Why AI Ethics and Governance Matter Now
Artificial intelligence is no longer a future technology in Kenya, it is an operational reality. Banks are using AI for credit scoring, hospitals are deploying AI-assisted diagnostics, telecoms operators are optimising networks with machine learning, and government agencies are exploring AI for citizen service delivery. With this rapid deployment comes a corresponding need for ethical governance frameworks that ensure AI systems are fair, transparent, accountable, and aligned with Kenyan values and legal requirements.
The urgency is not abstract. In 2024 and 2025, several high-profile AI governance failures made global headlines, biased lending algorithms, AI-generated misinformation, and privacy breaches through AI systems processing personal data without adequate safeguards. Kenya is not immune to these risks. In fact, the application of AI systems trained on non-African data to Kenyan populations introduces unique bias risks that require locally informed governance approaches.
This article examines the global AI ethics landscape as it applies to Kenya, the country's evolving regulatory framework, sector-specific concerns, international standards being adopted locally, and what all of this means for data centre operators and technology companies.
The Global AI Ethics Landscape and Kenya's Position
Bias in AI Systems: The African Data Problem
The most fundamental ethical challenge for AI in Kenya is data representation. The large language models and machine learning systems that organisations deploy are overwhelmingly trained on datasets from North America, Europe, and parts of Asia. African data, cultures, languages, and socioeconomic contexts are significantly underrepresented.
This gap has concrete, harmful consequences:
- Facial recognition systems trained primarily on lighter-skinned faces show significantly higher error rates for darker-skinned individuals, a well-documented problem that directly affects Kenyans.
- Natural language processing models perform poorly on Kiswahili, Sheng, and Kenya's many vernacular languages, leading to misinterpretation of user intent.
- Credit scoring algorithms trained on Western financial behaviour patterns may penalise Kenyans for perfectly normal local financial practices, such as relying on mobile money, informal savings groups (chamas), or seasonal income.
- Healthcare AI trained on European or American patient populations may produce inaccurate risk assessments for Kenyan patients with different genetic profiles, disease prevalence, and healthcare access patterns.
Addressing these biases requires not just technical solutions (better training data, model fine-tuning) but governance structures that identify, assess, and mitigate bias before AI systems reach production.
Privacy and Personal Data Processing
AI systems are voracious consumers of data. Large language models, recommendation engines, and predictive analytics tools process vast quantities of personal information. In Kenya, this intersects directly with the Kenya Data Protection Act and data centres, which establishes principles of data minimisation, purpose limitation, and lawful processing.
The tension between AI's appetite for data and data protection principles is one of the central governance challenges of our time. An AI model that delivers better results with more data is simultaneously a model that may violate data protection law by collecting more personal information than necessary for its stated purpose.
Transparency and Explainability
When an AI system makes a decision that affects a person's life (denying a loan, flagging a transaction as fraudulent, or recommending a medical treatment) that person has a legitimate interest in understanding why. The principle of algorithmic transparency requires that AI systems be explainable in terms that affected individuals and oversight bodies can understand.
This is technically challenging. Deep neural networks, the architecture behind most modern AI systems, are inherently opaque. The field of explainable AI (XAI) is developing tools to address this, but Kenya's regulatory framework does not yet specify what level of explainability is required for different types of AI-assisted decisions.
Kenya's Evolving Regulatory Framework
The Kenya Data Protection Act 2019
The DPA remains Kenya's most significant piece of legislation relevant to AI governance, even though it was enacted before the current generative AI wave. Several provisions have direct AI implications:
-
Section 25 (Automated Decision-Making): The DPA states that a data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. This provision directly applies to AI-driven credit scoring, insurance underwriting, and employment screening systems. Organisations must provide meaningful information about the logic involved and the significance and envisaged consequences of such processing.
-
Section 48 (Cross-Border Data Transfers): Sending data to foreign AI APIs triggers cross-border transfer requirements, including adequacy assessments and appropriate safeguards. The Office of the Data Protection Commissioner (ODPC) has been increasingly active in enforcing these provisions.
-
Data Protection Impact Assessments (DPIAs): The ODPC requires DPIAs for high-risk processing activities. AI systems processing personal data at scale (particularly in sensitive sectors) will typically trigger DPIA requirements.
The Proposed National AI Strategy
Kenya has been developing a national AI strategy, drawing on input from the ICT Authority, the Ministry of Information, Communications and the Digital Economy, academia, and the private sector. While the final strategy has not been formally enacted as of mid-2026, key themes from consultation drafts include:
- Establishing a national AI governance body or designating an existing institution to coordinate AI policy
- Developing sector-specific AI guidelines for high-risk applications in banking, healthcare, and government services
- Creating AI ethics requirements for public sector AI procurement
- Investing in AI governance capacity building through training and institutional development
- Promoting Kenyan representation in global AI governance forums
The proposed strategy draws heavily on international frameworks, particularly the UNESCO Recommendation on the Ethics of Artificial Intelligence, which Kenya endorsed.
The ICT Authority's Role
The ICT Authority, which falls under the Ministry of Information, Communications and the Digital Economy, is the government body most directly involved in shaping Kenya's AI governance approach. Its responsibilities include developing ICT standards, advising government on technology policy, and overseeing e-government initiatives. As AI becomes central to government service delivery, the ICT Authority's role in AI governance is expected to expand significantly.
The Communications Authority of Kenya (CA)
The CA regulates Kenya's telecommunications sector, including the deployment of AI in telecommunications services. As Safaricom, Airtel Kenya, and other operators increasingly use AI for network optimisation, customer service, and fraud detection, the CA's oversight of AI-enabled services is growing. The CA has signalled that it will develop specific guidelines for AI use in regulated telecoms services, focusing on consumer protection, transparency, and service quality.
Sector-Specific AI Governance Concerns
Banking and Financial Services
Kenya's banking sector, regulated by the Central Bank of Kenya (CBK), is one of the most active adopters of AI. The CBK has issued guidance on the use of technology in financial services, including expectations around algorithmic lending:
- Fair lending: Banks using AI for credit decisions must ensure that algorithms do not discriminate against protected groups. The CBK has indicated that algorithmic fairness audits may become a regulatory requirement.
- Explainability: Borrowers have a right to understand why a loan application was approved or denied. AI systems used for credit scoring must provide explanations that meet CBK's standards.
- Model risk management: CBK's prudential guidelines require banks to manage model risk, including AI and machine learning models. This includes model validation, ongoing monitoring, and governance over model changes.
The Central Bank's approach is informed by international standards from the Basel Committee on Banking Supervision and the Financial Stability Board, which have both issued guidance on AI in financial services.
Healthcare
AI in Kenyan healthcare (from diagnostic imaging AI to clinical decision support systems) raises particularly acute ethical concerns because the stakes involve human health and life. Key governance issues include:
- Clinical validation: AI diagnostic tools must be validated on Kenyan patient populations before deployment. A model trained on European radiology data may not perform accurately on Kenyan patients.
- Patient data protection: Medical records are classified as sensitive personal data under the DPA, requiring the highest level of protection. AI systems processing this data must implement strict access controls, encryption, and audit logging.
- Professional accountability: When an AI system assists or influences a clinical decision, the accountability framework must be clear. The Kenya Medical Practitioners and Dentists Council is developing guidance on the use of AI in clinical practice.
Telecommunications
Telecoms operators using AI for network optimisation, customer analytics, and fraud detection must navigate both the CA's regulatory framework and the DPA. Specific concerns include:
- Subscriber data: AI systems analysing call patterns, location data, and usage behaviour for network optimisation must comply with purpose limitation principles. Data collected for network management cannot be repurposed for marketing or profiling without additional consent.
- AI-driven pricing and offers: When AI determines which mobile plans or promotions are offered to specific subscribers, fairness and transparency requirements apply.
- Real-time surveillance concerns: AI-powered network monitoring systems must be designed with safeguards against misuse for surveillance of individuals or communities.
International Frameworks Shaping Kenyan AI Governance
UNESCO's Recommendation on the Ethics of AI
Adopted in November 2021, the UNESCO Recommendation on the Ethics of Artificial Intelligence is the first global standard on AI ethics. Kenya endorsed the recommendation and has referenced it in developing its national approach. The UNESCO framework emphasises proportionality, do no harm, safety and security, right to privacy, transparency, explainability, responsibility, accountability, and awareness.
The African Union's Continental AI Strategy
The African Union Continental AI Strategy, adopted in 2025, provides a pan-African framework for AI development and governance. It emphasises:
- Africa-owned AI development that serves African priorities rather than importing foreign AI systems without adaptation
- Data sovereignty as a continental priority
- Capacity building for AI governance across AU member states
- Inclusive AI that addresses rather than exacerbates inequality
- Regional harmonisation of AI regulations to create a unified African approach
For Kenya, the AU strategy reinforces the importance of developing local AI governance capacity rather than relying solely on imported regulatory models.
The EU AI Act and Its Extraterritorial Reach
The EU AI Act, which entered into force in August 2024 and is being phased in through 2027, is the world's most comprehensive AI regulation. Its extraterritorial provisions mean that it applies to providers and deployers of AI systems outside the EU when the systems' outputs are used within the EU.
This has direct implications for Kenyan companies:
- Kenyan BPO companies providing AI-enabled services to European clients must comply with the EU AI Act's requirements for the AI systems they deploy.
- Kenyan fintech companies serving European customers or processing European residents' data must classify their AI systems according to the EU risk framework.
- Kenyan data centre operators hosting AI systems for EU-based clients may need to demonstrate that their infrastructure supports the transparency, audit, and data governance requirements of the Act.
The CBK has also signalled awareness of the EU AI Act, noting that Kenyan banks with European correspondents or subsidiaries will need to align their AI governance practices with European standards.
What Data Centre Operators Need to Know
AI governance is not only a concern for the organisations building and deploying AI models. Data centre operators providing infrastructure for AI workloads have governance responsibilities too, both legal and commercial.
Infrastructure Responsibility
Data centres hosting AI workloads must ensure their facilities can support the governance requirements of their customers. This is increasingly part of the data centre security explained conversation, extending beyond physical security to include:
- Audit logging and chain of custody: The ability to demonstrate where data has been, who has accessed it, and how it has been processed.
- Data residency guarantees: Contractual and technical assurances that data processed in a specific facility remains within Kenyan jurisdiction.
- Secure data destruction: The ability to definitively delete data, including backup copies, when required by data subjects exercising their rights under the DPA.
- Incident response: Clear procedures for responding to data breaches involving AI systems, including notification to affected customers and regulators.
Supporting Customer AI Governance
As AI regulation tightens, data centre customers will increasingly require their infrastructure providers to support their governance obligations. This includes providing:
- Dedicated GPU infrastructure with appropriate security controls for AI inference workloads
- Network isolation to ensure AI workloads are segmented from other customers' data
- Compliance certifications that demonstrate the facility meets relevant security and governance standards
- Contractual terms that allocate responsibility for AI governance appropriately between the data centre operator and the AI deployer
The Environmental Dimension
The environmental impact of AI compute is an emerging governance concern. Training a single large language model can emit as much carbon as five automobiles over their entire lifetimes. For Kenyan data centre operators, this creates both an ethical obligation and a commercial opportunity. Kenya's geothermal energy (which provides over 40% of the country's electricity) offers a genuinely green power source for AI compute. Data centres that can demonstrate low-carbon AI infrastructure will increasingly attract environmentally conscious customers and support their own ESG reporting obligations.
AI Ethics Committees and Impact Assessments
Establishing AI Ethics Oversight
Leading Kenyan organisations are establishing internal AI governance structures. These range from formal AI ethics committees with board-level representation to smaller AI review panels within technology teams. Key functions include:
- Reviewing proposed AI systems for ethical risks before deployment
- Establishing guidelines for acceptable AI use within the organisation
- Monitoring deployed AI systems for emerging bias, performance degradation, or unintended consequences
- Advising leadership on AI governance compliance requirements
- Managing stakeholder concerns about AI's impact on employees and customers
Algorithmic Impact Assessments
Algorithmic impact assessments (AIAs) are structured evaluations of an AI system's potential effects on individuals, groups, and society. Similar to environmental impact assessments, AIAs evaluate risks before a system is deployed and recommend mitigations. While not yet mandated by Kenyan law, AIAs are being adopted voluntarily by leading organisations and are expected to become a regulatory requirement as the national AI strategy is formalised.
An effective AIA for a Kenyan organisation should evaluate:
- Bias and fairness: Has the system been tested for disparate impact across Kenya's ethnic, linguistic, and socioeconomic groups?
- Privacy implications: What personal data does the system process, and are appropriate safeguards in place?
- Transparency: Can the system's decisions be explained to affected individuals?
- Accountability: Is there a clear human accountability chain for the system's outputs?
- Kenyan context: Has the system been validated for the specific cultural, linguistic, and socioeconomic conditions of its intended Kenyan users?
The Growing Demand for AI Governance Professionals in Kenya
As AI governance matures from a niche concern to a mainstream business requirement, a new professional category is emerging in Kenya: the AI governance specialist. These professionals sit at the intersection of technology, law, ethics, and policy, and their skills are in growing demand.
Typical roles include:
- AI Ethics Officers within large corporations and government agencies
- AI Governance Consultants advising organisations on compliance and best practices
- Algorithmic Auditors who independently assess AI systems for bias, fairness, and compliance
- AI Policy Analysts working with regulators, industry bodies, and international organisations
- Data Protection Officers (already required under the DPA) expanding their remit to cover AI-specific governance
Kenyan universities and professional bodies are beginning to develop programmes to prepare professionals for these roles. Strathmore University, the University of Nairobi, and the Kenya School of Law have all introduced or are developing modules covering AI governance, technology law, and digital ethics.
Conclusion: Governance as Competitive Advantage
AI ethics and governance in Kenya are not obstacles to innovation, they are enablers of sustainable, trustworthy AI adoption. Organisations that invest in robust AI governance today will be better positioned to deploy AI systems that Kenyan citizens trust, that regulators approve, and that deliver genuine value rather than harm.
For data centre operators, the message is clear: providing infrastructure for AI workloads comes with responsibility. The facilities that can demonstrate security, compliance, data sovereignty, and support for their customers' AI governance obligations will win in a market where trust is the ultimate currency.
As Kenya's national AI strategy takes shape and international frameworks like the EU AI Act extend their reach into East Africa, the organisations that have proactively built AI governance capabilities will be the ones that lead. The time to invest in AI ethics and governance is now.
Frequently Asked Questions
Does Kenya have a specific AI law or regulation?
Kenya does not yet have a dedicated AI Act. AI governance currently operates through existing legislation, primarily the Kenya Data Protection Act 2019, which governs how AI systems process personal data. The government has been developing a national AI strategy, and the ICT Authority is expected to play a central role in coordinating AI governance. The Communications Authority of Kenya also has jurisdiction over AI-enabled telecommunications services.
How does the EU AI Act affect Kenyan companies?
The EU AI Act has extraterritorial reach, it applies to any organisation whose AI systems are placed on the EU market or whose outputs are used within the EU. Kenyan BPO companies, fintech firms serving European clients, and data centre operators hosting AI systems for EU customers may all fall within its scope. This means Kenyan tech companies need to understand EU AI risk classifications even without domestic AI legislation.
What is an AI ethics committee, and do Kenyan organisations need one?
An AI ethics committee is a governance body that reviews AI systems for ethical risks before and during deployment. While not yet legally mandated in Kenya, leading organisations including Safaricom, commercial banks, and the Microsoft ADC have established internal AI review processes. The proposed national AI strategy is expected to recommend AI ethics oversight for high-risk sectors like banking and healthcare.
Why is AI bias a particular concern in Kenya?
Most large AI models are trained predominantly on data from North America and Europe. When these models are applied to Kenyan users, they can produce biased outcomes, misidentifying African faces, misunderstanding Kenyan English or Kiswahili, or making incorrect financial risk assessments based on patterns that do not apply to the local context. This bias can lead to discriminatory lending decisions, inaccurate medical diagnoses, and exclusionary service delivery.
What role do data centres play in AI governance?
Data centres provide the infrastructure on which AI systems run, which comes with governance responsibilities. Data centre operators hosting AI workloads must ensure appropriate security controls, data residency compliance, audit logging capabilities, and the ability to support data deletion requests. As AI regulation tightens globally, data centre customers will increasingly require contractual guarantees that their infrastructure provider supports their AI governance obligations.