3 min read428 words
Yes — as drafted, Kenya's Artificial Intelligence and Other Emerging Technologies Policy 2026 applies to foreign AI providers whose systems are procured, accessed, or deployed in Kenya, or whose outputs have direct and foreseeable effects there, regardless of where the provider is based. This effects-based approach mirrors the extraterritorial reach of the EU's GDPR and AI Act.
What triggers the policy's reach
The framework would apply not only to AI systems developed and deployed within Kenya, but to foreign AI providers and related service providers whose systems are procured, accessed, deployed or relied upon in Kenya, or whose outputs have direct and foreseeable effects within the country.
Software vendors, cloud service providers, compute providers, AI model developers, data intermediaries, data annotation providers and public-sector technology suppliers with any footprint touching Kenya are captured under this framing — jurisdiction is defined by where an AI system's outputs land, not where the company is registered.
Is there any relief for companies already regulated elsewhere?
The draft policy proposes recognising compliance with substantially equivalent foreign regulatory regimes, subject to an adequacy assessment carried out by the Cabinet Secretary under criteria still to be established through future regulations. That relief is not automatic, and the equivalence criteria don't exist yet.
What this means for your business right now
The policy remains in draft form, open for public comment until 4 August 2026 — its final scope and the detail of the equivalence framework are both still being shaped. For Kenyan businesses exporting AI-enabled services, and international businesses using Kenya as a delivery location, this is a moment to understand the direction of travel and plan ahead of it, not a finalised compliance obligation to act on today.
Frequently asked questions
- Is Kenya's Draft AI Policy legally binding yet?
- No. It is a policy document, not legislation, and remains open for public comment until 4 August 2026. Related legislative reforms would still be needed to give it full legal force.
- Who does the extraterritorial scope cover?
- Foreign AI providers, cloud and compute providers, AI model developers, data intermediaries, and data annotation providers whose systems are used in Kenya or have foreseeable effects there.
- How is this different from a company just following its home country's AI rules?
- The draft policy proposes recognising 'substantially equivalent' foreign regimes, but only after a Cabinet Secretary adequacy assessment under criteria not yet published.
Talk to Gallant before you make the decision
Not only after something goes wrong. If this raises a question specific to your business, we're glad to talk it through.
This article is general legal information, not legal advice, and does not create a lawyer–client relationship.