By the NGOs.ke Editorial Team.
Does Kenya’s Artificial Intelligence Bill, 2026 apply to your NGO? Not yet. A Senate committee recommended on or around 15 October 2026 that the Senate not proceed with the Bill, so it is not law and has no commencement date. But the Data Protection Act, 2019 already governs how you use AI tools on beneficiary data today, and a national AI policy is expected next. This guide explains what the Bill proposed, why it stalled, and what Kenyan NGOs should do now.
What happened to the Artificial Intelligence Bill, 2026?
The Bill was sponsored by nominated Senator Karen Nyamu and introduced in the Senate in April 2026. According to The Star’s report of 15 October 2026, the Senate Information, Communication and Technology Committee, chaired by Trans Nzoia Senator Allan Chesang, concluded that the Bill regulates AI “too broadly, too early and too punitively”. The committee heard from 143 stakeholders, including government agencies, multinationals and civil society.
Its main objections were these:
- Penalties of up to Sh5 million, up to two years in prison, or both, were seen as disproportionate for small developers doing experimental work.
- The proposed Office of the AI Commissioner would overlap with existing regulators such as the Office of the Data Protection Commissioner (ODPC) and the Communications Authority of Kenya.
- The Bill did not adequately deal with foreign-built, cross-border and general-purpose AI systems, which is what most Kenyan organisations actually use.
The committee told the government to finalise a national AI policy first. The Ministry of ICT said the National Artificial Intelligence and Emerging Technologies Policy, 2026 was in its final stages. Techweez noted that the rejection was about the Bill’s approach, not about whether AI should be regulated at all.
What would the Bill have required of organisations using AI?
Even though it has stalled, the text shows where regulation is likely to head. Law-firm analyses by Cliffe Dekker Hofmeyr describe a risk-tiered design borrowed from the EU AI Act:
| Element | What the Bill proposed |
|---|---|
| Who is covered | Providers (developers who market a system) and deployers (anyone who puts a system into service under their authority). Personal end-users excluded. |
| Risk tiers | Unacceptable (banned), high, limited and minimal risk. High-risk examples include healthcare, education, finance, security and public administration. |
| High-risk duties | Human rights impact assessments, data protection impact assessments, human oversight, explainable decisions, and notifying affected people. |
| Regulator | An Office of the AI Commissioner with audit, inspection, register and fining powers. |
| Penalties | Administrative fines plus criminal penalties of up to KES 1 million or KES 5 million and up to six months or two years in prison, depending on the offence. |
For NGOs, the “deployer” role is the one that matters. A charity that uses an AI system to screen beneficiaries for cash transfers, triage health cases or flag safeguarding risks would likely have been a deployer of a high-risk system.
What does the draft national AI policy say?
The Ministry of Information, Communications and the Digital Economy published the draft Artificial Intelligence and Emerging Technologies Policy, 2026 for public comment, with submissions due by 4 August 2026, according to Bowmans. It is not legally binding, but it signals the direction. Points relevant to civil society include shared accountability between developers, deployers, vendors and users; incident reporting for AI failures and misuse; protections for children, vulnerable groups and workers; complaints and redress mechanisms; and transparency rules for synthetic media and deepfakes. It also proposes data localisation and domestic hosting for sensitive or critical systems, which could affect where you store beneficiary data.
Which rules already apply to NGOs using AI tools today?
The absence of an AI law does not mean a free-for-all. If you paste beneficiary details into a chatbot, use AI transcription on community meetings or run automated case scoring, you are processing personal data. That falls under the Data Protection Act, 2019, which also gives people rights around automated decision-making. Our guides on data protection compliance for NGOs in Kenya and ODPC registration fees and rules cover the baseline. Your donors’ safeguarding and data rules also still apply, so check them against the safeguarding policy guide.
How should a Kenyan NGO prepare now?
- List every AI tool your staff use. Include free chatbots, transcription apps, translation tools and any AI features inside your donor-management or survey software.
- Set a simple use policy. No personal data, photos of children or case notes in public AI tools. Name who approves new tools.
- Do a short data protection impact assessment for any tool that touches beneficiary data, and check whether the vendor stores data outside Kenya.
- Keep a human in the loop for any decision about who receives aid, services or jobs, and record how decisions were reached.
- Label AI-generated content and never create synthetic images of real beneficiaries.
- Watch the policy. Track the ministry’s final policy and any re-drafted Bill, and consider submitting comments through an umbrella body.
If your team needs affordable software to get started, see our list of free technology for Kenyan NGOs.
Frequently asked questions
Is the AI Bill in force in Kenya?
No. As of 19 October 2026 a Senate committee has recommended against proceeding with it, and the sources we reviewed give no commencement date or revised timetable.
Do Kenyan NGOs need to register their AI tools?
Not under any current AI law. The Bill proposed a public register of high-risk systems, but it has not passed. Data protection registration with the ODPC may still apply to your organisation as a data controller or processor.
Can we use ChatGPT or similar tools with beneficiary data?
Treat it as a high-risk step. Personal data should not go into public tools without a lawful basis, safeguards and, where needed, an impact assessment under the Data Protection Act.
What penalties did the AI Bill propose?
Serious offences carried fines of up to Sh5 million, up to two years in prison, or both. Those penalties are not in force.
What should NGOs do while the rules are unsettled?
Adopt a short internal AI policy, keep human oversight of decisions affecting people, and follow the ministry’s national policy process.
Last updated 19 October 2026. This article is general information, not legal advice; check current texts with a qualified Kenyan lawyer. For official policy documents, see the Ministry of Information, Communications and the Digital Economy.
Leave your comment