The rapid adoption and integration of artificial intelligence (AI) into critical spheres of our daily living has prompted calls for regulation not just to preserve innovation but also manage the attendant risks.
Whereas Kenya currently has no AI-specific legislation, there is a slow but steady move to develop policies around AI even as the relevant stake-holders beef up existing laws to regulate risky aspects of AI. To demonstrate this point:
- Kenya has a Draft AI Code of Practice (April 2024) authored by Kenya Bureau of Standards, advocating for responsible AI development to protect citizens’ rights; and,
- More recently in March 2025, the Kenyan government launched a National AI Strategy 2025–2030, which calls for a framework of AI adoption in critical sectors, including agriculture, healthcare, education and public services, pegged on three thematic pillars of “AI Infrastructure, Data, and AI Research,” and underpinned by governance, ethical AI, talent and investment.
In practice, Kenya relies on existing laws to address AI risks, for example:
- The Data Protection (General) Regulations, 2021.
- Kenya’s Computer Misuse and Cybercrimes Act (2018)
- The Consumer Protection Act (2012)
Acknowledging the inadequate regulatory framework, Kenyan courts in 2020 paused the rollout of a national biometric ID program (Huduma Namba) due to inadequate privacy safeguards, reasoning that the legal framework for collecting sensitive biometric data; fingerprints, face-scans, DNA was ‘inadequate and totally wanting’.
AI in the Finance Sector
In Kenya, fintech is very advanced with the likes of M-Pesa. The Central Bank of Kenya (CBK) encourages innovation. Nonetheless, Kenya faces the familiar dilemma, because while encouraging innovation, there ought to be a guard against potential harm. The 2019 Distributed Ledger and AI Taskforce noted this imbalance, stating that regulators must support innovation and competition while protecting customers, market integrity, financial stability, and human life.
In response to this clarion call, we have seen the CBK publish occasional fintech guidelines (for example, for digital loans, cybersecurity, etc), but this is hardly sufficient. A notable lacunar is noted that while Kenyan banks use basic AI (chatbots, fraud detection), presumably under existing banking regulations for capital adequacy and cybersecurity, there is no local law on algorithmic transparency in finance. Regardless, Kenyan financial institutions must protect consumer data under the Data Protection Act.
In sum, whereas we applaud efforts by development agencies funding AI research in finance, suggesting a future where Kenya might tailor regulations for AI usage, the Kenyan finance sector should currently treat AI models as they would any other software; requiring proper testing, audit trails, and recourse processes, guided by prudential regulations.
In our next article, we shall dive deeper into AI and the Criminal Justice system.
Faith Kariithi
Lawyer
Samuel Aywa
Managing Partner
Add a Comment