Part of the AI Regulation News hub.
Kenya's data-protection regulator published a July 2026 AI Guidance Note and wants comments by 17 August
Kenya's ODPC released a July 2026 Guidance Note on Artificial Intelligence under the Data Protection Act, with public comments due 17 August 2026. It is guidance, not Kenya's AI Bill.
Bottom line: This is not itself a binding AI statute. It is ODPC guidance applying Kenya's existing Data Protection Act Cap 411C to AI systems, opened for comment through 17 August 2026.
Who this affects: Controllers and processors using AI on personal data in ODPC's remit, including firms with Kenya users, processing, or shared-services operations.
Effective date: Guidance dated July 2026. Comment deadline 17 August 2026.
What changed: ODPC published an AI Guidance Note covering principles, lawful bases, data-subject rights (including automated decision-making), DPIA, DPO, children, breach notice, and third-party AI processing.
Analysis: If you already run Kenya DPIAs for automated decisions, read this as the AI-specific overlay and send comments before 17 August if the draft language will bind your stack in practice.
Primary sources: AI Guidance Note PDF · draft guidance page
- Instrument (EN)
- Guidance Note on Artificial Intelligence (July 2026)
- Authority
- Office of the Data Protection Commissioner (ODPC), Compliance Directorate
- Jurisdiction
- Kenya
- Status
- Draft guidance open for public comment through 17 August 2026
- Bindingness
- Regulatory guidance under the Data Protection Act Cap 411C (not a standalone AI Act)
- Effective / next deadline
- Comment deadline 17 August 2026
- Primary source
- ODPC AI Guidance Note PDF
What changed
Kenya's Office of the Data Protection Commissioner published a Guidance Note on Artificial Intelligence dated July 2026. The same draft-guidance page also lists companion notes on Emerging Technologies and Privacy-Enhancing Technologies.
Stakeholders may comment via the online form or by email to compliance@odpc.go.ke by 17 August 2026.
The opened PDF's contents apply Kenya's existing legislative framework (Constitution 2010; Data Protection Act Cap 411C; 2021 General, Registration, and Complaints Handling Regulations) to AI systems. Covered topics include data-protection principles, lawful bases, data-subject rights in AI contexts (including the right not to be subject to automated decision-making), and controller/processor obligations such as registration, privacy by design and default, DPIA, DPO, sensitive personal data, children and AI, breach notification, and third-party AI processing.
This instrument is distinct from the Artificial Intelligence Bill, 2026 (Senate Bills No. 4) already tracked separately, and from the earlier ODPC automated-decision / DPIA row.
Who is affected
Data controllers and processors using AI systems that process personal data within ODPC's remit.
US counsel and privacy leads advising firms with Kenyan users, Kenyan processing, or BPO/shared-services operations that touch Kenyan personal data.
Practical consequence for the US professional
Do not confuse this Guidance Note with Kenya's AI Bill. The Bill is still a legislative process. This note is ODPC telling you how Cap 411C already applies when AI is in the stack.
If you have Kenya personal data in model training, inference, or automated decisions, map the Guidance Note sections on lawful basis, automated decision-making rights, DPIA, and third-party AI processors against your current controls.
If the draft language will force tooling or contract changes, file comments before 17 August 2026.
Cross-border duty hook
For Africa coverage, pair this with the Kenya AI Bill tracker row and the thin Egypt/Nigeria inventory. ODPC is using guidance to operationalize existing privacy law while Parliament debates a dedicated AI statute.
Read the July 2026 ODPC AI Guidance Note as Cap 411C applied to AI, not as a new AI Act, and calendar the 17 August 2026 comment deadline if the draft will change your Kenya controls.
Source File
https://www.odpc.go.ke/wp-content/uploads/2026/07/AI-Guidance-Note.July-2026.pdf
Open the ODPC PDF and the draft-guidance-notes page; confirm the July 2026 title block and the 17 August 2026 comment instruction.
Guidance Note on Artificial Intelligence · July 2026 · OFFICE OF THE DATA PROTECTION COMMISSIONER
FAQ
Is this Kenya's AI law?
No. It is ODPC guidance applying the existing Data Protection Act Cap 411C to AI systems. Kenya's Artificial Intelligence Bill, 2026 is a separate legislative instrument.
When do comments close?
ODPC asks for comments on the draft guidance notes by 17 August 2026, via the online form or compliance@odpc.go.ke.
How does this relate to the AI Bill?
The Guidance Note is regulator guidance under privacy law. The AI Bill would create a separate AI-specific regime and commissioner structure if enacted.
What should a US firm with Kenya data do first?
Open the PDF, map automated-decision, DPIA, and third-party AI processor sections to current controls, and decide whether to comment before 17 August.
Related tracker rows
More coverage in the hub at AI Regulation News.