How to Build Ethical AI Products in Africa: A Practical Guide

To build an ethical AI product in Africa, know where your training data comes from and that people agreed to its use, test the model on the people who will rely on it, and let a person review any decision that affects someone's money, health or work. In Kenya, the Data Protection Act 2019 already gives people rights over automated decisions.

I co-founded Hackhouse, a builders' hub in Nairobi. Founders building with AI ask what the law requires and what good practice looks like when there is no AI law yet. This guide covers both, with each legal point checked on 5 November 2026.

Which laws apply to AI products in Kenya in 2026?

Kenya has no dedicated AI law in force. The government launched the National AI Strategy 2025 to 2030 at KICC on 27 March 2025, and estimated it needs at least KSh 152 billion to implement it by 2030 (Citizen Digital). A Senate Bill, the Artificial Intelligence Bill 2026, sponsored by nominated Senator Karen Nyamu, was rejected by the Senate ICT committee, which said its penalties were too harsh for a young sector (Techweez, 16 October 2026).

The rules that bind you today sit in the Data Protection Act 2019:

• Automated decisions (section 35). A person has the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them. Exceptions cover contracts, decisions authorised by law and consent. Where you make such a decision, you must tell the person in writing, and they can ask you to reconsider it or decide again with human involvement.
• Impact assessments (section 31). Where processing is likely to result in high risk to people's rights, you must carry out a data protection impact assessment before you start, and consult the Data Commissioner if the risk stays high.
• Lawful grounds (section 30). You need consent for specified purposes or another listed ground, and further use must match the purpose you collected the data for.
• Children (section 33). Processing a child's data needs a parent's or guardian's consent.
• Transfers abroad (section 48). Sending personal data out of Kenya needs proof of appropriate safeguards to the Data Commissioner, or one of the listed necessities.

At continental level, the African Union Executive Council endorsed the Continental Artificial Intelligence Strategy in Accra on 18 and 19 July 2024. It calls for ethical, responsible and equitable AI and for aligned national approaches.

How do I check that my training data is fit to use?

Keep a short data register for every model. For each dataset, write down:

• Where it came from, and whether the people in it consented to this use.
• Where it is stored, and whether it leaves Kenya.
• Who can access it, and who can audit it.
• Which groups it covers well and which it barely covers: language, region, age, gender, income.

Then test the model on data that looks like your users. Example: a credit model trained mostly on salaried workers may score a market trader who earns through daily mobile money sales as high risk, simply because it has seen few people like her. Split your test results by group, and fix gaps before launch.

How can I make AI work in African languages?

Language decides who can use your product. Several African-led efforts give you a starting point:

• Masakhane is a grassroots research community for African language technology. Its name roughly means "we build together" in isiZulu, and the only requirement to join is to follow its code of conduct.
• InkubaLM, from Lelapa AI, is a small model of about 0.4 billion parameters trained for isiZulu, Yoruba, Swahili, isiXhosa and Hausa, plus English and French. Its licence is CC BY-NC 4.0, which bars commercial use, so check licences before you build a paid product on any model.
• Lelapa AI's Vulavula offers speech-to-text that handles code-switching and translation between African languages, aimed at contact centres.

Small models matter for ethics as much as for cost. A model that runs on a cheap Android phone or a modest server reaches clinics, schools and traders on patchy networks.

How do I keep a human in charge of AI decisions?

Section 35 sets the legal floor. Build these into the product from the first version:

1. Label automated decisions. Tell users in plain language, in writing, when a model made the call.
2. Add an appeal route. A button, a USSD option or a phone line where a person can ask for review.
3. Name a reviewer. A trained staff member who can explain the decision and overturn it.
4. Log the reasons. Store the inputs and the main factors behind each decision, so the reviewer has something to explain.
5. Watch outcomes by group. Track approval or error rates by region, gender and language each month.

What should I check before launching an AI product?

• A data register exists for every model.
• A data protection impact assessment is done if the processing is high risk, such as credit scoring, health or hiring.
• The model has been tested on users like yours, with results split by group.
• Model and dataset licences allow your use.
• Users are told when a decision is automated, and can reach a person.
• Any transfer of personal data outside Kenya has documented safeguards.

Our guide to data privacy for African startups covers registration with the Data Commissioner in more detail, and cybersecurity basics covers protecting the data once you hold it. To test an AI product with other founders, look at the Hackhouse Residency, 12 weeks with no equity taken, or meet builders at Hackhouse events.

Key facts

• Kenya has no AI law in force; the Senate ICT committee rejected the Artificial Intelligence Bill 2026 in October 2026.
• Section 35 of the Data Protection Act 2019 covers decisions based solely on automated processing.
• Section 31 requires a data protection impact assessment for high-risk processing.
• Kenya launched its National AI Strategy 2025 to 2030 on 27 March 2025.
• The AU Executive Council endorsed the Continental AI Strategy in July 2024.
• InkubaLM covers five African languages, including Swahili, under a non-commercial licence.

Frequently asked questions

Does Kenya have an AI law?

No. As of November 2026 there is no AI law in force. The Artificial Intelligence Bill 2026 was rejected at Senate committee stage, so the Data Protection Act 2019 is the main law that applies to AI products.

Can my app make automated decisions about users in Kenya?

Yes, within limits. Under section 35, automated decisions with significant effects need a legal basis such as a contract or consent, written notice to the user, and a way to ask for human reconsideration.

When do I need a data protection impact assessment?

When your processing is likely to result in high risk to people's rights. Credit scoring, health data and large-scale profiling are common examples. Do it before processing begins.

Can I use open-source African language models commercially?

It depends on the licence. InkubaLM, for example, uses CC BY-NC 4.0, which bars commercial use. Read each model's licence page before building a paid product on it.

Sources

• Kenya: Data Protection Act No. 24 of 2019, International Center for Not-for-Profit Law, checked 5 Nov 2026
• Kenya launches National AI strategy with Ksh.152B implementation budget, Citizen Digital, checked 5 Nov 2026
• Senate committee rejects AI Bill, sending it back to the drawing board, Techweez, checked 5 Nov 2026
• Continental Artificial Intelligence Strategy, African Union, checked 5 Nov 2026
• Masakhane, Masakhane, checked 5 Nov 2026
• InkubaLM-0.4B, Lelapa AI on Hugging Face, checked 5 Nov 2026
• Vulavula, Lelapa AI, checked 5 Nov 2026

Go deeper with us. Join the Hackhouse community for conversations that go beyond the surface, where builders share the hard-won lessons that never make it into press releases.