Kenya is preparing to assert legal authority over artificial intelligence companies operating outside its borders, in a draft policy that would compel firms such as OpenAI and Meta to answer to Kenyan regulators even without a physical presence in the country.
The proposal, drawn up by the ICT Ministry, applies to any foreign entity whose AI systems are used within Kenya or whose outputs have a direct effect on Kenyan individuals, rights or public interests; a legal standard known as extraterritorial jurisdiction. It is the same jurisdictional approach the European Union relies on to fine global tech companies over privacy and safety breaches.
“This policy applies to any entity outside Kenya that provides AI or other emerging technologies systems or services whose outputs are used within Kenya, or which have direct and foreseeable effects on individuals, rights, or public interests in Kenya,” reads the draft AI policy.
Under the draft, the reach of Kenyan law would extend well beyond chatbot developers. Cloud providers, compute providers, infrastructure firms, data annotation companies and public-sector technology suppliers would all fall within scope if their systems touch Kenyan users or data.
The policy adopts what it calls an “effects-based jurisdictional approach, consistent with international best practice in data protection and consumer protection law,” according to the proposal.
In practice, this means a company never needs to set foot in Kenya to be held liable, it only needs its product’s consequences to be felt here. That would place OpenAI’s GPT models, Anthropic’s Claude and Meta’s Llama squarely within the ambit of Kenyan regulation, notwithstanding that none of the three companies maintains local offices. Google and Microsoft, by contrast, already operate Kenyan offices through their Gemini and MAI model lines respectively, potentially simplifying enforcement against them.
The draft policy borrows heavily from the EU’s AI Act in structure, if not yet in detail. It commits the government to classifying AI systems by risk level and maintaining a central register of high-risk systems for ongoing oversight though, unlike its European counterpart, the Kenyan draft does not yet define what qualifies as “high risk.”
The EU model designates systems used in critical infrastructure, healthcare, education, law enforcement, border control and elections as high-risk by default; Kenya’s drafters appear likely to follow a similar line.
Companies providing such systems would be required to conduct risk assessments, label AI-generated content, implement human oversight mechanisms, and meet minimum cybersecurity standards. They would also need to disclose information on data sources, known model limitations, and avenues for redress.
Public bodies face their own obligations. Government offices deploying high-risk AI in areas such as taxation, policing, justice and public services would need to conduct impact assessments beforehand, and the state plans to keep a public register of AI systems in use across government- except where national security is invoked to withhold disclosure. Foreign firms bidding for state AI contracts would additionally be pushed to partner with local technology companies.
Notably for a policy aimed at foreign tech giants, the draft also addresses the Kenyan workers who sustain their AI supply chains. It proposes minimum standards for written contracts, access to mental health support, and pay benchmarked against international rates for AI content moderators and data annotators- a direct response to years of complaints from Kenyan workers contracted to review material for firms including OpenAI and Meta, who have alleged psychological trauma and inadequate compensation.
The draft commits the state to “support the development and integration of fair and transparent pay standards for AI and other emerging technologies value chain workforce.”
The draft is silent on penalties. The EU’s comparable regime allows fines of up to 20 percent of a company’s global annual turnover, and requires non-EU firms in some cases to appoint a formal local representative to liaise with regulators.
Whether Kenya will adopt similarly stringent enforcement mechanisms – or the institutional capacity to pursue them against companies with no assets or staff in the country – remains an open question the government has yet to answer.
