By 
Lawmakers say the Sh5 million fines and a proposed "super regulator" could push local developers out of the country. The Ministry of ICT says its own AI policy is nearly done.
A Senate committee has recommended that the Senate abandon the Artificial Intelligence Bill, 2026, concluding that the proposed law would burden Kenya's young technology sector with penalties and institutions it is not yet ready to carry. The report, tabled by the Senate Information, Communication and Technology Committee chaired by Trans Nzoia Senator Allan Chesang, was reported by The Star on 15 October 2026.
The bill is sponsored by nominated Senator Karen Nyamu and would have been Kenya's first comprehensive law on the development, deployment and use of artificial intelligence. The committee's recommendation is that the Senate "does not proceed" with it.
What the committee found
The committee based its conclusion on submissions from 143 stakeholders, a pool that included government agencies, multinational technology companies, professional associations, civil society groups and individual citizens.
Its central finding is that the bill, in the committee's words, may regulate AI "too broadly, too early and too punitively" for the current stage of Kenya's digital ecosystem. Beyond that headline objection, the report raises several specific concerns:
Penalties. Serious offences under the bill carry fines of up to Sh5 million, imprisonment of up to two years, or both. The committee found these disproportionate to the activities of many local developers, whose work it described as experimental, non-commercial and aimed at improving local access to technology rather than causing harm.
Developer flight. The report warns that heavy regulation could lead innovators to relocate their operations and intellectual property to jurisdictions with friendlier rules, undermining the country's ambition to become a regional technology hub.
A concentration of power. Stakeholders flagged the Office of the Artificial Intelligence Commissioner as a "Super Regulator." The committee observed that the office would hold administrative, supervisory, enforcement and quasi-judicial powers at once, raising the prospect of conflict with the Office of the Data Protection Commissioner and the Communications Authority of Kenya.
Cost. The report questions the fiscal implications of creating additional public institutions at a time of pressure to contain government spending.
Gaps in scope. The committee faulted the bill for not adequately addressing cross-border AI systems, general-purpose AI models and emerging risks.
Why the foreign-model problem matters
The committee's point about cross-border systems goes to the heart of how AI is actually used in Kenya. The report notes that the country mainly uses AI systems built by foreign technology companies, which makes a centralised national enforcement framework hard to apply in practice.
That finding echoes a concern we reported in April, when the bill was first examined in detail. Most Kenyan AI developers do not train foundation models from scratch. They adapt open-source models built abroad for local uses such as Swahili-language chatbots, agricultural diagnosis and fraud detection. A requirement to document how a model was trained, and to face criminal liability for failing to do so, would fall on developers who never made the training decisions in the first place.
Legal reviews published earlier this year described the compliance load in similar terms. Law firm Bowmans noted that providers and deployers of high-risk systems would face pre-deployment risk assessments and human rights impact assessments, explainability obligations, and a duty to keep records of data inputs, outputs and performance metrics for at least five years. The Commissioner would also have powers to enter premises, inspect AI systems, issue enforcement notices and impose administrative fines.
Industry positions
Microsoft Kenya, one of the companies that submitted a memorandum, proposed placing AI regulatory functions inside existing institutions rather than creating a standalone office. Google and Safaricom raised concerns about the bill's definitions and the regulatory obligations it would impose. The reports reviewed do not publish those submissions in full.
How the bill got here
The bill was published in the Kenya Gazette Supplement as a Senate Bill dated 19 February 2026, with Senator Nyamu's memorandum dated 13 February. It received its first reading on 2 April and was committed to the Standing Committee on ICT, which then opened a period of public input.
We previously reported that the legislation was a response to a 6 February High Court order on an urgent petition arguing that the absence of AI safeguards threatens rights such as privacy and equality. Senator Nyamu has also publicly cited AI-generated harassment of women in politics as a motivation.
The bill used a risk-based model that drew on the European Union's AI Act. Its lowest tier required chatbots to tell users they are interacting with a machine. It created rights to an explanation, human review and challenge for people affected by automated decisions. It also made it an offence to generate or distribute AI content using someone's image, voice or likeness without consent where the result is misinformation, harm, defamation or reputational damage, and it required AI-generated content resembling real people, places or events to be labelled.
Critics raised concerns about the bill's reach into political speech. Writing for Tech Policy Press, one analysis argued the labelling rule and deepfake offences needed an explicit exemption for satire and civic commentary, in line with the freedom of expression protections in Article 33 of the Constitution.
The bill also reached the Senate while the Ministry of ICT and the civil society group KICTAnet were running multi-stakeholder consultations on a national AI policy. That sequencing was criticised at the time as a sign that the legislation was getting ahead of the policy meant to guide it.
The policy track
The committee's preferred route is to finish the national policy first. The Ministry of ICT told the committee that the National Artificial Intelligence and Emerging Technologies Policy, 2026 is in its final stages.
The draft policy was opened for public comment by ICT Cabinet Secretary William Kabogo on 28 July 2026, with submissions closing on 4 August. It follows the Kenya Artificial Intelligence Strategy 2025 to 2030 and sets out a national framework for governing, developing and deploying AI across sectors. Bowmans observed that the draft takes a risk-based approach, has a broad extraterritorial reach, and does not itself create legally binding obligations. It is also expected to lay the groundwork for later legislation.
That distinction matters for how the two instruments compare. The bill would have made obligations enforceable through fines and prison terms. The policy, as drafted, signals direction and leaves binding rules to future statutes and regulations.
The case that was made for moving faster
Not everyone argued for restraint. A study reported by the Kenya News Agency found that 77 percent of Kenyans rely on social media for political information, and warned that unchecked AI-generated misinformation could threaten the credibility of the 2027 General Election. The study urged the government to fast-track the AI Bill. The election is now 298 days away.
The bill's deepfake and disclosure provisions were its most direct answer to that risk. The reports reviewed describe the committee's reasoning on penalties, institutional design and cross-border enforcement, but do not detail how the committee treated the deepfake and labelling clauses specifically.
What happens next
A committee report is a recommendation. The Senate must still consider it, and the House can adopt or reject the committee's position. Bowmans also noted earlier this year that because the bill touches on county governments, it would need to pass through the National Assembly as well before reaching the President for assent.
For now, Kenya has no dedicated AI statute. Existing obligations on automated systems come mainly from the Data Protection Act, 2019, which the bill itself tied into its requirements for high-risk systems. The final policy, once published, will show how much of the bill's content the government intends to carry into future law.
Comments