Duty LXD-0102
Crawls the web, in Kenya
Each law's tag says when it binds: since in force proposed proposed
Computer Misuse and Cybercrimes Act, Reporting of Cyber Threatsince 2 lines
Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page
- Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
- Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
- This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
- Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
- This duty is in effect now and has applied since the Act commenced on ; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.
Computer Misuse and Cybercrimes Act, 2018, unauthorised accesssince 2 lines
Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018), s. 14 (unauthorised access) · Read the law's page
- Do not gain access to a computer system by infringing a security measure, knowing the access is unauthorised, including to copy, transfer or output data from it.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.
Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2025)proposed7 lines
Artificial Intelligence Bill, 2026, Senate Bills No. 4 of 2025 (Kenya); published in the Kenya Gazette ; read a First Time in the Senate ; committed to the Senate Standing Committee on Information, Communication and Technology; public-memoranda window closed ; not yet reported out of committee, read a Second Time, or passed by either chamber as of
- This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Disclose to users the nature, purpose, and extent of automated decision-making, along with bias-mitigation measures.
- Label deepfakes and AI-generated content resembling real persons.
- Do not use a person's image or likeness without their consent.
- Incorporate human-in-the-loop oversight for consequential decisions made by high-risk and critical AI systems.
- Provide affected persons a plain-language explanation of consequential automated decisions.
- Provide affected persons a mandatory human review of consequential automated decisions.