Kenya’s First AI Bill Hits a Wall: Why the Senate Committee Wants a Different Regulatory Model

Kenya’s attempt to establish its first dedicated artificial intelligence law has encountered a major setback. On 15 October 2026, The Star reported that the Senate Standing Committee on Information, Communication and Technology had recommended that the Senate not proceed with the Artificial Intelligence Bill, 2026, sponsored by nominated Senator Karen Nyamu. The committee’s recommendation followed consideration of submissions from 143 stakeholders, including government agencies, technology companies, professional associations, civil society organisations and members of the public.

The distinction between a committee recommendation and a final parliamentary decision is important. The available reporting establishes that the committee wants the Senate not to proceed with the Bill; it does not establish that the full Senate has formally rejected it through a vote.

The committee’s objections concern more than the proposed penalties. They touch on the structure of AI oversight, the powers of a proposed new regulator, the relationship between existing agencies, the affordability of compliance and Kenya’s ability to regulate systems developed by foreign technology companies.

The result is a policy impasse with consequences for businesses, public institutions and citizens. The Bill sought to create a dedicated framework for AI development and deployment. Its committee-level setback does not remove the risks that motivated the proposal; instead, it raises the question of how Kenya should address them through its existing laws, emerging policy framework and any future legislation.

Introduced in 2026 and sponsored by Senator Karen Nyamu, the Artificial Intelligence Bill sought to establish a comprehensive framework for governing the development, deployment and use of AI in Kenya. Its proposed architecture included an Office of the Artificial Intelligence Commissioner, an AI Authority and an Advisory Committee on Artificial Intelligence.

The proposed Commissioner’s office would have oversight and enforcement responsibilities, including investigating complaints, auditing AI systems and monitoring compliance. The proposed AI Authority would help establish industry standards and operate regulatory sandboxes, where developers could test systems under supervision. An advisory body would provide guidance on emerging risks and policy developments.

The Bill also proposed risk-based regulation, with stricter obligations for higher-risk systems. Its provisions addressed matters including risk assessments, transparency, data governance and harmful uses of AI-generated content. The proposed penalties included fines of up to KSh5 million and imprisonment of up to two years for certain serious offences.

These proposals reflected a broad regulatory ambition: to move beyond general principles and establish institutions and obligations specifically designed for AI.

That ambition also created questions about proportionality. Which systems should face the strictest scrutiny? How should obligations differ between a small developer experimenting with an open-source model and a large organisation deploying AI at scale? Which regulator should act when an AI application involves personal data, telecommunications infrastructure and a consequential automated decision?

The committee’s objections suggest that the proposed framework did not resolve these questions to its satisfaction.

According to The Star, the committee warned that the Bill could regulate AI too broadly, too early and too punitively for Kenya’s current stage of digital development. It questioned whether the proposed penalties were proportionate to the activities and resources of smaller developers, particularly those conducting experimental or non-commercial work.

The concern is economic as well as legal. Compliance can require specialist advice, risk assessments, documentation, testing and continuing monitoring. Large organisations may already have legal, security and governance teams to handle these requirements. Early-stage developers and small businesses may not.

If regulatory obligations are too broad or unclear, the cost of understanding and complying with them can become a barrier to entry. Smaller developers may delay launching products, abandon particular applications or choose to operate in markets where requirements are more predictable. The committee warned that excessive regulation could encourage Kenyan innovators to relocate their operations and intellectual property abroad.

These are risks identified by the committee, not evidence that an exodus has already occurred. Whether regulation changes investment decisions will depend on its final design, the costs it imposes and the value businesses see in a predictable and trusted market.

The opposite risk also deserves attention. Weak or unclear rules can create uncertainty for businesses that want to use AI responsibly, while leaving individuals without effective ways to challenge harmful outcomes. Predictable regulation can support investment when it clarifies responsibilities and establishes credible safeguards.

The question, therefore, is not whether compliance should cost nothing. It is whether obligations are proportionate to the risks, sufficiently clear to follow and realistically enforceable.

The committee also raised concerns about the proposed Office of the Artificial Intelligence Commissioner. As reported by The Star, it questioned whether the new office would concentrate administrative, supervisory, enforcement and quasi-judicial powers while duplicating functions already performed by existing institutions.

Two regulators identified in the reporting were the Office of the Data Protection Commissioner and the Communications Authority of Kenya. The committee also noted concerns about the public expenditure required to establish and operate additional institutions. Microsoft Kenya reportedly proposed embedding AI regulatory functions within existing institutions rather than creating a standalone office.

This debate reflects a central challenge in AI governance: the technology does not fit neatly within one regulatory category.

An AI system used by a lender may involve personal data and influence access to credit. A system used by a public agency may affect access to a service. A generative AI tool may create synthetic media, while the platform distributing that media is subject to a different set of responsibilities. Each use case can engage existing legal mandates, but the combined risks may require coordination across institutions.

A dedicated regulator could build specialist expertise and provide a clear point of accountability. However, a new office would need a well-defined mandate, appropriate resources and safeguards against excessive concentration of power. It would also need clear procedures for working with existing regulators.

Using existing institutions could reduce duplication and make use of established expertise. But simply assigning AI responsibilities to several agencies without a coordination mechanism could create gaps, inconsistent decisions and uncertainty about who is responsible for investigating a complaint.

Neither institutional model is sufficient by itself. The practical test is whether responsibilities are clear, regulators can cooperate, decisions can be challenged and citizens can obtain meaningful remedies.

The committee also questioned whether the Bill adequately addressed cross-border AI systems, general-purpose models and emerging technological risks. The Star reported that lawmakers considered enforcement difficult because Kenya relies substantially on AI systems developed by foreign technology companies.

This is a significant implementation issue. A Kenyan organisation might deploy an AI service developed overseas, integrate it into a local product and use it to make or support decisions affecting Kenyan customers. The developer of the underlying model, the local deployer and the platform hosting the service may be different entities, operating under different legal and commercial arrangements.

A framework focused mainly on domestic AI developers could therefore miss important points of control. Conversely, rules that impose broad obligations on every organisation using an AI-enabled product could burden ordinary businesses without necessarily reaching the actors best positioned to address a particular risk.

A future framework needs to distinguish between the responsibilities of model developers, system providers, distributors and deployers. Their duties should reflect the degree of control they exercise, the risks they can reasonably identify and the steps available to prevent or remedy harm.

Cross-border enforcement also requires practical cooperation. Rules on paper will have limited effect if authorities cannot identify responsible parties, obtain relevant information or coordinate with other jurisdictions where necessary.

The committee’s recommendation does not mean that AI-related activity is exempt from Kenyan law.

The Data Protection Act, 2019, already establishes obligations relating to personal data, including requirements relevant to automated decision-making. Other existing legal frameworks may apply depending on the activity, the information involved and the sector in which a system is deployed. Techweez notes that the existing data-protection framework does not resolve every issue raised by the Bill, including broader questions of AI safety, algorithmic accountability and synthetic media.

That distinction is essential. Kenya is not moving from a comprehensive AI law to a legal vacuum. It is facing the question of whether its existing legal tools adequately address the full range of AI-related risks and, where they do not, how additional protections should be designed.

For organisations using AI, existing obligations continue to matter regardless of the Bill’s status. If a business processes personal data through an AI system, it should not assume that the absence of a dedicated AI statute removes its data-protection responsibilities.

At the same time, businesses should not treat the Bill’s proposed penalties and obligations as if they are already binding law. The provisions reported in March 2026 were proposals under consideration, not a statement of current AI-specific legal requirements.

The Bill’s setback comes as Kenya develops a separate policy framework for AI and other emerging technologies.

The Ministry of Information, Communications and the Digital Economy invited public comments on the Draft Kenya Artificial Intelligence and Other Emerging Technologies Policy in 2026. The official consultation page set a submission deadline of 4 August 2026. The draft policy was intended to guide responsible AI development, deployment and use while supporting innovation, infrastructure, skills and public trust.

A policy and a law perform different functions. A policy can establish national priorities, direct government programmes and provide a basis for coordination. Legislation can create binding duties, define offences, assign statutory powers and establish enforceable remedies.

The two should be developed in a coherent sequence. A national policy can help determine what the country wants AI governance to achieve and which risks deserve priority. Legislation can then translate those objectives into clear obligations where existing law is insufficient.

The committee’s recommendation to finalise the national policy before proceeding with the Bill, as reported by The Star, makes this relationship particularly important.

However, finalising a policy will not, by itself, resolve every legal gap. The policy will need implementation plans, accountable institutions and resources. Any subsequent legislation will need clear definitions, proportionate duties, credible enforcement and a realistic compliance pathway.

The official parliamentary library lists a committee report on the Artificial Intelligence Bill, dated 7 August 2026. The full report is available through the Parliament of Kenya Library. The committee’s reported October recommendation should be read alongside the official parliamentary record as the legislative process develops.

The next stage of Kenya’s AI governance debate could focus on several practical questions.

A risk-based approach. Not every AI application creates the same potential harm. A tool that helps a user organise routine information does not raise the same issues as a system used to determine access to credit, employment, healthcare or essential public services. Requirements should reflect the consequences of the use case, while allowing for reassessment as systems change.

Clear allocation of responsibility. The framework should explain what is expected of developers, vendors, organisations deploying AI and public institutions using it. Where existing regulators already have relevant powers, the law should define how they coordinate rather than simply add another layer of oversight.

Proportionate penalties and due process. Sanctions should reflect the seriousness of a violation, the harm caused, the organisation’s role and the circumstances of the case. Businesses also need clarity on the rules, a fair process for contesting enforcement decisions and guidance on how to comply.

Practical support for smaller developers. Regulatory sandboxes, technical guidance, standardised assessment templates and staged implementation could help startups understand their responsibilities. Such support would not remove accountability; it could make compliance more achievable.

Protection for affected individuals. People should have clear routes to challenge consequential automated decisions, report misuse of personal data and seek remedies where AI systems cause harm. Transparency is useful only if people can understand what has happened and what steps are available to them.

Regular review. AI systems and deployment practices change quickly. Governance frameworks need mechanisms to review evidence, update technical guidance and revise rules where experience shows that obligations are ineffective or disproportionate.

These are design questions rather than conclusions about the precise wording of any future Bill. Their importance is that they connect regulatory ambition to the day-to-day realities of developers, institutions and the public.

The committee’s recommendation puts two competing concerns into sharper focus. One is that broad, costly or uncertain requirements could make it harder for local developers to build and commercialise AI products. The other is that an incomplete framework could leave important risks insufficiently addressed.

Those concerns should not be treated as mutually exclusive. A framework can support innovation while establishing safeguards, provided that the obligations are clear, risk-based and enforceable. Equally, the existence of a dedicated AI law would not guarantee effective protection if regulators lacked capacity or if responsibilities remained unclear.

Kenya’s National AI Strategy 2025–2030 sets out a wider ambition for AI development. The legislative challenge is to translate that ambition into governance arrangements that businesses can understand, public institutions can implement and citizens can rely on. The Senate committee’s recommendation has interrupted one proposed route towards that goal, but it has not settled the broader policy question.

The next steps will depend on how the national policy is finalised, whether lawmakers pursue a revised Bill and how government institutions address the gaps identified in the debate.

Kenya’s first AI Bill has hit a major roadblock. The harder work—deciding how to regulate AI in a way that protects the public, gives businesses predictable rules and strengthens local innovation, remains ahead.