Kenya is adding another layer to an already overburdened digital regulatory system. The proposed Artificial Intelligence Bill 2026 (the Bill), introduced by Nominated Senator Karen Nyamu, is part of a larger policy push following publication of Kenya's National AI Strategy (2025-2030), which positions the country as a regional hub for AI development.
Kenya, which has long positioned itself as East Africa's technological powerhouse, is now confronted with a familiar regulatory temptation: to regulate rapidly in the face of innovation.
The Bill proposes an AI Commissioner, an AI Authority, and an Advisory Council, as well as the criminalisation of deepfakes, the enforcement of regulatory sandboxes, and the categorisation of AI systems by risk levels, and imposing fines of up to Sh5 million or three years in jail. The legislature's goal is apparent. The institutional structure, timing, and evidence foundation for criminal responsibility are not.
Blimey! The Bill establishes three new regulatory bodies in a field that has yet to create a single locally trained large language model. Kenya already has the Data Protection Commissioner, whose authority includes automated decision-making, and the Communications Authority, which regulates digital content.
The proposed law does not explain why these institutions cannot absorb AI oversight through targeted amendments, but instead creates parallel structures, with the compliance cost of navigating three additional regulators falling disproportionately on early-stage Kenyan developers rather than multinational firms whose models underpin the majority of local AI deployment.
Additionally, the risk-classification structure mirrors the European Union's (EU) AI Act without taking into consideration structural variations between the two jurisdictions. The EU's tiered system functions within a single market, with harmonised enforcement and hundreds of billions of dollars in AI investment.
Kenyan developers mostly modify open-source structures for local applications in agriculture, financing, and health triage; they do not create foundation models.
Yet the Bill requires audit trails for the provenance of training data and impact evaluations from players who do not have access to such information because it belongs to upstream model suppliers.
Imposing criminal culpability for failure to comply with technically impossible duties is a drafting error. An examination of the AU Continental AI Strategy supports this: Phase 1 of continental implementation, lasting until 2026, focuses on governance structures and resource mobilisation, not punitive legislation.
Thus, this penalty regime exacerbates the situation. Fines of Sh5 million and three years' imprisonment, with criminal liability extending to directors, mean that a single enforcement action might derail a Series A fundraising round, yet Africa accounts for three percent of the global AI skill pool.
The AU Commissioner for Infrastructure indicated that more than 83 percent of continental AI startup financing in the first quarter was focused in four countries, including Kenya.
Therefore, criminal sanctions that erode the investment base are counterproductive. Moreover, the Bill does not define what constitutes high-risk in practice, leaving categorisation to the Commissioner's discretion and providing circumstances for selective enforcement.
That said, the Bill's animating concerns are valid. Deepfake harassment of female politicians is well documented, and Senator Nyamu has faced it. Furthermore, AI-generated misinformation ahead of the 2027 General Election poses an operational danger.
And the Constitution offers an adequate foundation for controlling synthetic media that breaches dignity, privacy, or public discourse. However, achieving these goals does not need the creation of three new organisations, a parallel compliance system, or the criminalisation of an entire class of technical activity.
To conclude, the Senate has an opportunity here to insist on regulation that respects the maturation conditions the government’s own strategy identified. The question is, will we regulate AI with the precision the moment demands, or will we regulate by reflex or will we copy-paste EU without asking what local conditions actually require and probably pay for it in lost innovation for the next decade?
The writers are privacy practitioners.
Follow ourWhatsApp channel for the latest business and markets updates.
Unlock a world of exclusive content today!Unlock a world of exclusive content today!
