Duty LXD-4424
Deploys a mental-health chatbot, in Kenya
Each law's tag says when it binds: since in force proposed proposed
Computer Misuse and Cybercrimes Act, Reporting of Cyber Threatsince 2 lines
Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page
- Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
- Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
- This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
- Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
- This duty is in effect now and has applied since the Act commenced on ; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.
Artificial Intelligence Bill, 2026, transparency, disclosure and synthetic-media labellingproposed3 lines
Artificial Intelligence Bill, 2026 (Senate Bills No. 4), ss. 28, 35(1)(i) (transparency and safeguards; synthetic-media offence) · Read the law's page
- Disclose to users and affected persons the nature, purpose and limitations of your system, the extent to which decisions or outputs are automated, and your bias-mitigation measures.
- Where your system's automated decisions produce significant legal or similar effects on a person, provide safeguards under the Data Protection Act, including the right to human intervention, to express views and to contest the decision.
- Do not generate, deploy or distribute synthetic media using a person's image, voice or likeness without their explicit consent where it is likely to cause harm, misinformation, defamation or an invasion of privacy.
Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2025)proposed7 lines
Artificial Intelligence Bill, 2026, Senate Bills No. 4 of 2025 (Kenya); published in the Kenya Gazette ; read a First Time in the Senate ; committed to the Senate Standing Committee on Information, Communication and Technology; public-memoranda window closed ; not yet reported out of committee, read a Second Time, or passed by either chamber as of
- This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Disclose to users the nature, purpose, and extent of automated decision-making, along with bias-mitigation measures.
- Label deepfakes and AI-generated content resembling real persons.
- Do not use a person's image or likeness without their consent.
- Incorporate human-in-the-loop oversight for consequential decisions made by high-risk and critical AI systems.
- Provide affected persons a plain-language explanation of consequential automated decisions.
- Provide affected persons a mandatory human review of consequential automated decisions.