By Hansen Advocates
Artificial Intelligence (AI) is rapidly changing how businesses operate. From drafting contracts and responding to customer enquiries to analysing financial information, generating marketing content and automating business processes, AI tools are creating new opportunities for efficiency, innovation and growth.
For Kenyan businesses, the appeal is clear. Tasks that once required significant time and resources can now be completed in minutes. However, as organisations increasingly rely on AI, important legal questions arise concerning customer privacy, confidential information, intellectual property and responsibility for AI-generated decisions and content.
The question is no longer simply whether a business should adopt AI. It is whether the business can use AI responsibly while protecting its customers, employees, commercial interests and legal position.
1. Kenya’s Legal Landscape: What Businesses Need to Know
Kenya’s legal framework for AI is developing, but businesses should not assume that the absence of a dedicated AI statute means AI use is unregulated.
The Data Protection Act, 2019 provides an important foundation for the collection, use, storage and sharing of personal data. It establishes obligations for organisations that determine how personal data is processed and those that process it on behalf of others.
These obligations remain relevant when personal information is entered into an AI system, used to train a model, analysed to generate predictions or processed through a third-party AI service.
The Act also provides individuals with rights concerning their personal data, including the right to be informed about its use, access their information, object to certain processing and seek correction or deletion of inaccurate data.
Kenya’s proposed Artificial Intelligence Bill, 2026, has also brought AI governance into the national legal debate. However, in October 2026, the Senate’s Information, Communication and Technology Committee recommended that the Senate should not proceed with the Bill, citing concerns about its proposed regulatory framework and potential impact on innovation. The Bill should therefore not be treated as enacted law. Businesses should monitor subsequent parliamentary developments and policy changes.
For now, organisations should pay particular attention to their existing obligations under data protection, intellectual property, contract, consumer protection and other applicable laws.
2. Customer Data and Privacy: What Happens When You Feed Information into AI?
One of the most significant legal risks associated with AI is the handling of personal data.
Consider a company that uploads customer records, identification documents, employee information, financial statements or customer correspondence into an AI platform to summarise, analyse or organise the information.
Depending on the platform and its settings, the information may be transmitted to an external service provider, stored for a period of time or processed in ways that the business has not fully assessed.
This creates several important questions:
- Does the business have a lawful basis for processing the personal data for this purpose?
- Have customers or employees been appropriately informed about how their information will be used?
- Is the business sharing more information than is necessary?
- What security measures protect the information?
- Will the AI provider retain the information or use it for additional purposes?
- Could the information be transferred outside Kenya, and, if so, are the applicable legal requirements satisfied?
The Data Protection Act requires personal data to be processed lawfully, fairly and transparently, for specified purposes and only to the extent necessary. Organisations must also take appropriate measures to safeguard the information they handle.
Businesses should therefore avoid entering identifiable customer or employee information into AI tools without first assessing the purpose, legal basis, security arrangements and terms governing that use.
Where possible, sensitive information should be removed or replaced with anonymised or synthetic information before it is submitted to an AI tool. Simply removing a person’s name may not be sufficient if other details can still identify them.
Organisations should also assess whether a data protection impact assessment is required for processing that is likely to result in high risks to individuals.
3. Confidentiality: Is Your Business Sharing More Than It Realises?
AI tools can be useful for reviewing contracts, preparing proposals, analysing internal reports and drafting correspondence. However, these tasks may involve information that should remain confidential.
Examples include:
- Unpublished financial statements and business strategies.
- Client contracts, legal advice and privileged communications.
- Trade secrets, source code and proprietary business processes.
- Employee records and internal investigations.
- Negotiations involving acquisitions, investments or commercial partnerships.
Submitting such material to an external AI service may create risks if the business has not established how the provider stores, accesses, uses or deletes the information.
There may also be contractual restrictions on sharing information with third parties. Professional confidentiality obligations and legal professional privilege may require additional care, particularly where lawyers and their clients use AI tools.
A business should not assume that information remains confidential merely because it is entered into a private account or a platform marketed as secure.
Before using an AI tool for confidential work, organisations should review its terms of service, data retention practices, access controls, security commitments and contractual protections. They should also confirm whether their existing confidentiality agreements permit the proposed use.
A practical approach is to adopt an internal AI policy identifying approved tools, prohibited information, authorised users and circumstances requiring legal or management approval.
4. AI-Generated Content and Intellectual Property: Who Owns the Result?
Generative AI can produce articles, advertisements, images, software code, presentations, designs and other materials in seconds. However, the legal status of AI-generated content can be more complicated than it appears.
Businesses should consider at least three issues.
First, ownership. Who owns the content produced through an AI tool? The answer may depend on the applicable law, the nature of the human contribution, contractual terms and the circumstances in which the material was created. Businesses should not assume that every AI-generated output automatically attracts copyright protection or that the business necessarily owns all rights in it.
Second, infringement. An AI-generated image, passage of text, design or other output may resemble material protected by another person’s intellectual property rights. The fact that a machine generated the content does not automatically eliminate the risk of infringement.
Third, commercial use. The terms governing an AI service may restrict certain uses or impose conditions on the content it generates. Businesses should understand these terms before incorporating AI-generated material into products, advertising campaigns, publications or client deliverables.
Organisations can reduce these risks by reviewing AI-generated content before publication, checking relevant third-party rights, keeping records of significant human contributions and reviewing the applicable service terms.
Where content is commercially important, businesses should consider obtaining appropriate legal advice on ownership, licensing and permitted use.
5. Who Is Responsible When AI Gets It Wrong?
AI systems can produce inaccurate statements, fabricated references, misleading recommendations and biased results. They may also generate content that appears authoritative even when it is incorrect.
Imagine a business using AI to prepare a customer contract. The system inserts a clause that conflicts with the parties’ agreed terms. Alternatively, an organisation uses an AI tool to screen job applicants, and its recommendations unfairly disadvantage certain candidates.
Who bears responsibility?
The answer depends on the facts, the applicable law, the parties’ contractual arrangements and the nature of the harm. However, businesses should not assume that responsibility automatically shifts to the AI provider simply because a system produced the error.
Organisations remain responsible for the decisions they make, the services they provide and their compliance with applicable legal obligations.
Human review is therefore essential where AI outputs could materially affect legal rights, financial interests, employment opportunities, customer treatment or other important outcomes.
Businesses should establish clear procedures for checking accuracy, identifying bias, escalating high-risk outputs and correcting errors. Decisions with significant consequences should not be delegated entirely to an AI system without an appropriate assessment of the legal and practical risks.
6. Automated Decisions, Profiling and Fair Treatment
Some businesses use AI to analyse customer behaviour, assess creditworthiness, identify potential fraud, recommend products or rank job applicants.
These applications can create concerns where individuals are evaluated through automated profiling or decisions made without meaningful human involvement.
Kenya’s Data Protection Act contains provisions addressing certain decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals. The precise application depends on the circumstances and the safeguards available.
Businesses should therefore assess whether their AI systems make or materially influence decisions affecting individuals, whether the relevant legal requirements are satisfied and whether appropriate safeguards and review mechanisms are in place.
Organisations should also consider the quality and representativeness of the data used, the possibility of discriminatory outcomes and whether affected individuals receive adequate information about the process.
An AI system should not be treated as inherently objective simply because it uses data and algorithms. Its outputs may reflect inaccuracies, limitations or biases present in the information and methods on which it relies.
7. Kenya’s Proposed AI Legislation: What Should Businesses Watch?
Kenya’s AI regulatory debate reflects a broader challenge: how to encourage innovation while protecting individuals, businesses and the public from potential harm.
The Artificial Intelligence Bill, 2026, proposed a dedicated governance framework, including an AI Commissioner, oversight mechanisms and obligations relating to AI risk management. However, the Senate committee’s October 2026 recommendation that the Senate should not proceed with the Bill means businesses should distinguish between proposals under discussion and requirements currently in force.
The regulatory landscape may continue to evolve through policy development, further legislative proposals and guidance from relevant authorities.
Businesses should monitor developments affecting AI accountability, risk assessment, transparency, automated decision-making, data governance and the use of AI-generated content.
Importantly, organisations should not postpone responsible AI governance while waiting for a dedicated AI law. Existing legal obligations already provide a basis for assessing many of the risks associated with AI adoption.
8. A Practical AI Compliance Checklist for Kenyan Businesses
Businesses can take the following steps to improve their readiness.
1. Identify AI use. Maintain an inventory of AI tools used across departments, including tools adopted informally by employees.
2. Classify information. Identify personal data, confidential business information, privileged communications and other material that must not be submitted to unapproved tools.
3. Review privacy compliance. Establish a lawful basis for relevant personal data processing, provide appropriate information to data subjects and assess whether a data protection impact assessment or other regulatory steps are required.
4. Assess AI providers. Review service terms, data retention, security arrangements, permitted uses, data transfers and contractual protections before approving a platform.
5. Introduce an AI policy. Set clear rules on approved tools, acceptable uses, prohibited information, employee responsibilities and escalation procedures.
6. Maintain human oversight. Require appropriate review of AI-generated legal, financial, employment, customer-facing and other high-impact outputs.
7. Protect intellectual property. Review AI-generated content before commercial use and assess relevant copyright, licensing, confidentiality and contractual issues.
8. Train employees. Ensure staff understand the limitations of AI, privacy obligations, confidentiality risks and the importance of verifying AI-generated information.
9. Prepare for incidents. Establish procedures for responding to unauthorised disclosures, inaccurate outputs, security incidents and complaints involving AI systems.
10. Monitor legal developments. Review applicable laws, regulatory guidance and legislative proposals periodically, updating internal policies as necessary.
Conclusion: Responsible AI Is a Business and Legal Priority
Artificial Intelligence offers Kenyan businesses opportunities to improve efficiency, develop new products and compete in an increasingly digital economy. Yet these benefits must be balanced against the legal and ethical responsibilities that accompany the use of powerful technologies.
Customer data must be handled lawfully. Confidential information must be protected. Intellectual property rights must be respected. AI-generated content must be checked, and important decisions must receive appropriate oversight.
Kenya’s developing AI regulatory landscape makes it especially important for businesses to establish sound governance practices now rather than waiting for new legislation to settle every question.
At Hansen Advocates, we recognise that technological innovation can create both opportunities and legal challenges for businesses. Organisations adopting AI should consider reviewing their data protection arrangements, commercial contracts, confidentiality safeguards and internal policies to identify potential risks and establish appropriate protections.
Is your business ready for responsible AI adoption? Taking practical steps today can help protect your organisation, strengthen customer trust and support sustainable innovation as the law continues to develop.
This article is intended for general information purposes only and does not constitute legal advice. The application of the law depends on the facts and circumstances of each case. Businesses should seek professional advice on their specific circumstances.