Source: Business Daily Africa

Kenya is shifting AI governance from aspirational board principles to demonstrable evidence through the Artificial Intelligence Bill. The Bill, modelled closely on the EU AI Act, introduces a risk-based classification of AI systems from minimal to unacceptable and reserves the strictest duties for high-risk uses in sectors such as finance, healthcare and public administration. For high-risk systems, organisations are required to carry out pre-deployment impact assessments, evaluate human rights risks, explain automated decisions and retain records of system performance, inputs and outputs for up to five years. The proposal creates a new AI Commissioner empowered to inspect systems, issue compliance notices and impose penalties. Some specifics, including final risk classifications, will be set out in subsequent regulations, and even lower-risk systems are expected to face disclosure duties.

The piece warns enforcement could be slowed by regulatory resource constraints but stresses that regulatory delay is not a reason to defer compliance. The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has argued that Kenya's main issue is an accountability gap rather than absence of rules. Organisations are urged to maintain inventories of AI systems and classify them by risk, ensure systems can be independently audited for bias, accuracy and explainability, and assign accountability to a named executive who reports to the board’s audit or risk committee while aligning AI governance with existing laws. The article emphasises that customers may seek redress or withdraw business before regulators act, and that organisations cannot reconstruct five years of records after the fact.