Source correction, September 29, 2026. The original August 10 report cited an ODPC index for a 17 August comment deadline. That index now returns 404. We verified the official July 2026 PDF, which contains no deadline, and removed instructions to act on the unverified timetable. The original publication date is retained.
Middle East and Africa AI regulation
Informational analysis, not legal advice. Confirm how the guidance applies to your situation with qualified counsel.
Part of the AI Regulation News hub.
Kenya's ODPC published a July 2026 draft AI Guidance Note
Kenya's ODPC released a July 2026 Guidance Note on Artificial Intelligence under the Data Protection Act. The PDF is marked as draft guidance; the current consultation timetable is unverified.
Bottom line: The July 2026 ODPC draft Guidance Note discusses Kenya's Data Protection Act Cap 411C in the context of AI systems. Its cover is marked as draft guidance.
Who this affects: Controllers and processors using AI on personal data in ODPC's remit, including firms with Kenya users, processing, or shared-services operations.
Effective date: Guidance dated July 2026. Current consultation timetable unverified.
What changed: ODPC published an AI Guidance Note covering principles, lawful bases, data-subject rights (including automated decision-making), DPIA, DPO, children, breach notice, and third-party AI processing.
Analysis: If you already run Kenya DPIAs for automated decisions, read this as the AI-specific overlay and compare its provisions with your current controls.
Primary sources: AI Guidance Note PDF · draft guidance page (the original index link is no longer available)
- Instrument (EN)
- Guidance Note on Artificial Intelligence (July 2026)
- Authority
- Office of the Data Protection Commissioner (ODPC)
- Jurisdiction
- Kenya
- Status
- July 2026 draft guidance. Current consultation status unverified
- Bindingness
- Draft guidance under the Data Protection Act Cap 411C; current adoption status unverified
- Effective / next deadline
- Current consultation timetable unverified
- Primary source
- ODPC AI Guidance Note PDF
What changed
Kenya's Office of the Data Protection Commissioner published a Guidance Note on Artificial Intelligence dated July 2026. The original report also recorded companion notes on Emerging Technologies and Privacy-Enhancing Technologies on an ODPC index that is now unavailable.
The original report gave a 17 August 2026 comment deadline. We could not reverify that instruction after the index became unavailable; the linked PDF contains no comment deadline.
The opened PDF's contents apply Kenya's existing legislative framework (Constitution 2010; Data Protection Act Cap 411C; 2021 General, Registration, and Complaints Handling Regulations) to AI systems. Covered topics include data-protection principles, lawful bases, data-subject rights in AI contexts (including the right not to be subject to automated decision-making), and controller/processor obligations such as registration, privacy by design and default, DPIA, DPO, sensitive personal data, children and AI, breach notification, and third-party AI processing.
This instrument is distinct from the Artificial Intelligence Bill, 2026 (Senate Bills No. 4) already tracked separately, and from the earlier ODPC automated-decision / DPIA row.
Who is affected
Data controllers and processors using AI systems that process personal data within ODPC's remit.
US counsel and privacy leads advising firms with Kenyan users, Kenyan processing, or BPO/shared-services operations that touch Kenyan personal data.
Practical consequence for the US professional
Do not confuse this Guidance Note with Kenya's AI Bill. This source check does not establish the current status of the AI Bill. The linked ODPC draft discusses the existing data-protection framework.
If you have Kenya personal data in model training, inference, or automated decisions, map the Guidance Note sections on lawful basis, automated decision-making rights, DPIA, and third-party AI processors against your current controls.
Check the current ODPC consultation instructions before submitting comments.
Cross-border duty hook
For Africa coverage, pair this with the Kenya AI Bill tracker row and the thin Egypt/Nigeria inventory. The linked draft discusses existing privacy law. This correction does not verify the current parliamentary status of a separate AI statute.
Map the July 2026 ODPC AI Guidance Note to your Kenya data controls. Check the current ODPC instructions separately before relying on a comment deadline.
Source File
https://www.odpc.go.ke/wp-content/uploads/2026/07/AI-Guidance-Note.July-2026.pdf
Open the linked ODPC PDF and confirm the July 2026 title block. The former draft-guidance index returned 404 during this check. The PDF does not verify a comment deadline.
Guidance Note on Artificial Intelligence · July 2026 · OFFICE OF THE DATA PROTECTION COMMISSIONER
FAQ
Is this Kenya's AI law?
No. It is ODPC guidance applying the existing Data Protection Act Cap 411C to AI systems. Kenya's Artificial Intelligence Bill, 2026 is a separate legislative instrument.
When do comments close?
The current timetable is unverified. The original report gave 17 August 2026, but the source index is now unavailable and the linked PDF contains no deadline.
How does this relate to the AI Bill?
The linked draft discusses privacy law in AI systems. This source check does not verify the current text or legislative stage of the separate AI Bill.
What should a US firm with Kenya data do first?
Open the PDF and map automated-decision, DPIA, and third-party AI processor sections to current controls. Check the current consultation instructions separately.
Related tracker rows
More coverage in the hub at AI Regulation News.
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.