Kenya's National AI Strategy and Code of Practice expected to set foundation of AI regulation once finalized.
Laws/Regulations directly regulating AI (the “AI Regulations”)
There are currently no specific laws or regulations in Kenya that directly regulate AI.
Status of the AI Regulations
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI.
However, the Ministry of Information, Communications and The Digital Economy (ICT) is working with different stakeholders to spearhead the development of a National AI Strategy (the "AI Strategy"). The draft AI Strategy is currently being prepared and is expected to be finalized later this year.
In addition to the above, the Kenya Bureau of Standards (KEBS) published the Draft Information Technology Artificial Intelligence Code of Practice (the "Draft AI Code of Practice") on April 8, 2024.1 The Code was developed to help organizations develop, provide and use AI in a responsible way where the rights of citizens are not to be compromised in the course of developing AI systems. The Code is however still in draft form, and KEBS has invited members of the public to submit comments by June 13, 2024.2
The Robotics Society of Kenya also developed the Kenya Robotics and Artificial Intelligence Society Bill 2023 (the "Robotics and AI Bill3") with an aim to develop a framework that would regulate AI in Kenya. The Bill is still in draft form and has not been published in the Kenya Gazette. The Bill has also not received support from the Kenya government and has faced opposition from key private sector players and stakeholders.
Lastly, the Cabinet Secretary for ICT in 2019 established the Distributed Ledgers Technologies and Artificial Intelligence Taskforce (the "Taskforce"). The mandate of the Taskforce was to explore and analyze upcoming digital technologies that demonstrate great potential to transform Kenya's economy, including disruptive technologies that are currently shaping the global economy such as distributed ledger technologies (Blockchain and hashgraph), artificial intelligence (Al.), 5G wireless technology, and the internet of things. The Taskforce in its report noted that the challenge for regulation of AI is how to balance supporting innovation and competition while protecting customers, market integrity, financial stability, and human life.4
Other laws affecting AI
Some of the other laws that are expected to impact artificial intelligence include:
- The Data Protection Act, 2019 – This Act, inter alia, recognizes that every data subject has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning, or significantly affects, the data subject
- The Computer Misuse and Cybercrimes Act, 2018 – This Act, inter alia, provides for the protection of critical information infrastructure and creates obligations for owners or operators of a system designated as critical infrastructure. It will therefore apply to AI systems to the extent that they are considered to constitute critical information infrastructure
- Consumer Protection Act, 2012 – This law will be applicable to AI because of the need to ensure the protection of consumers who use AI products and systems
Definition of “AI”
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. None has been provided so far as there is no law in Kenya that defines "AI."
However, the Draft AI Code of Practice by KEBS, though it has not defined AI, has enumerated the three characteristics of AI which include:
- Built with the capabilities of an AI system that implements a model to acquire information and processes with or without human intervention by algorithm or programming
- Applies optimizations or inferences made with the model to augment decisions, predictions, or recommendations in a timely manner to meet specific objectives
- Updates and improvements made to the model, system, or application by evaluation of interaction outcomes5
In addition, the Robotics and AI Bill defines the term ‘artificial intelligence' to mean the ability of machines to perform tasks that are typically associated with human intelligence, such as learning and problem-solving.6
Territorial scope
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, it is expected that the AI Strategy and the Draft AI Code of Practice once finalized, will only be applicable in Kenya and will not have extra-territorial application. The Taskforce in its report however recognized that national AI regulations are likely to have transnational effects and can potentially cause cross-national conflicts.7
Sectoral scope
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. As such, there are no specific regulatory requirements that apply to the various sectors in Kenya.
Compliance roles
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, some of the roles provided under the Draft AI Code of Practice include an obligation for stakeholders to understand the ecosystem in which the AI systems will operate and ensure that risk management and security systems are in place.8
In addition, the Robotics and AI Bill seeks to require persons who carry out the business of a robotics and artificial intelligence (AI) society or association to register with the government explaining the relevant business activities that will be undertaken.9
Core issues that the AI Regulations seek to address
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. The core issues that are required to be addressed will become clearer once the AI Strategy and the Draft AI Code of Practice are finalized.
Risk categorization
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. Risk categorization is expected to become clearer once the once the AI Strategy and the Draft AI Code of Practice are finalized.
Key compliance requirements
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. However, the Draft AI Code of Practice provides that developers and stakeholders in the AI space must comply with and maintain high standards of transparency, accountability, security and privacy measures, risk management capacity and governance of the AI systems.10
Regulators
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. As such, there are no Regulators that oversee the development and use of AI in Kenya at present.
Enforcement powers and penalties
As indicated above, there are currently no specific laws or regulations in Kenya that directly regulate AI. The elements of enforcement and penalties have not been expressly developed.
1 See here
2 See here
3 See here
4 See here, p.42
5 See here, p.8 and 9
6 See here, p.5
7 See here, p.42
8 See here, p.11
9 See here, Article 21
10 See here
Jeffrey Shin (Trainee Solicitor, White & Case, London) and Cameron Lee (Trainee Solicitor, White & Case, London) contributed to this publication.
Bowmans contributors - Daniel Mwathe and Patrick Kamanthe
