Technology, Startup and Creative Industries Law in Kenya

Not by a dedicated statute. Kenya launched its National AI Strategy 2025–2030 in March 2025 and published a Draft Artificial Intelligence and Emerging Technologies Policy in 2026, with public comment open until 4 August 2026 — but a strategy and a draft policy do not create binding obligations. What does apply now is the Data Protection Act 2019 to any personal data used in training or inference, the Computer Misuse and Cybercrimes Act 2018, intellectual property law to models and outputs, and the Consumer Protection Act 2012 to how the product is marketed. Legislation is clearly signalled, so building to the draft policy's direction is sensible even though it is not yet enforceable.

Under the Copyright Act, copyright vests in the author, and an assignment must be in writing and signed to move it. Paying an invoice does not transfer ownership. For employees the position is generally more favourable to the employer, but contractors and freelancers retain copyright absent a written assignment — and most early-stage products in Kenya are built at least partly by contractors. This surfaces in every funding round and every acquisition. Obtain signed assignments now, while relationships are good, rather than trying to track down a former developer during diligence.

A cap table that reconciles to the statutory registers; signed IP assignments from every founder, employee and contractor; up-to-date BRS filings including the beneficial ownership register; employment or contractor agreements that reflect how people are actually engaged; and a data protection position if the product handles personal data. None of it is difficult in isolation. What makes it expensive is doing it all at once, under time pressure, after a term sheet has been signed and the valuation is already fixed.

It depends on the nature and scale of your processing rather than on whether you consider yourself a technology company. Registration as a data controller or processor is determined by criteria in the Act and its regulations, and a consumer-facing product handling significant volumes of personal data is far more likely to fall within them than a small B2B tool. The assessment should be documented either way — enterprise customers increasingly ask for it, and a recorded reasoned conclusion is a much better answer than an assumption.

Four things do most of the work. Data protection: the controller and processor roles, the processing terms, and where the data is hosted if that is outside Kenya. Service levels: what you commit to and what the remedy is when you miss it, which should be a service credit rather than open-ended liability. Limitation of liability: an uncapped exposure on a subscription product is rarely commercially rational. And exit: what happens to customer data on termination, in what format, and for how long you will hold it.

Principally what happens to the content afterwards. Many brand agreements take a perpetual, worldwide, royalty-free licence — or outright ownership — of everything produced, which means the brand can keep running your content long after the campaign fee has been paid. Also check exclusivity, since a broad category exclusivity can quietly block every competing brand for the term; the approval process, so it does not become unlimited unpaid revisions; and payment terms. Disclosure of paid promotion is a legal obligation, not a matter of preference.