REGULATING ARTIFICIAL INTELLIGENCE IN KENYA: BALANCING INNOVATION, FUNDAMENTAL RIGHTS AND PUBLIC ACCOUNTABILITY

Introduction

Artificial intelligence (AI) is rapidly transforming how decisions are made, information is generated and services are delivered in Kenya, creating opportunities for innovation and economic development while presenting increasingly complex legal risks. As AI systems become capable of influencing decisions that affect individuals, questions of privacy, discrimination, accountability, transparency and access to justice become difficult to ignore. Kenya’s existing legal framework, including the Constitution of Kenya 2010 and the Data Protection Act 2019, provides important safeguards, yet these laws were not designed to address every challenge created by increasingly sophisticated AI technologies. Kenya’s Artificial Intelligence Strategy 2025–2030 and the proposed Artificial Intelligence Bill 2026 therefore represent important steps towards developing a more responsive regulatory framework. However, regulation must achieve more than technological control: it must protect fundamental rights without unnecessarily restricting innovation. This article critically examines whether Kenya’s emerging approach to AI regulation can achieve this balance, arguing that an effective framework must be proportionate, rights-based and sufficiently adaptable to hold those responsible for AI systems accountable for their consequences.¹ ² ³

Conceptual and Legal Background

Artificial intelligence refers broadly to computational systems capable of performing tasks that ordinarily require human intelligence, including learning from data, recognising patterns, generating content and supporting decision-making. Unlike conventional software, some AI systems can produce outputs through complex statistical models that may be difficult for users to understand or predict. This creates a distinctive legal problem because conventional rules of liability often assume that responsibility can be connected to identifiable human conduct. With AI, however, harm may arise from the interaction between developers, training data, algorithms, users and the environment in which a system operates. The problem is particularly significant where AI influences decisions concerning employment, financial services, healthcare or access to public services. Consequently, the legal question is not simply whether AI is accurate, but whether its design and deployment remain consistent with principles of fairness, accountability and human rights. Yeung argues that algorithmic systems increasingly exercise regulatory functions traditionally associated with human decision-makers, raising concerns about accountability and legitimacy.⁴ This demonstrates why AI governance requires legal rules capable of addressing both technological innovation and its wider consequences.

A further difficulty arises from the capacity of AI systems to reproduce existing social inequalities. An algorithm may appear neutral while producing discriminatory outcomes because of biased training data, inappropriate system design or assumptions embedded within the development process. This presents a particular challenge for equality law because the discriminatory effect may not be immediately visible and responsibility may be distributed across several actors. Wachter, Mittelstadt and Russell argue that individuals affected by automated decisions require sufficient information to understand and challenge decisions made about them.⁵ The issue therefore extends beyond technical accuracy to procedural fairness and effective remedies. A legal framework that protects individuals only after harm has occurred may be inadequate where automated systems can operate at a scale capable of affecting thousands of people. AI regulation should consequently adopt a preventative approach, requiring appropriate safeguards before high-risk systems are widely deployed.

The regulation of AI therefore requires a shift from regulating technology solely through existing laws towards anticipating the risks created by its design and deployment. A risk-based approach is particularly relevant because not every AI application presents the same degree of danger: an AI tool used for entertainment does not raise the same legal concerns as one used to determine access to employment, healthcare, credit or public services. The European Union has adopted this approach through the EU Artificial Intelligence Act, which differentiates regulatory obligations according to the level of risk posed by AI systems.⁶ This provides a useful comparative model for Kenya, but it should not be copied mechanically. Kenya’s regulatory choices must reflect its constitutional values, institutional capacity, technological development and socio-economic conditions. The central issue is therefore how Kenya can develop a framework that protects individuals from serious AI-related harm while preserving the technological innovation necessary for economic and social development.

Legal Framework in Kenya

Kenya already possesses several legal instruments capable of regulating particular consequences of artificial intelligence. At constitutional level, Article 27 of the Constitution guarantees equality and freedom from discrimination, while Article 31 protects the right to privacy.⁷ These provisions are particularly relevant where AI systems process personal information or produce decisions that may disadvantage particular individuals or groups. The Data Protection Act 2019 provides an additional safeguard by regulating the processing of personal data and expressly addressing automated individual decision-making. Section 35 gives a data subject the right not to be subjected to a decision based solely on automated processing where that decision produces legal effects or significantly affects the individual, subject to specified exceptions.⁸ The provision also permits an affected person to request reconsideration or a new decision that is not based solely on automated processing. This is significant because it establishes a legal basis for challenging certain automated outcomes rather than treating algorithmic decisions as inherently authoritative.

The Data Protection (General) Regulations 2021 further strengthen the framework surrounding automated processing by requiring appropriate safeguards and addressing concerns relating to transparency and discriminatory effects.⁹ Nevertheless, the existing framework has limitations. The Data Protection Act primarily regulates personal data rather than AI systems as a complete technological ecosystem. It may therefore provide protection where an AI system processes personal information, but it does not necessarily answer broader questions concerning system safety, algorithmic accountability, responsibility for defective AI or the governance of AI applications that do not involve personal data. This distinction exposes an important regulatory gap: existing laws can address particular consequences of AI without comprehensively governing the technology itself.

Kenya’s Artificial Intelligence Strategy 2025–2030 recognises this need by identifying governance and an adaptable legal framework as an important component of the country’s AI development agenda.¹⁰ The Strategy therefore demonstrates that Kenya’s policy direction is not simply to restrict AI, but to create conditions for responsible development and deployment. However, a strategy is primarily a policy instrument and cannot by itself provide the same enforceable rights and duties as legislation. This makes the proposed Artificial Intelligence Bill particularly important to Kenya’s future regulatory architecture.

Judicial Interpretation

Although Kenyan courts have not yet developed an extensive body of jurisprudence specifically dealing with artificial intelligence, existing administrative and constitutional decisions provide principles that are highly relevant to automated decision-making. In *Suchan Investment Limited v Ministry of National Heritage & Culture & 3 others*, the Court of Appeal considered the legality and rationality of a ministerial decision declaring property a national monument. The Court found that the decision was unsupported by sufficient evidence and constituted an unreasonable exercise of statutory power, ultimately quashing the decision.¹¹ The significance of the case for AI regulation lies not in its facts but in its treatment of reasoned and evidence-based decision-making. If a public authority uses an algorithm to make or influence a decision affecting an individual, technological complexity should not remove the obligation to act rationally, lawfully and on an adequate evidential basis.

This principle becomes more important where an affected person cannot understand why an automated system produced a particular result. A government agency should not be able to avoid constitutional scrutiny by arguing that an unfavourable decision was generated by software rather than a human official. Article 47 of the Constitution requires administrative action to be lawful, reasonable and procedurally fair, while the Fair Administrative Action Act 2015 provides statutory mechanisms for challenging administrative decisions.¹² The existing judicial approach therefore provides a useful foundation for AI governance: automated decision-making should remain subject to the same standards of legality, rationality and fairness that apply to conventional administrative action. However, existing case law does not fully resolve the distinctive problems of algorithmic opacity, bias and distributed responsibility. This reinforces the need for specific regulation rather than relying exclusively on courts to adapt existing principles after disputes arise.

Critical Analysis of Kenya’s Proposed AI Regulation

Kenya’s proposed Artificial Intelligence Bill 2026 represents an important attempt to move from regulating individual consequences of technology towards establishing a broader governance framework. The Bill proposes an Office of the Artificial Intelligence Commissioner with responsibilities including risk assessment, conformity audits, post-market surveillance, investigation of complaints and development of regulatory guidance.¹³ The proposed institutional framework is significant because AI-related harms may require specialised technical expertise that existing regulatory institutions do not possess. However, creating another regulatory institution may also produce overlapping mandates with the Office of the Data Protection Commissioner and sector-specific regulators.¹⁴ The effectiveness of the proposed framework will therefore depend not simply on creating an AI Commissioner, but on clearly defining institutional responsibilities and requiring effective cooperation between regulators.

The Bill’s emphasis on human-centred artificial intelligence is another significant strength. It proposes human involvement and oversight in critical decisions, together with mechanisms for review and override where AI affects rights, safety or societal well-being.¹⁵ This approach is consistent with the principle that technological efficiency should not displace human accountability. Nevertheless, the existence of a human reviewer does not automatically guarantee meaningful oversight. A reviewer who simply accepts an algorithmic recommendation without understanding or questioning its basis would provide little protection against automated error or discrimination. This concern is particularly important in light of Article 47 of the Constitution, which requires administrative action to be lawful, reasonable and procedurally fair.¹⁶ The proposed human-oversight requirement should therefore require genuine authority to question, modify or reject an AI-generated outcome rather than merely placing a human between the algorithm and the affected individual.

Transparency is another area requiring stronger protection. Merely informing an individual that AI was used in a decision does not necessarily enable that person to understand or challenge the outcome. The law should therefore distinguish between technical transparency and meaningful explanation. Wachter, Mittelstadt and Russell demonstrate that counterfactual explanations can help individuals understand how an automated decision could have been different without requiring disclosure of the entire algorithm or source code.¹⁷ This provides Kenya with a potentially useful middle ground between commercial confidentiality and the individual’s right to understand a significant decision. Such an approach would also complement the Data Protection Act 2019, which already provides safeguards concerning decisions based solely on automated processing.¹⁸

The proposed regulatory sandbox could also help Kenya avoid excessive regulation. AI technology is developing rapidly, and rigid legal requirements may become outdated before they can effectively respond to new applications. The Bill’s provision for regulatory sandboxes could allow innovative systems to be tested under regulatory supervision before widespread deployment.¹⁹ However, regulatory flexibility must not become a mechanism through which fundamental rights are weakened in the name of innovation. High-risk applications should remain subject to minimum requirements concerning privacy, discrimination, security, human oversight and access to remedies. A proportionate, risk-based model would therefore be preferable to either unrestricted technological development or blanket regulation. The European Union’s AI Act provides a useful illustration of how regulatory obligations can be differentiated according to the level of risk posed by an AI system.²⁰

A further concern is the allocation of responsibility when AI causes harm. AI development commonly involves several actors, including developers, providers, deployers and users. This distribution of responsibility can make it difficult for an injured person to identify the actor legally responsible for an unlawful or harmful outcome. Yeung’s analysis of algorithmic regulation highlights the difficulty of maintaining accountability where decision-making authority becomes distributed through complex technological systems.²¹ Kenya’s existing legal framework may provide remedies in particular circumstances, but it does not necessarily establish a comprehensive liability framework covering the entire AI lifecycle. The proposed legislation should therefore clarify responsibility for defective design, inadequate testing, negligent deployment and failure to monitor high-risk systems.

The regulation of AI must also address equality and discriminatory outcomes. An apparently neutral algorithm may reproduce discrimination because of biased training data, inadequate datasets or assumptions incorporated during system development.²² This creates a particularly important issue for Kenya because AI systems developed using datasets that inadequately represent African populations may produce outcomes that are less accurate or less fair when applied locally. Article 27 of the Constitution provides a strong normative foundation for preventing discrimination, while the Data Protection Act provides additional safeguards against certain discriminatory effects of automated processing.²³ Regulation should therefore require appropriate bias testing and rights-impact assessment for high-risk systems before and during deployment. The objective should not be to eliminate every technological risk, which would be unrealistic, but to ensure that foreseeable and serious risks are identified, reduced and accompanied by effective remedies.

Comparative Perspectives

The European Union provides the clearest example of a comprehensive statutory approach through the *EU Artificial Intelligence Act*. The Act adopts a risk-based framework under which different obligations apply according to the level of risk presented by an AI system, with particularly demanding requirements for high-risk systems.²⁴ The principal strength of this approach is that regulation is connected to potential harm rather than simply to the existence of AI technology. However, the detailed requirements may create substantial compliance costs, particularly for smaller enterprises.²⁵ Kenya should therefore learn from the EU model without reproducing it mechanically. A Kenyan framework should retain the principle of proportionality while adapting regulatory requirements to Kenya’s institutional capacity and economic environment.

The United Kingdom provides a contrasting model. Rather than relying primarily upon a single comprehensive AI statute, the UK has adopted a principles-based, regulator-led approach built around safety, transparency, fairness, accountability and contestability.²⁶ This model offers greater flexibility because existing regulators can apply the principles according to their particular sectors. However, the same flexibility can produce fragmentation and uncertainty about precisely which requirements apply to a particular AI system. Kenya could therefore benefit from combining the strengths of both models: binding statutory protections for fundamental rights and high-risk AI, supplemented by flexible regulatory guidance capable of responding to technological change.

The African Union’s Continental Artificial Intelligence Strategy provides an additional and particularly relevant perspective. The Strategy promotes an Africa-centric, development-focused and ethical approach to AI governance while encouraging responsible, equitable and inclusive AI development.²⁷ This is important because Kenya should not simply import regulatory models developed for European or other jurisdictions with different economic and institutional circumstances. Kenya can instead pursue compatibility with emerging African standards while retaining its own constitutional commitments and addressing local concerns such as digital inequality, institutional capacity, access to technology and representation within datasets.

Key Legal Challenges and Critical Evaluation

The central challenge is therefore finding an appropriate balance between innovation and accountability. Excessive regulation could discourage investment, increase compliance costs for start-ups and prevent beneficial AI applications from reaching Kenyan consumers.²⁸ Conversely, weak regulation could allow discrimination, privacy violations, misinformation and unsafe automated decision-making to develop faster than effective remedies. The appropriate response is consequently neither unrestricted innovation nor blanket regulation, but proportional regulation based on risk. Lower-risk applications should face relatively light obligations, while systems capable of significantly affecting fundamental rights should face stronger requirements concerning testing, transparency, human oversight, monitoring and redress.

A second challenge is institutional capacity. Sophisticated AI legislation will have limited practical value if the institutions responsible for enforcement lack qualified personnel, technical infrastructure and financial resources. Kenya’s AI Strategy itself recognises the importance of an adaptable governance and legal framework for responsible AI development.²⁹ The proposed regulatory structure should therefore be accompanied by investment in technical expertise, regulatory capacity and public AI literacy. Without such investment, Kenya risks creating legislation that is ambitious on paper but weak in practical enforcement.

Recommendations for Reform

Kenya should adopt a rights-based, risk-sensitive and innovation-supportive regulatory model. First, the Artificial Intelligence Bill should clearly define the respective powers of the AI Commissioner, the Office of the Data Protection Commissioner and sector-specific regulators. Secondly, high-risk AI systems should be subject to mandatory risk and rights-impact assessments before deployment and appropriate monitoring thereafter. Thirdly, individuals affected by significant automated decisions should have a practical right to meaningful explanation, human review and accessible remedies. Fourthly, liability rules should clearly identify responsibility across the AI supply chain. Finally, regulatory sandboxes should be developed alongside AI literacy and support for Kenyan innovators, ensuring that regulation becomes an instrument for responsible innovation rather than an obstacle to innovation.

Conclusion

Artificial intelligence presents Kenya with a regulatory challenge that cannot be resolved simply by extending existing laws to new technologies. The analysis demonstrates that the Constitution, Data Protection Act and administrative law already provide important safeguards concerning privacy, equality, fairness and accountability. However, these protections remain fragmented and largely address particular consequences of AI rather than governing the complete lifecycle of increasingly sophisticated systems. Kenya’s proposed Artificial Intelligence Bill therefore provides an important opportunity to close this regulatory gap. The central argument of this article is that Kenya should pursue neither unrestricted technological development nor excessively restrictive regulation. A sustainable approach requires a proportionate, rights-based and risk-sensitive framework in which the strength of regulatory obligations corresponds to the potential harm posed by an AI system. The proposed AI Commissioner, human-oversight requirements, regulatory sandboxes and complaint mechanisms provide useful foundations, but their effectiveness will depend upon institutional independence, adequate technical capacity, clear regulatory responsibilities and meaningful remedies for affected individuals. Kenya should therefore strengthen the proposed framework by establishing clearer liability rules, requiring meaningful explanations for significant automated decisions, introducing stronger rights-impact assessments for high-risk systems and ensuring effective cooperation between AI, data-protection and sector-specific regulators. At the same time, proportionate obligations and regulatory sandboxes can protect innovation and prevent compliance requirements from unnecessarily disadvantaging emerging Kenyan businesses. Ultimately, the success of AI regulation should not be measured by how many restrictions Kenya places on technology, but by whether technological progress occurs without sacrificing constitutional rights, human dignity and public accountability. Kenya has an opportunity not merely to regulate artificial intelligence, but to demonstrate how an African constitutional democracy can shape technological development around the interests of its people.

Bibliography

Legislation and Constitutional Materials

Constitution of Kenya 2010.

Data Protection Act 2019 (Kenya).

Data Protection (General) Regulations 2021 (Kenya).

Fair Administrative Action Act 2015 (Kenya).

Artificial Intelligence Bill 2026 (Senate Bill No 4 of 2026).

Regulation (EU) 2024/1689 (Artificial Intelligence Act).

Cases

Suchan Investment Limited v Ministry of National Heritage & Culture & 3 others [2016] KECA 729 (KLR).

Secondary Sources

Yeung K, ‘Algorithmic Regulation: A Critical Interrogation’ (2018) 12(4) Regulation & Governance 505.

Wachter S, Mittelstadt B and Russell C, ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR’ (2018) 31(2) Harvard Journal of Law & Technology 841.

Policy and Institutional Materials

Ministry of Information, Communications and the Digital Economy, Kenya Artificial Intelligence Strategy 2025–2030 (2025).

African Union, Continental Artificial Intelligence Strategy (2024).

UK Government, A Pro-Innovation Approach to AI Regulation (2023).

OSCOLA Footnote(S):

1. Karen Yeung, ‘Algorithmic Regulation: A Critical Interrogation’ (2018) 12(4) Regulation & Governance 505.
2. Sandra Wachter, Brent Mittelstadt and Christopher Russell, ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR’ (2018) 31(2) Harvard Journal of Law & Technology 841.
3. Regulation (EU) 2024/1689 (Artificial Intelligence Act).
4. Karen Yeung, ‘Algorithmic Regulation: A Critical Interrogation’ (2018) 12(4) Regulation & Governance 505.
5. Sandra Wachter, Brent Mittelstadt and Christopher Russell, ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR’ (2018) 31(2) Harvard Journal of Law & Technology 841.
6. Regulation (EU) 2024/1689 (Artificial Intelligence Act), arts 6–9.
7. Constitution of Kenya 2010, arts 27 and 31.
8. Data Protection Act 2019 (Kenya), s 35.
9. Data Protection (General) Regulations 2021 (Kenya), regs 22 and 49.
10. Ministry of Information, Communications and the Digital Economy, Kenya Artificial Intelligence Strategy 2025–2030 (2025).
11. Suchan Investment Limited v Ministry of National Heritage & Culture & 3 others [2016] KECA 729 (KLR).
12. Constitution of Kenya 2010, art 47; Fair Administrative Action Act 2015 (Kenya), ss 3–4.
13. Artificial Intelligence Bill 2026 (Senate Bill No 4 of 2026), s 10.
14. ibid; Data Protection Act 2019 (Kenya), ss 4–6.
15. Artificial Intelligence Bill 2026, s 32.
16. Constitution of Kenya 2010, art 47.
17. Sandra Wachter, Brent Mittelstadt and Christopher Russell, ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR’ (2018) 31(2) Harvard Journal of Law & Technology 841.
18. Data Protection Act 2019 (Kenya), s 35.
19. Artificial Intelligence Bill 2026, provisions on regulatory sandboxes.
20. Regulation (EU) 2024/1689 (Artificial Intelligence Act), arts 6–9.
21. Karen Yeung, ‘Algorithmic Regulation: A Critical Interrogation’ (2018) 12(4) Regulation & Governance 505.
22. Constitution of Kenya 2010, art 27.
23. Data Protection Act 2019 (Kenya), s 35.
24. Regulation (EU) 2024/1689 (Artificial Intelligence Act), arts 6–9.
25. ibid.
26. UK Government, A Pro-Innovation Approach to AI Regulation (2023).
27. African Union, Continental Artificial Intelligence Strategy (2024).
28. Karen Yeung, ‘Algorithmic Regulation: A Critical Interrogation’ (2018) 12(4) Regulation & Governance 505.
29. Ministry of Information, Communications and the Digital Economy, Kenya Artificial Intelligence Strategy 2025–2030 (2025).