Can Our Board Just Let the AI Decide? Oversight Duties Before Kenya’s AI Bill

Kenya’s Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2026) is not law. It was published on 19 February 2026, had its first reading in the Senate on 2 April 2026, and appeared under “Bills at Second Reading” on the Senate’s notice paper for 5 August 2026. Boards do not need to wait for it to find out whether they can simply defer to an algorithm’s output. Board oversight of AI is already governed by the Companies Act, 2015, and the answer there is that they cannot.

Independent judgment does not switch off because a tool is involved

Section 144 of the Companies Act requires a director to exercise independent judgment. The duty is not infringed where a director acts in accordance with an agreement duly entered into by the company or in a way authorised by its constitution, but nothing in the section suggests that a director may adopt a software output as their own decision without engaging with it. Using an AI system to support a decision, such as credit scoring, hiring recommendations, pricing or risk flagging, is not itself a problem. Treating the system’s output as the decision, rather than as one input the director then actually considers, is where the duty is at risk. A director who approves whatever the model recommends has arguably delegated a decision the law expects them to make personally.

Reasonable care and skill now includes understanding what the tool does

Section 145 asks a director to exercise the care, skill and diligence of a reasonably diligent person with two attributes: the general knowledge, skill and experience that may reasonably be expected of a person carrying out the director’s functions, and the general knowledge, skill and experience the director actually has. The standard is therefore partly objective and partly personal. As AI-assisted tools become standard in hiring, lending and operations, a board that has never asked how a system reaches its recommendations, what data it was trained on or how often it is wrong is increasingly exposed on this duty. You do not need to be a data scientist to sit on a board that uses these tools. You do need to have asked the basic questions before relying on the answer.

What the AI Bill would add if it becomes law

According to the Parliamentary Bill Digest, the Bill proposes an Office of the Artificial Intelligence Commissioner, which would classify AI systems into four tiers: unacceptable, high, limited and minimal risk. High-risk sectors include healthcare, education, finance, security and public administration. Providers and deployers of high-risk systems would have to keep datasets and system documentation, carry out risk and human rights impact assessments, ensure transparency and explainability, and comply with the Data Protection Act.

The digest also records penalties: a fine of up to KES 5 million, imprisonment of up to two years, or both, for offences such as deploying a high-risk system without the required assessments, and lower penalties for transparency failures. For boards, the notable feature is that directors and officers of a company may be liable if they knew of an offence and did not exercise due diligence. These are proposals only. The final text, and whether the Bill passes in anything like its current form, remains uncertain.

Until then, board oversight of AI is a matter of the duties above, not of any new statute. The practical risk today is less a statutory penalty than a decision that cannot be defended: a refused loan, a dismissed employee or a mispriced contract that the board cannot explain because nobody asked how the tool reached its answer.

What good board oversight of AI looks like now

A board that can show it discussed how an AI tool is used in a significant decision, understood its basic limitations and built in a genuine human review step is in a materially stronger position than one that adopted a tool and never revisited the decision. In practice that means:

• keeping a register of the AI tools the company uses in decisions about customers, staff or credit;
• naming a director or senior officer responsible for each material use;
• requiring a human reviewer who can override the output, and recording when they do;
• asking the vendor how the system was built, tested and monitored; and
• minuting the discussion. Section 210 requires directors’ minutes to be kept for at least seven years.

That record of active oversight is what sections 144 and 145 already expect, whatever shape the AI Bill eventually takes.