Kenya’s AI bill creates a new digital sheriff with sweeping powers

In February 2026, Kenya took a decisive step toward regulating one of the most transformative technologies of the modern era. The Artificial Intelligence (AI) Bill (2026), sponsored by Nominated Senator Karen Nyamu, marks the country’s first comprehensive attempt to bring order, accountability, and structure to its rapidly growing AI ecosystem.

For years, Kenya has been described as Africa’s “Silicon Savannah” due to the global success of homegrown innovations like M-Pesa (mobile money) and Ushahidi (crowdsourced crisis mapping). It thrived on innovation powered by startups and global tech firms experimenting with everything from fintech algorithms to health diagnostics. 

But this growth has largely existed within a patchwork of laws, including the Data Protection Act of 2019 and the Computer Misuse and Cybercrimes Act of 2018. The new bill seeks to unify and modernise this fragmented approach.

Borrowing heavily from the European Union’s AI Act of 2024, Kenya’s proposal aims to strike a delicate balance between enabling innovation and protecting citizens. At the heart of this effort is a powerful new institution that could redefine how technology is governed in the country.

The most consequential feature of the bill is the creation of the Office of the Artificial Intelligence Commissioner, an independent authority tasked with enforcing AI rules. In policy circles, this office has already earned a nickname: the “digital sheriff.”

This is not merely symbolic. The Commissioner, according to the bill, will wield sweeping powers to inspect AI systems, access training data, investigate complaints, and issue enforcement notices. The office, TechCabal learnt, will also maintain a public register of high-risk AI systems operating in Kenya, bringing a new level of transparency to technologies that have often operated in the shadows.

Appointed by the President and approved by the National Assembly, the Commissioner will serve a five-year renewable term. The role is structured to ensure autonomy, positioning it alongside other key state offices. 

However, the qualifications required for the position are unusually stringent. Similar positions in other government agencies are filled by government appointees, with little emphasis on advanced qualifications. For the AI commissioner role, the bill specifies that candidates must have advanced academic credentials and a minimum Master’s degree in AI, Computer Science, Law, Ethics, or Engineering. They must also have at least 10 years of experience in AI governance and institutional leadership, raising questions about whether such expertise is readily available in a still-emerging field.

Beyond enforcement, the bill noted that the office will also shape the broader AI ecosystem. It will develop ethical guidelines, promote AI literacy among citizens, and oversee regulatory sandboxes where startups can test new technologies under relaxed rules.

A risk-based approach? 

Central to the bill is a four-tier classification system that regulates AI based on its potential for harm. This framework reflects a growing global consensus that not all AI systems should be treated equally.

At the highest level are systems deemed to pose an “unacceptable risk.” These include technologies designed for cognitive manipulation, government-led social scoring, or intrusive surveillance. Such systems are banned outright, with their development or deployment considered a criminal offence.

The next category, “high-risk” AI, covers applications that influence critical aspects of life, such as healthcare, banking, education, and law enforcement. These systems will face strict requirements, including human rights impact assessments, mandatory registration, and continuous human oversight. 

The aim is to ensure that decisions affecting livelihoods and freedoms are not left entirely to algorithms.

“Limited risk” systems, such as chatbots and AI-generated media, must meet transparency obligations. Users must be clearly informed when they are interacting with AI or viewing synthetic content. Meanwhile, “minimal risk” applications, including spam filters and video game algorithms, will remain largely unregulated to encourage innovation.

This tiered approach allows regulators to focus resources where the stakes are highest, while giving developers room to experiment in lower-risk areas.

Tackling digital harm 

One of the most immediate concerns addressed by the bill is the rise of deepfakes and AI-driven misinformation. With Kenya’s 2027 general elections on the horizon, lawmakers are particularly wary of how synthetic media could be used to manipulate public opinion.

The bill introduces strict penalties for non-consensual deepfakes, including fines of up to KES 5 million and prison terms of up to two years. It also criminalises the use of AI-generated content for political interference, signalling a proactive attempt to safeguard democratic processes.

These provisions build on existing laws like the Data Protection Act of 2019, but go further by explicitly targeting AI-enabled harm. They reflect a broader recognition that the risks posed by AI are no longer theoretical but already shaping real-world events.

Beyond enforcement and penalties, the bill places a strong emphasis on protecting individual rights. One of its most notable provisions is the “right to explanation,” which allows citizens to demand clear, plain-language justifications for automated decisions that affect them.

Whether it is a rejected loan application or an unsuccessful job screening, individuals will have the right to understand how an algorithm reached its conclusion and to request human review. This provision aims to counter the opacity of AI systems, often described as “black boxes.”

Developers are also required to adopt human-centric design principles, ensuring that their systems prioritise safety, fairness, and non-discrimination. In doing so, the bill aligns Kenya’s AI governance with global ethical standards.

Innovation vs regulation

While the bill introduces significant oversight, it also recognises the need to nurture innovation. Regulatory sandboxes are a key part of this strategy, offering startups a controlled environment to test new AI products without facing the full burden of compliance from the outset.

This approach reflects lessons from other jurisdictions, where overly rigid regulations have sometimes stifled emerging industries. By providing flexibility, Kenya hopes to maintain its reputation as a leading tech hub in Africa.

However, not everyone is convinced the balance is right. Critics argue that the compliance requirements for high-risk AI, combined with steep penalties, could place an undue burden on smaller startups. For companies operating on limited budgets, the cost of audits, documentation, and oversight may prove prohibitive.

Another major question is how the new AI Commissioner will interact with existing regulators. Kenya already has institutions such as the Office of the Data Protection Commissioner and the Communications Authority, both of which oversee aspects of digital activity.

The bill mandates coordination between these bodies to avoid duplication and bureaucratic overlap. Yet, in practice, managing these relationships could prove complex. Without clear boundaries, companies may find themselves navigating multiple layers of regulation, potentially slowing down innovation rather than enabling it.

Africa’s AI race

Kenya’s AI bill is part of a broader continental shift from voluntary guidelines to enforceable laws. Countries like Nigeria, South Africa, and Angola are also developing their own frameworks, each with distinct priorities.

Nigeria, for instance, emphasises digital sovereignty and has proposed higher penalties, while South Africa is leaning toward a sector-specific regulatory model. Angola has taken an even more expansive approach, asserting jurisdiction over AI systems that affect its citizens regardless of where they are developed.

Despite these differences, a common thread is emerging: the use of regulatory sandboxes and risk-based frameworks to balance innovation with control. Kenya’s model, centred on a powerful single regulator, stands out for its centralisation and ambition.

Contrary to the idea of a regulatory vacuum, Kenya already has laws that apply to AI. The Data Protection Act governs how personal data is used, while cybercrime laws address malicious digital activity. Courts have even used these frameworks to halt controversial projects, such as the Worldcoin iris-scanning initiative.

The new bill does not replace these laws but builds on them, creating a specialised authority to handle AI-specific challenges. In this sense, the “digital sheriff” is less about starting from scratch and more about bringing coherence to an already evolving legal landscape.

If passed, the Artificial Intelligence Bill, 2026, will mark a turning point in how Kenya governs technology. By establishing a powerful central authority, adopting a risk-based framework, and embedding rights into law, the country is positioning itself at the forefront of AI regulation in Africa.