What the Bill Would Have Created
Senator Karen Nyamu’s bill, gazetted February 19, 2026, was Kenya’s first serious attempt at comprehensive AI legislation. At its core were two new institutions: an Office of the Artificial Intelligence Commissioner, empowered to investigate violations, conduct audits, set standards and impose administrative sanctions, and a separate AI Authority intended to handle standard-setting and run regulatory sandboxes for startups to test products under supervision. The bill adopted a risk-based classification system, explicitly modeled in part on the EU’s AI Act, tiering AI systems from “unacceptable” to “minimal” risk and requiring pre-deployment impact assessments for anything classified high-risk.
Where the bill drew the most attention was its penalty structure. It proposed fines of up to KES 5 million, or alternatively a percentage of a company’s annual turnover, alongside criminal liability for specific offenses, most notably up to two years’ imprisonment for distributing harmful AI-generated deepfakes using someone’s likeness without consent. The same penalty tier applied to deploying prohibited AI systems or skipping required risk and workforce assessments.
Why the Committee Pulled the Plug
The committee’s reasoning centered on proportionality rather than principle. Its report states plainly that the combination of heavy fines, criminal exposure and ongoing compliance duties “would not just regulate the sector but actively discourage participation in it,” pushing local developers toward markets with lighter regulatory burdens. That concern lands differently in Kenya than it might in a larger, more capitalized market: Kenya’s AI ecosystem is described as dominated by small startups building on open-source tools for agriculture, health, lending and education, operating on thin margins and limited funding, precisely the kind of players least able to absorb compliance costs calibrated for far larger companies.
A useful comparison surfaced in the bill’s own legal analysis: the EU AI Act, which Kenya’s bill partly modeled itself on, uses turnover-based fines reaching up to 7% of a company’s global turnover for the most serious breaches. Kenya’s bill, by contrast, used a flat cap of KES 5 million regardless of company size, meaning a small Nairobi startup and a much larger operator would theoretically face the same ceiling, a structural mismatch that likely fed directly into the committee’s proportionality concerns.
A Gap the Rejection Doesn’t Close
Importantly, the committee wasn’t arguing against AI regulation itself. Its report and subsequent coverage are consistent on this point: the vote was a verdict on this bill’s specific design, not on whether Kenya needs AI-specific law. And that need remains real. With the bill shelved, Kenya currently has no dedicated AI legislation at all; existing tools like the Data Protection Act, 2019 offer only limited coverage, mainly around automated decision-making, and don’t meaningfully address AI safety, accountability, or deepfake-specific harms the rejected bill was built to cover.
The committee pointed to this gap directly in its reasoning, noting that current laws like the Science, Technology and Innovation Act and the Data Protection Act don’t adequately address how AI systems actually operate in Kenya. That leaves an open question the rejection doesn’t answer: what replaces the bill, and on what timeline.
What’s Already in Motion Instead
The timing here isn’t coincidental. Kenya’s Ministry of ICT informed the committee that a separate, parallel policy document, the National Artificial Intelligence and Emerging Technologies Policy, 2026, is already in its final stages of development. Unlike Nyamu’s bill, a policy document doesn’t carry the force of law or create enforceable penalties on its own, but it may be intended as groundwork that a future, better-calibrated bill could be built on. The committee’s own counter-proposal gestures in a similar direction: alongside rejecting the bill, it floated an AI Authority focused on standards and sandboxes alongside an Advisory Committee to guide government thinking on emerging risks, a lighter-touch structure than the enforcement-heavy Commissioner’s office the original bill proposed.
