Artificial intelligence (AI) is rapidly becoming part of everyday life in Kenya, often without people realising it.
It powers customer service chatbots, helps banks detect fraud, filters job applications, recommends products while shopping online and is increasingly being used by businesses through tools such as ChatGPT and other generative AI platforms.
Now, the government wants to accelerate that transformation.
Through the National Artificial Intelligence Strategy 2025–2030, launched in March 2025, the government has set out an ambitious plan to position Kenya as a regional leader in AI innovation, digital skills and AI-driven public services.
At the same time, it is moving to ensure the technology develops responsibly.
The Office of the Data Protection Commissioner (ODPC) has issued the Guidance Note on Artificial Intelligence, July 2026, outlining how organisations should use AI while protecting people’s privacy and complying with Kenya’s Data Protection Act.
The guidance is expected to take effect on September 4, providing businesses, government agencies and other organisations with a framework for deploying AI responsibly.
Together, the two documents illustrate Kenya’s approach to artificial intelligence: encourage innovation while ensuring it does not come at the expense of people’s rights.
1. AI is no longer just a technology issue
For many Kenyans, AI still feels like something associated with futuristic robots or chatbots that answer questions. In reality, artificial intelligence is already embedded in many everyday services.
Banks use algorithms to assess creditworthiness and detect suspicious transactions. Employers increasingly rely on software to screen job applications, while hospitals are beginning to explore AI-assisted diagnostics. Schools and universities are also experimenting with AI-powered learning tools.
The government’s AI Strategy seeks to expand these applications across sectors such as healthcare, agriculture, manufacturing, education, financial services and public administration.
Officials see AI as a tool that could improve public service delivery, strengthen economic growth, create jobs, attract investment and make Kenya a regional technology hub.
However, as AI becomes more influential in everyday decisions, questions around fairness, accountability and privacy are becoming increasingly important.
That is where the ODPC guidance comes in, with a clear message: AI is not above the law.
One of its clearest messages is that organisations cannot treat AI as operating outside Kenya’s legal framework.
Whether an organisation develops its own AI system, purchases commercial AI software or uses popular generative AI platforms to process personal information, it remains responsible for complying with the Data Protection Act.
The guidance applies broadly across sectors. Banks, insurance companies, schools, hospitals, employers, retailers, telecommunications firms and government institutions that use AI to process personal data are all expected to follow the same privacy principles.
Rather than creating an entirely new AI law, the ODPC explains how existing data protection obligations apply when organisations adopt artificial intelligence.
2. AI should not become a “black box”
Perhaps the biggest concern surrounding AI is that people often do not know when it is being used to make decisions about them.
Imagine applying for a loan through your bank’s mobile app. A few seconds later, you receive a message saying your application has been declined.
Was the decision made by a loan officer, or did an algorithm reject your application?
The ODPC guidance says organisations should be transparent when AI plays a significant role in decisions affecting individuals. More importantly, people should have an opportunity to request meaningful human review rather than simply accepting an automated outcome.
This could become particularly important in areas such as employment, insurance, education, healthcare and financial services, where AI systems increasingly assist decision-makers.
The guidance also encourages organisations to explain the reasoning behind AI-assisted decisions rather than hiding behind statements such as “the computer made the decision.”
This represents a significant shift towards transparency and accountability. Businesses remain responsible even when using overseas AI platforms such as Gemini, Claude and ChatGPT.
Many organisations now rely on cloud-based AI services developed outside Kenya. Employees may upload reports into AI assistants to summarise documents, generate presentations or draft emails.
Some businesses may assume that responsibility shifts to the overseas technology provider once information leaves Kenya.
The ODPC guidance makes it clear that this is not the case.
Organisations remain responsible for protecting personal information throughout its lifecycle, including when data is transferred to AI providers operating outside the country.
This means businesses are expected to carefully assess how personal information is processed, stored and protected before adopting AI-powered services.
For companies rapidly embracing generative AI, this may require reviewing contracts, updating privacy notices and strengthening governance procedures.
3. Public information is not automatically free AI training data
Another notable clarification concerns publicly available information.
Many internet users assume that anything posted publicly online can automatically be collected and used to train artificial intelligence systems.
The guidance challenges that assumption. It explains that organisations should still establish a lawful basis before using publicly available personal information for AI-related purposes.
For journalists, photographers, researchers, creators and ordinary social media users, this reinforces the principle that publicly accessible information does not automatically lose its privacy protections.
4. AI must not discriminate
Artificial intelligence is often promoted as objective. However, international experience has shown that poorly designed AI systems can unintentionally reinforce existing biases when they are trained using incomplete or unrepresentative data.
The ODPC therefore expects organisations to monitor AI systems for unfair outcomes and discrimination. This is particularly important where AI influences recruitment, lending, insurance, healthcare or other decisions that can have a significant impact on people’s lives.
Rather than assuming algorithms are always neutral, organisations are encouraged to continuously assess whether AI systems are producing equitable results.
5. High-risk AI faces greater scrutiny
The guidance recognises that not all AI systems present the same level of risk.
Applications involving healthcare, employment, education, financial services, facial recognition and generative AI receive particular attention because of their potential impact on individuals.
Organisations deploying higher-risk AI systems are expected to implement stronger governance measures, including risk assessments, documentation, monitoring and meaningful human oversight.
The message is straightforward: the greater the potential impact on people’s rights, the greater the responsibility placed on organisations deploying the technology.
6. Children’s data receives extra protection
The guidance also places special emphasis on children.
Organisations developing AI-powered educational tools or digital services aimed at minors are expected to implement stronger safeguards when processing children’s personal information.
This reflects growing recognition globally that children require additional protection in digital environments where AI is increasingly present.
7. AI governance does not end after deployment
One misconception surrounding AI compliance is that organisations only need to assess risks before launching a system.
The ODPC takes a different view. Organisations are expected to continuously monitor AI systems after deployment to identify emerging risks such as declining accuracy, cybersecurity vulnerabilities, model drift or unintended discriminatory outcomes.
In other words, responsible AI governance is presented as an ongoing process rather than a one-time compliance exercise.
8. Kenya is balancing innovation with trust
Taken together, the National Artificial Intelligence Strategy and the ODPC guidance illustrate a broader policy direction.
The government wants Kenya to become a leading AI economy in Africa by encouraging innovation, supporting local startups, strengthening digital infrastructure and building AI skills across the workforce.
At the same time, it recognises that widespread AI adoption depends on public confidence. People are unlikely to embrace AI if they fear it will misuse their personal information, make unfair decisions or operate without accountability.
The ODPC guidance seeks to build that trust by reminding organisations that artificial intelligence does not replace legal responsibility.
Human accountability remains central even when machines assist in decision-making.
With the guidance expected to take effect on September 4, organisations using AI are likely to spend the coming weeks reviewing their privacy notices, governance frameworks, vendor agreements and internal policies.
Many may also need to train staff on responsible AI use, assess whether existing AI tools comply with data protection requirements and conduct risk assessments for higher-risk applications.
For ordinary Kenyans, the guidance offers something equally important: greater clarity about their rights in an increasingly AI-powered world.
As artificial intelligence becomes woven into banking, healthcare, education, government services and everyday business operations, understanding how these systems should operate may become just as important as understanding the technology itself.
Kenya’s AI journey is therefore no longer simply about adopting the latest digital tools. It is about ensuring that innovation and the protection of fundamental rights advance together as the country awaits implementation of the policy.
