Inside Karen Nyamu's Artificial Intelligence Bill

The AI Bill 2026 risks importing not just good ideas, but also the burdens that come with regulating far more advanced economies. [iStockphoto]

A university student in the country using Artificial Intelligence (AI) to write code or launch a small digital project may soon find themselves caught in regulations designed for billion-dollar tech companies. That tension, between protection and progress, is at the heart of the Kenya Artificial Intelligence Bill, 2026.

Kenya is not new to technological leaps. We have seen what happens when the right conditions meet local ingenuity. The rise of M-Pesa transformed how millions transact, save, and build businesses. Today, AI presents a similar opportunity. From fraud detection in mobile money to diagnostic tools in hospitals and chatbots for farmers, AI is quietly embedding itself into everyday life.

It is therefore right that policymakers are paying attention. The Bill, sponsored by Senator Karen Nyamu, proposes a structured approach to governing AI, including a new oversight office, risk-based classification of AI systems, and penalties for harmful uses such as non-consensual deepfakes. On paper, it signals ambition. It suggests Kenya wants to lead, not follow.

But ambition alone is not enough. The real question is whether the Bill understands the stage Kenya is at.

Most AI systems in use locally are not being built from scratch in Nairobi or Eldoret. They are adapted; imported models tweaked to solve Kenyan problems. A startup helping farmers predict crop yields, for instance, is not operating at the same scale or risk level as a multinational deploying facial recognition systems across continents. Treating them as if they are the same would be a mistake.

That is where the current draft begins to wobble. In borrowing heavily from frameworks like the EU AI Act, the Bill risks importing not just good ideas, but also the burdens that come with regulating far more advanced economies. In Europe, even well-resourced companies have raised concerns about the cost and complexity of compliance. For smaller players, those costs can be crippling.

Kenya’s innovation ecosystem is still young. It does not need to be shielded from competition; it needs room to grow.

This does not mean abandoning regulation. Some risks are real and immediate. Deepfakes, for example, are not theoretical threats. In a country where elections are often contested and public trust in information is fragile, manipulated media could do serious damage. The Bill is right to take a firm stance here.

But firmness in high-risk areas should not translate into blanket rigidity.

Startups working on low-risk applications: Tools for agriculture, small-scale analytics, or customer service automation; should not face the same compliance expectations as large corporations. A more proportionate approach would make this explicit. For instance, startups below Sh100 million in turnover could be exempted from full compliance audits, facing only simplified disclosure requirements. Without such distinctions, regulation may unintentionally favour established players while locking out the very innovators Kenya hopes to nurture.

One of the most promising elements of the Bill is the idea of regulatory sandboxes. These controlled environments allow developers to test AI systems under supervision before releasing them more widely. If implemented well, they could become a powerful engine for local innovation.

But that outcome is not automatic.

For sandboxes to work in Kenya’s context, they must actively support local participation. That means prioritising Kenyan-led projects, reducing entry costs, and creating clear pathways from experimentation to market deployment. Institutions such as Konza Technopolis Development Authority could play a central role in linking these efforts to funding, mentorship, and infrastructure. Otherwise, sandboxes risk becoming another bureaucratic layer rather than a launchpad for new ideas.

Another issue the Bill cannot afford to sidestep is data.

Across the developing world, there is growing unease about how global AI systems are built. Local data such as languages, behaviours, cultural patterns; is often harvested, processed, and monetised elsewhere, with little benefit returning to the communities it came from. Kenya is not immune to this dynamic.

If AI is to contribute meaningfully to the local economy, the country must think seriously about data sovereignty. At a minimum, foreign AI providers should be required to conduct local impact assessments before deploying systems trained on Kenyan data. Beyond that, policymakers should explore ways to encourage local data ownership, whether through cooperatives, trusts, or other models that ensure value is shared more equitably.

Regulation, however, is only one piece of the puzzle.

The future of AI in Kenya will depend just as much on people as on policy. Without a skilled workforce, even the best-designed frameworks will struggle to deliver results. Universities need stronger programmes in AI and data science. Young developers need access to computing resources. And public institutions must be willing to adopt local solutions, creating demand that sustains the ecosystem.

Other countries have recognised this sequencing. India, for example, has placed significant emphasis on building digital capacity and infrastructure before tightening regulatory controls. Kenya would do well to take a similar view: Build first, regulate smartly, and adjust as the ecosystem matures.

There is also an opportunity for government to lead by example. If public agencies adopt AI responsibly for instance in ensuring transparency, human oversight, and accountability, they can set standards that ripple across the private sector. Done right, this could turn the state into a driver of ethical innovation rather than simply an enforcer of rules.