KenyaArtificial Intelligence Bill, 2026, high-risk system obligations
An AI risk obligations rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Self, Regulator
- Where the report goes
- Kept
What it requires
- Conduct a risk assessment and a human-rights impact assessment before deploying a high-risk system, and maintain human oversight of it.NIST AI RMFMAP 5.1NIST AI RMFMAP 3.5
- Keep records of data inputs, training datasets, outputs and performance metrics for at least five years.NIST AI RMFMEASURE 2.4
- Obtain explicit consent from a person, or their legal representative, before generating or manipulating their image, voice or likeness, and label the output as AI-generated.NIST AI RMFMAP 3.3NIST AI RMFMEASURE 2.8
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which systems count as a 'high-risk artificial intelligence system' for the duties in section 26(1), given that the definition turns on a system that 'poses significant risks to health, safety, fundamental rights, or societal welfare, as prescribed by regulations' while section 25(2)(b) describes high risk by reference to 'critical sectors'?
What it makes you log
What the log must hold
Input reference, Output reference, Data lineage
Logging duty
Section 26(1)(d) requires a provider or deployer of a high-risk artificial intelligence system to maintain records of data inputs, training datasets, outputs and performance metrics for at least five years. Section 26(1)(c) separately requires transparency, traceability and explainability of the system's decision-making processes. The Office's power to require the production of records sits in section 11(1)(b), which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- s. 26(1)(d)
- Trigger
- high_risk_systems
What this law does
This measure is the Senate bill numbered 4 of 2026, published in the Kenya Gazette on and read a first time in the Senate on .
As drafted, a provider or deployer of a high-risk system would have to conduct a risk assessment and a human-rights impact assessment before deployment, ensure transparency, traceability and explainability of the system's decision-making, keep records of training data and performance for at least five years, and obtain explicit consent before generating or manipulating a person's image, voice or likeness.
The Artificial Intelligence Commissioner would maintain a public register of high-risk systems, including those used by county governments.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or generates content with AI.
Back to the example · Lint your app
Page updated .