AI & EMERGING TECHNOLOGIES LEGAL ADVISORY.
Artificial intelligence is no longer the future — it is the present. But as AI becomes embedded in business operations, it brings a new category of legal risk that most organizations are unprepared for.
From AI-powered hiring tools to automated customer service, algorithmic decision-making, and generative AI content — businesses in Kenya and across Africa are rapidly adopting emerging technologies. The legal frameworks governing these tools are still catching up, but that does not mean the risks are absent. Understanding them now gives your business a critical advantage.
AI is not here to replace lawyers but to enhance the lawyer’s craft. Therefore, we should move far from the AI-solutionism approach, which is a popular belief that given enough data, machine learning algorithms can solve all humanity’s problems. This article examines Kenya’s use of AI in the legal sector. It will examine the benefits that AI can bring to this sector, how the country, through its policies, is addressing this emergence, and the general perceptions of AI in the Kenyan legal sector.
Key Legal Issues Arising from AI Use
1. Data Privacy and AI
AI systems are trained on and process vast amounts of data, much of it personal. Under Kenya’s Data Protection Act, 2019, automated decision-making that significantly affects individuals — such as credit scoring, hiring decisions, or insurance assessments — must comply with data subject rights, including the right to an explanation and the right to object.
Key action: Audit the data your AI systems use. Ensure you have a lawful basis for processing and that individuals can exercise their rights under the DPA.
2. Intellectual Property in AI-Generated Content
Who owns content created by an AI? This is one of the most contested legal questions in technology law today. In most jurisdictions, copyright subsists in works created by human authors. AI-generated content — where there is no meaningful human creative input — may not attract copyright protection, leaving your business unable to protect what your AI produces.
Additionally, if your AI was trained on third-party copyrighted material without authorization, you may face infringement liability.
Key action: Review the terms of service of AI tools you use commercially. Seek legal advice on IP ownership of AI outputs and the provenance of training data.
3. AI in Employment Decisions
Using AI to screen CVs, assess candidates, or evaluate employee performance introduces legal risk around discrimination. If an algorithm systematically disadvantages candidates based on protected characteristics — even unintentionally — an employer may face liability under Kenya’s Employment Act and the Constitution’s equality provisions.
Key action: If you use AI in hiring or performance management, conduct bias audits of the system and maintain human oversight over final decisions.
4. Contractual Liability for AI Errors
When an AI system makes an error that causes loss — a wrong medical recommendation, a flawed financial projection, a defective automated contract — who is liable? The answer depends on how contracts between technology providers, businesses, and end users are structured.
Key action: Review your contracts with AI vendors and your terms of service with clients. Ensure liability is clearly allocated and that you are not inadvertently accepting unlimited exposure.
5. Sector-Specific Regulation
Certain sectors face additional scrutiny when deploying AI. In financial services, the CBK expects explainability in credit decisions. In healthcare, the use of AI diagnostics tools raises questions under medical practice and liability law. In legal services, AI tools must be used within the bounds of professional conduct rules.
Key action: Understand the sector-specific regulations that apply to AI deployment in your industry before going to market.
The Emerging Regulatory Landscape
Kenya does not yet have AI-specific legislation, but this is changing. Globally, the EU AI Act has set a precedent for risk-based AI regulation, and African governments — including Kenya — are developing their own frameworks. Businesses that build compliant, ethical AI practices now will be ahead of the curve when regulation arrives.
Common Pitfalls Founders Should Avoid
- Assuming that because the AI Bill isn’t law yet, there’s nothing to comply with — the Data Protection Act, 2019 already applies to most AI systems today.
- Treating AI compliance as a one-off legal review rather than an ongoing documentation and audit practice.
- Overlooking sector regulators (CBK, CMA, Pharmacy and Poisons Board) because attention is focused only on the new AI-specific framework.
- Failing to document the provenance and licensing of training data until an investor or regulator asks for it.
- Assuming a chatbot or ‘limited risk’ feature is automatically exempt — classification depends on use case and sector, not just the technology itself.
Regulatory Bodies & Frameworks to Know
| Body / Framework | Relevance to AI |
| Office of the Data Protection Commissioner (ODPC) | Enforces the Data Protection Act, 2019 — applies to any AI system that processes personal data (nearly all consumer-facing AI). |
| Office of the AI Commissioner (proposed) | Would be established under the AI Bill, 2026 to classify, register and audit high-risk AI systems and issue enforcement notices. |
| Communications Authority of Kenya (CA) | Oversees telecoms and data infrastructure; relevant for AI systems built on licensed networks or platforms. |
| Central Bank of Kenya (CBK) / Capital Markets Authority (CMA) | Apply where AI is used in credit scoring, algorithmic trading, or other regulated financial services. |
| Kenya Industrial Property Institute (KIPI) | Governs patents, trademarks and, increasingly, questions around AI-generated works and inventorship. |
| Pharmacy and Poisons Board | Drafting rules for AI tools used in clinical and healthcare settings. |
How RMA Law Africa Can Help
Navigating a regulatory landscape that is still being written requires a legal partner who is tracking the process in real time, not just reacting to the final text. RMA Law Africa advises founders and technology companies on:
- Pre-emptive compliance audits against the Data Protection Act, 2019 and the AI Bill’s current draft provisions.
- Drafting AI usage policies, data provenance documentation, and model risk assessments.
- Structuring IP ownership and licensing terms for AI-assisted products and training data.
- Ongoing regulatory monitoring as the AI Bill moves through the Senate and National Assembly.
Get in touch with our team to assess where your AI product currently stands and what to prioritise before enforcement begins.
Contact us through→office@rmlawafrica.com or contact lawyers through our partners ; https://knownafrique.africa/