of synthetic media:
- Mandatory Disclosure: Any AI-generated content (text, audio, or video) that resembles existing persons, places, or events must be clearly labeled as such.
- Criminalization: The bill proposes criminal penalties for creating or distributing harmful deepfakes intended to deceive, defame, or incite violence.
4. Public rights and protections
The legislation grants Kenyan citizens several new digital rights:
- Right to Explanation: Individuals have the right to know how an AI system reached a decision that significantly affects them (e.g., a loan rejection).
- Right to Human Review: Affected persons can request that a qualified human representative review a decision made by an automated system.
- Privacy and Data Protection: The bill mandates that all AI training and deployment must strictly adhere to the Data Protection Act, 2019.
5. Innovation and regulatory sandboxes
To ensure regulation does not stifle growth, the bill introduces Regulatory Sandboxes. These allow startups and developers to test innovative AI products in a controlled environment under the supervision of the AI Authority, often with relaxed compliance requirements during the testing phase.
6. Offenses and penalties
The bill includes stringent enforcement mechanisms:
- Financial Fines: Non-compliance can result in fines of up to 5 million Kenyan Shillings or a percentage of an entity’s annual turnover.
- Imprisonment: Certain violations, particularly those involving harmful deepfakes or unauthorized data processing, carry prison terms of up to two years.
7. Ethical principles
The bill outlines foundational principles that all AI developers in Kenya must follow, including transparency, fairness, accountability, and environmental sustainability (minimizing the carbon footprint of large data centers).