Inside Kenya's Artificial Intelligence Bill and the fight for accountability

In February 2023, a job applicant named Derek Mobley filed a lawsuit in California that has quietly become one of the most consequential legal tests of artificial intelligence (AI) in modern life.

Mobley alleged that Workday, a company whose AI-powered software helps employers screen and rank job applicants, unfairly rejected his application despite his qualifications.

His claim was not that a human recruiter discriminated against him, but that the algorithm itself may have done so, systematically, invisibly, and at scale.

The case raises a fundamental question for the digital age: who is accountable when an AI system makes a decision that harms an individual? In 2024, a federal judge allowed the lawsuit to proceed, signalling something profound.

Courts are increasingly willing to examine whether organisations can be held responsible for decisions made through artificial intelligence, recognising that AI is no longer merely a passive tool but an active participant in decision-making processes.

That realisation is arriving just in time for Kenya. The Artificial Intelligence Bill, 2026, represents the country’s most ambitious attempt yet to regulate a technology that already underpins its financial system.

Risk-based model

From mobile lending platforms that assess creditworthiness in seconds, to insurance algorithms that price risk and trading systems that influence markets, AI has become the quiet infrastructure of economic life.

The Bill seeks to bring order, accountability, and trust to this rapidly expanding domain. But its success will depend on whether it fully confronts a central truth that cases like Mobley versus Workday and others have exposed: when AI makes decisions, responsibility cannot be automated away.

At its core, the Bill adopts a risk-based model, classifying AI systems into four categories: unacceptable, high, limited, and minimal risk.

In the financial services sector, most applications, such as credit scoring, fraud detection, underwriting, and algorithmic trading, will fall squarely within the “high-risk” category.

This classification is appropriate. These systems do more than optimise efficiency; they shape access to opportunity. To address this, the Bill imposes substantive obligations on providers and deployers of high-risk AI systems.

These include risk and human rights impact assessments, transparency and explainability requirements, robust record-keeping, and cybersecurity safeguards.

It also embeds user rights: individuals must be informed when AI is used, and they must be able to seek human intervention, challenge decisions, and express their views.

The proposed AI Commissioner could help ensure consistent oversight and provide a clear avenue for addressing complaints and emerging risks.

Yet even as the Bill builds this architecture, it must contend with an existing legal cornerstone that already governs automated decision-making: Section 35 of the Data Protection Act, 2019.

Section 35 enshrines a critical right that individuals should not be subject to decisions based solely on automated processing when those decisions have legal or significant effects.

In financial services, this is not an abstract principle.

Automated decisions

A loan denial, an insurance rejection, or an investment loss recommendation can alter a person’s life trajectory.

Section 35 also requires individuals to be notified of significant automated decisions and gives them the right to seek reconsideration, reinforcing the need for human oversight.

For financial institutions, the Bill will require greater transparency, stronger governance and clearer accountability for AI-driven decisions.

While compliance costs may rise, public trust in automated systems is likely to improve.

Challenges remain, including coordinating oversight with existing regulators and managing compliance costs for smaller fintech firms. Clear guidance will be needed to protect consumers without stifling innovation.

The deeper question raised by the AI Bill is not simply how to regulate technology, but how to sustain trust in a digital economy.

Whether in hiring, lending, or customer service, AI systems act on behalf of institutions.

And institutions must remain responsible for what those systems do.

AI promises greater efficiency, financial inclusion, and innovation. Yet it also introduces new risks, including opacity, bias, and the possibility of errors occurring at scale.

The challenge for policymakers is to ensure that the benefits of AI are realised without weakening accountability.

The AI Bill, 2026, is a strong beginning. It signals that Kenya intends not only to adopt AI, but to govern it responsibly.

The lesson from around the world is clear. AI does not replace human judgment.

When something goes wrong, institutions must remain accountable. Kenya’s law must ensure that responsibility is never unclear.

 The writer is the Group Data Protection Officer at Old Mutual