Flagship sector · Sector consultancy
Kenya now has a national AI strategy, an active data protection regulator, a contested cybercrimes law and an AI bill before the Senate. Institutions that automate decisions or hold personal data face binding and tightening obligations. We help leaders govern technology with evidence, meet the law and prove that digital services work.
The policy environment
Kenya's technology governance rests on a small number of statutes that now carry real weight. The Data Protection Act, 2019 and its 2021 regulations require registration with the Office of the Data Protection Commissioner, impact assessments for high-risk processing and safeguards on automated decisions. The Kenya Artificial Intelligence Strategy 2025-2030, launched in March 2025, sets three pillars, digital infrastructure, data, and research and innovation, supported by governance, talent, investment and ethics. It sits within the Kenya National Digital Master Plan 2022-2032. The strategy itself records that Kenya has no AI-specific law. The Artificial Intelligence Bill, 2026, a Senate bill listed for second reading by June 2026, would create an AI Commissioner and a risk-tiered regime.
Enforcement and litigation are shaping obligations faster than legislation. The Data Commissioner has issued hundreds of determinations, enforcement notices and compensation orders, and in May 2025 the High Court ordered Worldcoin to delete biometric data collected without an adequate impact assessment under section 31 of the Act. The Computer Misuse and Cybercrimes (Amendment) Act, 2025 widened investigative powers and duties on service providers, but in July 2026 the High Court struck down its website-blocking power and its expanded cyber harassment offence. In finance, the Central Bank of Kenya surveyed AI use in 2025, found most institutions without an AI strategy, and in September 2026 opened consultation on revised prudential guidelines and guidance notes, including a draft note on AI in banking.
Digital public infrastructure is expanding through eCitizen, the Maisha Namba unique personal identifier and the Digital Health Act, 2023, whose 2025 regulations govern health information management and data exchange and build on the Act's requirement for county health data banks. A 2025 special audit by the Auditor-General questioned the traceability of eCitizen payments, and the data-sharing terms of the December 2025 Kenya-United States health cooperation framework remain before the courts. The draft National Data Governance Policy, consulted on in 2026, proposes data officers in every ministry, agency and county and a national data marketplace. The Technopolis Act, 2026 turns Konza's authority into a national Technopolis Development Authority. For counties, the question is no longer whether to digitise but how to govern what they hold.
Where the pressure is
Reviewed October 2026. Each pressure traces to a law, a policy or a ruling set out below.
The Artificial Intelligence Bill, 2026 proposes an Office of the AI Commissioner, a ban on unacceptable-risk systems, and impact assessments, registration and human oversight for high-risk uses in health, education, finance, security and public administration. Institutions that inventory their systems and document their decisions now will absorb the law at lower cost, whatever its final form.
The Data Commissioner now issues determinations, penalty notices and compensation orders, and the courts have treated a missing impact assessment as fatal, as in the May 2025 Worldcoin judgment. Boards need to know which processing requires an assessment, whether their registration is current and how quickly a breach can be reported.
The July 2026 High Court judgment removed the website-blocking power and the expanded cyber harassment offence introduced in 2025, while the rest of the amendment stands. Public institutions and service providers need clear advice on which obligations bind them and how to handle investigators' data requests lawfully.
CBK's 2025 survey found credit risk assessment to be the leading use of AI among respondents, and most institutions without an AI strategy. Lenders now face explicit expectations on human oversight, explainability and bias, and CBK's consultation on revised guidelines and guidance notes, including a draft note on AI, runs to 7 November 2026.
Counties must operate health data banks and integrate facility systems under the Act and its 2025 regulations, while litigation over data sharing under the Kenya-United States health cooperation framework continues. Ministries, counties and partners need evidence that digital health systems protect patients and improve care.
The draft National Data Governance Policy proposes data officers in every county and a paid marketplace for anonymised government data, and the Auditor-General's 2025 special audit questioned the traceability of eCitizen payments. Accounting officers will be asked to show who holds which data, on what lawful basis and under what controls.
Laws, plans and institutions
The Acts and regulations that create obligations, the policies and programmes that set direction, and the institutions that hold the mandate.
Who does what
How the Fourth Schedule of the Constitution of Kenya, 2010 divides the sector between the national government and the 47 county governments.
What we offer
Each service has a defined scope, method, timeline and set of deliverables, and can be tailored to your institution.
AI readiness assessments and adoption strategies for ministries, state agencies and counties, aligned to the Kenya Artificial Intelligence Strategy 2025-2030 and Kenyan law.
See the serviceRegistration, impact assessments, data governance and breach readiness under the Data Protection Act, 2019 for public bodies, counties and regulated firms.
See the serviceModel risk and AI governance frameworks for banks, SACCOs, insurers and lenders, built to meet Central Bank of Kenya, SASRA and IRA expectations.
See the serviceIndependent audits of automated decision systems and the vendors behind them, testing legality, accuracy, fairness, security and contract terms.
See the serviceIndependent evaluation and indicator verification of digital public services, from digital health systems to eCitizen-type platforms, measuring uptake, quality, inclusion and value.
See the servicePractical AI and data training for senior officials, county executives and boards, grounded in Kenyan law, the national AI strategy and real decisions.
See the serviceOur work in this sector
| Year | Client | Engagement | Practice |
|---|---|---|---|
| 2025 | PATH International | Digital Health Pilot Indicator Verification, Maternal Care | Digital Health M&E |
Key references
Policy environment reviewed October 2026. Laws, regulations and programmes change; consult the official text before relying on any summary here.
Technology, Data and AI
Tell us what you need to decide and by when. We will set it against the law, policy and budget realities of the sector and propose the work.