AI Regulation Tracker / Consultation

Kenya's AI Bill Would Create an Independent Commissioner With Power to Inspect, Audit, and Fine

Regulatory summary: Kenya's Artificial Intelligence Bill, 2026, published as Senate Bills No. 4 of 2025 and sponsored by Senator Karen Nyamu, would establish the Office of the Artificial Intelligence Commissioner as an independent regulator with power to enter premises and inspect AI systems, require records, issue enforcement notices, summon witnesses, and impose.

The Artificial Intelligence Bill, 2026 would establish the Office of the Kenya Artificial Intelligence Commissioner, sort AI systems into four risk tiers on an EU-influenced model, and impose heightened duties on high-risk systems in sectors such as healthcare, finance, employment, and security. It is a Senate bill in committee, not yet law.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Kenya's AI Bill Would Create an Independent Commissioner With Power to Inspect, Audit, and Fine regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

Kenya moved from having no dedicated AI statute to a published bill that would create a comprehensive framework and a standalone regulator. The bill establishes the Office of the Artificial Intelligence Commissioner, adopts a four-tier risk classification on an EU-influenced model, prohibits unacceptable-risk systems, imposes concrete obligations on high-risk systems, requires a public register of high-risk systems, and sets offences carrying fines and imprisonment. Detailed thresholds and classification criteria are left to regulations the Cabinet Secretary would make in consultation with the Commissioner.
AI providers and deployers selling into or operating in Kenya; compliance, data-protection, and legal teams at companies using AI in healthcare, finance, employment, security, and public administration; public-sector bodies and county governments; and digital-rights and public-law counsel. Vendors of high-risk systems face the heaviest proposed duties.
Status: Published as Senate Bills No.
If you operate AI in Kenya, map your systems against the bill's four tiers now, flag anything that would count as high risk in healthcare, finance, employment, security, or public administration, and start assembling the risk assessment, human rights impact assessment, explainability records, and five-year record-keeping the bill would require. Consider filing views through the committee's public participation process while the text can still change.

Regulatory Briefing

Bindingness: Pending legislation, not law. This is a Senate bill under committee review, so it creates no obligations today. If enacted and assented to, it would be a binding Act of Parliament, cited as the Artificial Intelligence Act, 2026, enforced by a statutory regulator with power to fine and, through the courts, to pursue criminal penalties. Treat every duty below as proposed, not in force.
Scope: Providers and deployers of AI systems operating in Kenya, across the public and private sectors, with heightened duties for high-risk systems in critical sectors. Providers develop or place systems on the market; deployers put systems into service or use them under their authority, excluding end users acting in a personal, non-professional capacity. The bill also addresses public-sector use and county governments.
What Changed: Kenya moved from having no dedicated AI statute to a published bill that would create a comprehensive framework and a standalone regulator. The bill establishes the Office of the Artificial Intelligence Commissioner, adopts a four-tier risk classification on an EU-influenced model, prohibits unacceptable-risk systems, imposes concrete obligations on high-risk systems, requires a public register of high-risk systems, and sets offences carrying fines and imprisonment. Detailed thresholds and classification criteria are left to regulations the Cabinet Secretary would make in consultation with the Commissioner.
Who This Affects: AI providers and deployers selling into or operating in Kenya; compliance, data-protection, and legal teams at companies using AI in healthcare, finance, employment, security, and public administration; public-sector bodies and county governments; and digital-rights and public-law counsel. Vendors of high-risk systems face the heaviest proposed duties.
Current Status: Published as Senate Bills No. 4 of 2025, dated February 19, 2026 on Kenya Law. First reading in the Senate on April 2, 2026; referred to the Senate Standing Committee on Information, Communication and Technology with a public participation process. Pre-enactment as of July 2026.
Effective Date: None. The bill is not in force. It must pass the Senate, clear the National Assembly, and receive presidential assent before any provision takes effect, and key duties depend on regulations still to be made.
Primary Source: The Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2025), Parliament of Kenya, https://www.parliament.go.ke/sites/default/files/2026-04/The%20Artificial%20Intelligence%20Bill,%202026%20(Senate%20Bills%20No.4%20of%202025)_0.pdf ; Kenya Law record, https://new.kenyalaw.org/akn/ke/bill/senate/2026-02-19/the-artificial-intelligence-bill-2026/eng@2026-02-19
Secondary Analysis: Bowmans (bowmanslaw.com), Kenya: Artificial Intelligence Bill, 2026, Proposed too soon?; Techweez (techweez.com), reporting the April 2, 2026 first reading and referral to the Senate ICT committee; TechPolicy.Press analysis of the bill.
Workflow Impact: A high-risk provider or deployer would need to run a risk assessment and a human rights impact assessment before deployment, build explainability and traceability into decision-making, keep data, training-set, output, and performance records for at least five years, run data protection impact assessments under the Data Protection Act where required, label AI-generated media and obtain consent for use of a person's image, voice, or likeness, and enter the system in a public register. The regulator could inspect, demand records, and fine for non-compliance.
Operational Next Step: If you operate AI in Kenya, map your systems against the bill's four tiers now, flag anything that would count as high risk in healthcare, finance, employment, security, or public administration, and start assembling the risk assessment, human rights impact assessment, explainability records, and five-year record-keeping the bill would require. Consider filing views through the committee's public participation process while the text can still change.

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Kenya	Kenya moved from having no dedicated AI statute to a published bill that would create a comprehensive framework and a standalone regulator. The bill establishes the Office of the Artificial Intelligence Commissioner, adopts a four-tier risk classification on an EU-influenced model, prohibits unacceptable-risk systems, imposes concrete obligations on high-risk systems, requires a public register of high-risk systems, and sets offences carrying fines and imprisonment. Detailed thresholds and classification criteria are left to regulations the Cabinet Secretary would make in consultation with the Commissioner.	AI providers and deployers selling into or operating in Kenya; compliance, data-protection, and legal teams at companies using AI in healthcare, finance, employment, security, and public administration; public-sector bodies and county governments; and digital-rights and public-law counsel. Vendors of high-risk systems face the heaviest proposed duties.	Published as Senate Bills No. 4 of 2025, dated February 19, 2026 on Kenya Law. First reading in the Senate on April 2, 2026; referred to the Senate Standing Committee on Information, Communication and Technology with a public participation process. Pre-enactment as of July 2026.

Source File

Instrument: The Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2025)
Authority: Parliament of Kenya (Senate); sponsor Senator Karen Nyamu; before the Senate Standing Committee on Information, Communication and Technology
Date: Dated February 19, 2026 on Kenya Law; first reading April 2, 2026; in committee with public participation as of July 2026
Citation: The Artificial Intelligence Bill, 2026, Senate Bills No. 4 of 2025 (would be cited as the Artificial Intelligence Act, 2026 if enacted)
Primary Source: https://www.parliament.go.ke/sites/default/files/2026-04/The%20Artificial%20Intelligence%20Bill,%202026%20(Senate%20Bills%20No.4%20of%202025)_0.pdf ; https://new.kenyalaw.org/akn/ke/bill/senate/2026-02-19/the-artificial-intelligence-bill-2026/eng@2026-02-19
Corroboration: Bowmans, Kenya: Artificial Intelligence Bill, 2026, Proposed too soon? (bowmanslaw.com); Techweez, AI Bill moves to Senate committee as public input window opens (techweez.com); TechPolicy.Press analysis of the bill.

Frequently Asked Questions

Is Kenya's Artificial Intelligence Bill, 2026 already law?

No. It is a Senate bill, published as Senate Bills No. 4 of 2025. It received its first reading on April 2, 2026 and was referred to the Senate Standing Committee on Information, Communication and Technology. It must pass both Houses and receive presidential assent before it takes effect, and several duties depend on regulations still to be made.

What is the Office of the Artificial Intelligence Commissioner?

It is the independent regulator the bill would create to oversee and enforce the Act. It would have power to enter premises and inspect systems, require records, issue enforcement notices, summon witnesses, impose administrative fines, and maintain a public register of high-risk systems.

How does the bill classify AI systems?

On a four-tier, EU-influenced model: unacceptable risk (prohibited), high risk (critical sectors such as healthcare, education, agriculture, finance, security, employment, and public administration), limited risk, and minimal risk. The detailed criteria would be set by regulations.

What would high-risk operators have to do?

Run a risk assessment and a human rights impact assessment before deployment, ensure transparency and explainability, keep records for at least five years, comply with the Data Protection Act, build in robustness and cybersecurity, label AI-generated media and obtain consent for use of a person's image, voice, or likeness, and register the system.

What are the penalties?

For serious offences, a fine of up to five million shillings or up to two years imprisonment, or both. For a second category, including obstructing the regulator or breaching ethical guidelines in a way that causes bias, discrimination, or harm, up to one million shillings or six months imprisonment, or both. Directors or officers can be personally liable where a company offends.