Kenya’s plan to introduce a dedicated law governing artificial intelligence has encountered a major setback after a Senate committee recommended that lawmakers should not proceed with the Artificial Intelligence Bill, 2026.
The Senate Standing Committee on Information, Communication and Technology raised concerns about the Bill’s proposed penalties, the cost of regulatory compliance and plans to establish a dedicated Office of the AI Commissioner. The committee warned that the proposed framework could place a disproportionate burden on local technology developers and complicate the work of existing regulators.
The Bill, sponsored by nominated Senator Karen Nyamu, was intended to establish a comprehensive framework for developing, deploying and using artificial intelligence in Kenya. It proposed regulatory oversight, risk-based obligations, transparency requirements and safeguards for AI-related activities.
The committee’s recommendation does not mean the challenges associated with AI have disappeared. Questions about privacy, automated decisions, harmful deepfakes and accountability remain important as Kenyan businesses, public institutions and individuals increasingly use AI tools.
The debate now centres on a difficult policy question: how can Kenya protect the public from AI-related harm without imposing rules that unnecessarily restrict innovation?
What happened to Kenya’s Artificial Intelligence Bill?
The Artificial Intelligence Bill, 2026, was introduced as a proposed legal framework for AI development and use in Kenya. Its stated objectives included promoting ethical and accountable AI while protecting human rights, personal data and public welfare.
The Bill proposed establishing an Office of the Artificial Intelligence Commissioner to oversee aspects of AI governance. It also included provisions covering risk classification, high-risk systems, transparency, regulatory sandboxes and public-sector use of AI.
However, after considering stakeholder submissions, the Senate’s ICT Committee recommended that the Senate should not proceed with the Bill in its current form.
Reporting published in October 2026 indicates that the committee’s concerns included the proposed penalties, the creation of a powerful new regulator and potential duplication of responsibilities already assigned to existing public institutions.
This distinction matters: a committee recommendation is not automatically the same as a final decision by the full Senate. The Bill’s subsequent parliamentary status should be checked against official Senate records before any claim that it has been permanently defeated or withdrawn.
Why did the Senate committee oppose the Bill?
1. Concerns about fines and criminal penalties
One of the most contentious parts of the proposed legislation was its enforcement framework.
The Bill included penalties that could reach KSh5 million for certain offences, alongside other sanctions. Some offences also carried potential criminal liability, including imprisonment for up to two years.
The committee expressed concern that heavy fines and criminal exposure could disproportionately affect smaller developers and innovators whose projects may be experimental or operate with limited financial resources.
For a Kenyan startup building a chatbot, an agricultural advisory tool or a customer-service application, the cost of compliance can influence how quickly it develops and launches a product.
That does not mean technology businesses should be exempt from accountability. AI systems can create real risks when they misuse personal information, produce harmful decisions or are deployed irresponsibly. The policy challenge is to ensure that penalties are proportionate to the nature and seriousness of the violation.
A revised framework could therefore need to distinguish between deliberate harmful conduct, serious negligence, repeated violations and mistakes that can be corrected without imposing the same level of punishment.
2. The proposed AI Commissioner and regulatory overlap
The Bill proposed an Office of the Artificial Intelligence Commissioner with responsibilities that included oversight, investigations, audits and enforcement.
The committee questioned whether establishing a new institution with broad powers could duplicate the responsibilities of existing regulators.
For example, the Office of the Data Protection Commissioner already has a role in enforcing Kenya’s data protection framework. The Communications Authority of Kenya also has responsibilities in areas related to communications and digital services.
AI applications can overlap with several regulatory fields. A facial-recognition product, for instance, may raise privacy concerns, while an AI service offered through a communications platform may raise other questions about how the service is operated.
Creating a new regulator could provide specialised expertise, but it could also create uncertainty if responsibilities are not clearly separated.
The central question is whether Kenya needs a new standalone institution, stronger coordination among existing agencies, or a combination of both.
3. Compliance costs for Kenyan startups
Kenya’s technology sector includes established companies, venture-backed startups, small software businesses, university research teams and individual developers.
These groups do not have equal access to lawyers, compliance specialists or large technology budgets.
A company developing a high-impact AI system used in financial decisions may need extensive testing, documentation and monitoring. A small business using an AI tool to organise customer enquiries may have a very different risk profile.
If regulatory requirements are too broad, smaller companies could face obligations that are expensive relative to their size and the risks their products create.
On the other hand, weak oversight can leave consumers with limited protection when AI systems make consequential mistakes.
A workable framework would need to balance these concerns through clear rules, proportionate obligations and practical guidance that businesses can understand.
What did the Bill propose?
The proposed legislation aimed to create a broader system for AI governance rather than relying exclusively on existing laws.
Its provisions included:
- Establishing an Office of the Artificial Intelligence Commissioner.
- Creating an advisory structure to support AI governance.
- Introducing risk-based obligations for certain AI systems.
- Addressing transparency and accountability.
- Providing for regulatory sandboxes in which qualifying innovations could be tested under supervision.
- Supporting AI literacy and responsible adoption.
- Addressing aspects of AI use by public institutions.
These proposals were intended to provide a more specific framework for AI than the rules contained in general legislation.
The committee’s recommendation raises questions about how those objectives should be pursued, not whether every issue identified in the Bill is unimportant.
What happens to AI regulation in Kenya now?
The immediate question is what approach the government and Parliament will take following the committee’s recommendation.
The committee indicated that a national policy should guide future legislation. Reporting in October 2026 also stated that the Ministry of ICT informed the committee that the National Artificial Intelligence and Emerging Technologies Policy, 2026, was in its final stages of development.
The policy’s final publication and official status should be confirmed through government sources before readers rely on it as an adopted framework.
A policy can establish national priorities and guide government action, but it should not automatically be treated as equivalent to an Act of Parliament. Businesses need to understand which obligations arise from existing law, which come from policy direction and which would require new legislation.
For now, organisations should continue to comply with laws that already apply to their activities, including data protection and other relevant sector-specific requirements.
What does this mean for Kenyan AI startups?
For AI startups, the committee’s recommendation may reduce immediate uncertainty about the proposed Bill’s specific regulatory structure. However, it does not eliminate the need to manage risks or comply with existing laws.
AI developers may gain time to prepare
Businesses developing AI products can use this period to establish responsible practices before new legislation is introduced.
Practical steps include documenting what a product does, testing its performance, identifying foreseeable harms and creating procedures for responding to complaints.
Startups should also be transparent about AI-generated outputs, particularly where customers could reasonably mistake them for verified information or human decisions.
Investors will watch regulatory clarity
Investors generally need to understand the rules governing the markets in which their companies operate.
Unclear or rapidly changing requirements can increase uncertainty. Equally, a predictable framework that protects consumers and establishes consistent standards may help businesses plan for long-term growth.
Kenya’s challenge is to develop rules that are sufficiently clear to support investment while retaining meaningful safeguards.
Local innovation needs practical safeguards
Kenyan developers are applying AI to problems in agriculture, education, healthcare, financial services, logistics and customer support.
A startup building a crop advisory tool, for example, needs to understand the limitations of its recommendations and avoid presenting uncertain outputs as guaranteed results. A company using AI to screen loan applicants needs to consider fairness, data quality, explainability and applicable financial and data-protection requirements.
These responsibilities do not depend solely on whether a dedicated AI law is enacted.
TechDrivers has previously explored the practical effects of AI on work and business. Read our analysis of how AI could change the way work is managed and how businesses are adopting AI automation in Kenya.
What does this mean for ordinary Kenyans?
AI governance is not only a concern for software companies. It can affect people who use digital lending services, online shopping platforms, educational applications, healthcare tools and automated customer-support systems.
Protection against misuse of personal data
AI products may process names, contact details, financial records, photographs, voice recordings or other personal information.
Kenya’s Data Protection Act, 2019, provides an existing legal framework for personal-data processing. Organizations should consider whether they have a lawful basis for processing information, whether they have explained their practices clearly and whether they have implemented appropriate safeguards.
The precise obligations depend on the circumstances and the type of processing involved.
Fairness in automated decisions
An AI system may help assess applications, rank candidates or identify patterns in customer behavior.
If the data used by a system is incomplete or biased, its outputs may disadvantage some people. Where automated processing has a significant effect on individuals, the relevant legal rights and obligations need to be assessed carefully.
A dedicated AI law could provide additional rules for some of these issues, but the absence of a new AI Act does not mean that every existing legal protection disappears.
Harmful deepfakes and misleading content
AI tools can produce realistic images, audio and video that misrepresent what a person said or did.
Such content can be used for fraud, harassment, impersonation or the spread of false information. The legal response depends on the specific conduct and applicable laws.
A future AI framework could clarify responsibilities for developers, distributors and users of certain AI-generated content. Any new rules would need to address harmful uses without unnecessarily restricting legitimate creative work, research and expression.
Could Kenya regulate AI without creating a new authority?
One option is to strengthen coordination among existing regulators and clarify how current laws apply to AI systems.
For example, data-protection issues could remain within the existing data-protection framework, while other regulators address matters within their respective legal mandates.
Another option would be to establish a specialized AI oversight body with clearly defined powers and formal coordination arrangements.
Each approach has trade-offs. Relying on existing institutions may reduce duplication, but regulators may need additional expertise and resources. A new authority could develop specialized knowledge, but it would require funding, clear limits on its powers and safeguards against overlapping mandates.
A risk-based approach could also help distinguish between low-risk uses and systems that can significantly affect people’s rights, finances, safety or access to essential services.
The objective should be clear responsibilities, proportionate enforcement and accessible guidance for businesses and the public.
What should Kenyan businesses do while the debate continues?
Businesses do not need to wait for a new AI law to begin improving their governance practices.
1. Identify where AI is being used. Maintain a record of AI tools used by employees, customer-facing services and internal systems.
2. Review the data involved. Determine what information is collected, where it comes from, how it is used and whether personal data is involved.
3. Assess the consequences of errors. A tool that drafts routine marketing copy may create different risks from one used to assess loan applications or provide healthcare recommendations.
4. Keep people involved in important decisions. Establish appropriate human review for consequential outputs, especially where mistakes could affect a person’s rights, finances or safety.
5. Tell users when it matters. Explain when AI is being used and what its limitations are, particularly when users may otherwise misunderstand how a service works.
6. Monitor legal and policy developments. Follow official parliamentary records, government policy announcements and guidance from relevant regulators.
These steps can help organizations prepare for future requirements while improving the reliability of their AI systems today.
For businesses exploring AI-based digital services, our article on AI as a digital teammate in the workplace examines another part of the same transition.
Frequently asked questions
Has Kenya’s AI Bill, 2026, been rejected permanently?
The Senate ICT Committee recommended that the Senate should not proceed with the Bill. That recommendation should not be described as a final decision by the entire Senate unless subsequent official parliamentary records confirm that outcome.
Why did the Senate committee oppose the AI Bill?
The committee raised concerns about proposed penalties, compliance costs, the creation of a new AI regulator and possible overlap with existing institutions. It also recommended that a national policy should guide future legislative action.
What penalties did the proposed AI Bill include?
Reporting on the Bill cited fines of up to KSh5 million for certain offences and possible imprisonment of up to two years for specified offences. The applicable penalty would depend on the offence and the Bill’s provisions; these were proposed penalties, not a new set of fines created by an enacted AI law.
Does Kenya currently have any laws that apply to AI?
Yes. Existing laws can apply to activities involving AI, depending on the circumstances. The Data Protection Act, 2019, is particularly relevant when personal data is processed. Other laws may also apply to specific conduct or sectors. The absence of a dedicated AI Act does not mean AI activity is entirely unregulated.
Will the committee’s recommendation affect Kenyan AI startups?
It may affect the direction and timing of proposed AI-specific regulation. However, the final effect depends on subsequent parliamentary and government decisions. Startups should continue to manage risks and comply with existing laws.
Does Kenya need an AI Commissioner?
That remains a policy question. A dedicated authority could build specialized expertise, while using existing institutions could reduce duplication. The appropriate model depends on clearly defined responsibilities, enforcement capacity, cost and the safeguards provided to the public.
What should businesses do before a dedicated AI law is enacted?
Businesses should document their AI use, assess risks, protect personal data, review outputs, provide appropriate human oversight and monitor official regulatory developments. They should not assume that a proposed Bill is already enforceable law.
Conclusion: Kenya’s AI regulation debate is not over
The Senate ICT Committee’s recommendation to halt the Artificial Intelligence Bill, 2026, has put the proposed law’s future into question. Its concerns center on whether the framework’s penalties, compliance requirements and proposed regulatory institution are proportionate to Kenya’s current technology ecosystem.
But the underlying issues remain. AI is increasingly used in business operations, financial services, education, healthcare and public administration. People need safeguards against harmful uses, while developers need clear and practical rules that allow responsible innovation.
Kenya’s next steps will matter. A coherent national policy, effective coordination among regulators and proportionate legal requirements could help establish a predictable environment for both technology businesses and the public.
The central challenge is not simply whether Kenya should regulate artificial intelligence. It is how to make that regulation clear, enforceable and appropriate to the risks—without unnecessarily obstructing the innovation it is meant to govern.
For Kenyan businesses, the practical message is straightforward: do not wait for the final shape of AI regulation before building responsible systems.
