A recruitment tool screens out candidates. A chatbot gives a customer the wrong information. A model is trained on personal data gathered from the web. Kenyan businesses are already using such systems, and they are asking a practical question: who answers when an AI system causes loss?
Quick answer: Kenya does not yet have a standalone statute dedicated to artificial intelligence. Existing law applies: the Data Protection Act 2019 governs the automated processing of personal data, the Computer Misuse and Cybercrimes Act 2018 addresses unauthorised access to and interference with systems, and contract and general legal principles frame the commercial arrangements. Responsibility may fall on the developer, the deployer, the professional user or a combination, and it is increasingly allocated by contract before deployment.
The framework that applies now
The absence of a dedicated AI statute does not leave a gap in the law; it means the existing rules do the work. The Data Protection Act 2019 applies wherever personal data is processed, including where the processing is automated or supports a decision about a person. The Computer Misuse and Cybercrimes Act 2018 applies to unauthorised access, interference and related conduct. Contracts, negligence and misrepresentation supply the commercial and civil framework.
The Office of the Data Protection Commissioner has published guidance notes on matters such as data protection impact assessments and cross-border data transfers. Those notes are relevant to AI deployment because they shape how a controller must assess risk and how data may move to a model hosted outside Kenya.
Who may be liable
The allocation of responsibility is still developing, and the answer depends on the facts. A developer that built and supplied the system may face a claim in contract or in negligence. A deployer that put the tool into service, chose the data or set the parameters may carry responsibility for the consequences. A professional user who relied on an output without reasonable checks may share in the loss. A patient, customer or candidate affected by a decision may have a data protection complaint as well as a civil claim.
Contracts can allocate risk between the parties, but they do not bind the person who suffered the loss. That distinction matters: a limitation of liability between vendor and customer may shape the commercial claim, while a regulator or an affected individual deals with the parties under the applicable law.
Data protection duties
Where an AI system processes personal data, the controller must identify a lawful basis, be transparent about the processing and respect data subject rights. A data protection impact assessment is the usual way to test a high-risk deployment, including profiling and automated decision-making. The assessment should record the purpose, the data used, the people affected, the risks identified and the measures taken to address them.
Where the model is hosted abroad or trained on data from another jurisdiction, the cross-border transfer rules apply. The ODPC guidance on cross-border transfers is a useful starting point, and the arrangement with the vendor should reflect the controller’s obligations rather than leaving them to the vendor’s standard terms.
Contract and vendor allocation
Vendor and licence terms should be negotiated with liability in mind. The questions are practical: what does the vendor warrant about accuracy and performance, what indemnity does it give, what are the liability caps, who owns the inputs and outputs, what happens on termination, and what cooperation does the vendor owe in an incident or a regulatory inquiry? A data processing agreement is needed where the vendor processes personal data on the controller’s behalf.
Standard terms are rarely written for the deployer’s risk. A short schedule that addresses the specific use case, the data involved and the consequences of failure is usually worth more than a long negotiation over boilerplate.
Governance and documentation
| Control | What it achieves |
|---|---|
| AI inventory and owner | Shows what systems are in use and who is accountable |
| Human review of material decisions | Keeps a person in the loop where rights or livelihoods are affected |
| Data provenance record | Shows what the model was trained or tuned on and where it came from |
| Testing and monitoring | Identifies errors and drift before they become a pattern |
| Impact assessment | Records the risk analysis and the mitigations chosen |
| Incident and complaint log | Provides the evidence trail if a decision is challenged |
Governance is also a commercial asset. Organisations that can explain how a system was selected, tested and monitored are better placed to answer a regulator, a customer or a court than those that cannot produce the reasoning behind a deployment.
Disputes and evidence
When an AI-related dispute arises, the evidence is usually documentary: the contract, the impact assessment, the testing records, the logs, the decision record and the correspondence. A claimant must show what the system was asked to do, what it produced and how that caused loss. A defendant will point to the contract terms, the warnings given and the human review that was meant to catch errors.
Regulatory and civil routes can run in parallel. A data protection complaint to the ODPC may sit alongside a contract claim or a consumer complaint, and the dispute resolution clause in the governing contract often determines the forum for the commercial dispute.
Timing, cost and when to get advice
Advice is cheapest before deployment. Reviewing the data flows, the impact assessment and the contract before the tool goes live costs less than responding after a complaint, and it produces the documentation that any later inquiry will ask for. Where a dispute has arisen, the first step is to preserve the logs and records before systems are changed.
Take advice where the system makes or supports decisions about people, personal data is involved, the model is hosted abroad, the vendor’s terms are standard and one-sided, or a complaint or claim has been received. The firm’s ICT, data privacy and AI law practice in Nairobi advises on AI deployment and liability, and it works alongside the guides on data protection impact assessments and software and SaaS contracts.
Primary sources
- Data Protection Act 2019, Kenya Law.
- Computer Misuse and Cybercrimes Act 2018, Kenya Law.
- Office of the Data Protection Commissioner: guidelines and guidance notes.
This article is general information, not legal advice.
