KenyaArtificial Intelligence Bill, 2026, transparency, disclosure and synthetic-media labelling
An AI transparency rule binding public and private bodies.
What it requires
- Disclose to users and affected persons the nature, purpose and limitations of your system, the extent to which decisions or outputs are automated, and your bias-mitigation measures.
- Where your system's automated decisions produce significant legal or similar effects on a person, provide safeguards under the Data Protection Act, including the right to human intervention, to express views and to contest the decision.
- Do not generate, deploy or distribute synthetic media using a person's image, voice or likeness without their explicit consent where it is likely to cause harm, misinformation, defamation or an invasion of privacy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
As drafted, generating, deploying or distributing harmful synthetic media without consent would carry a fine of up to KES 5,000,000 or imprisonment of up to two years, or both (s. 35(2)(a); the Bill's own text at that clause cross-refers to itself as 'section 34', a drafting artifact, but the printed clause carrying the offences and this penalty is numbered 35).
Penalty structure
As drafted (s. 35(2)(a)). The same subsection also allows imprisonment of up to two years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 5,000,000
Who enforces it
Settledness
- As of
- Open questions
- Which penalty applies to a failure to comply with the disclosure duties in section 28, given that section 35(1)(c) makes it an offence and section 35(2)(b) sets the lower penalty for 'an offence under section 34(c), (f) or (h)', although section 34 is the public-sector provision and the offences are listed in section 35(1)?
What it makes you log
Logging duty
Section 28(3) requires a provider of a high-risk artificial intelligence system to submit annual compliance reports to the Artificial Intelligence Commissioner and to make the non-confidential information in them public. The clause names no log or record, but an annual report on compliance cannot be produced without a kept record of it. The disclosure duties in section 28(1) and the consent offence in section 35(1)(i) require no record.
- Kind
- Implicit
- As of
- Provision
- s. 28(3)
- Trigger
- high_risk_systems
What this law does
This measure is the Senate bill numbered 4 of 2026, published in the Kenya Gazette on and read a first time in the Senate on . As drafted, a provider or deployer of any artificial intelligence system would have to disclose to users and affected persons its nature, purpose and limitations, the extent to which its outputs are automated, and its bias-mitigation measures, and a provider of a high-risk system would have to submit annual compliance reports.
A user of an artificial intelligence system whose automated decisions produce significant legal or similar effects on a person would have to comply with the Data Protection Act by providing safeguards including the right to human intervention, to express views and to contest the decision.
Generating, deploying or distributing synthetic media using a person's image, voice or likeness without their explicit consent, in a way likely to cause harm, misinformation, defamation or an invasion of privacy, would be an offence carrying a fine of up to KES 5,000,000 or imprisonment of up to two years, or both.
When LexLint raises it
When your app profile says your app generates content with AI, deploys a chatbot or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .