Kenya is starting to write rules for artificial intelligence, and the first targets are the kinds of automated decisions that ISPs and mobile money platforms already make every day. Credit limits, fraud flags and account restrictions are set by software at speed, and the people affected often cannot find out why. For operators who depend on M-Pesa and automated billing, this direction matters now, not later.
The draft guidance names the risky uses
On 3 August 2026, the Office of the Data Protection Commissioner published draft guidance on AI under the Data Protection Act. It lists eight AI uses that would require a data protection impact assessment, and two are directly relevant to billing: credit scoring for loan decisions, and fraud detection in payment systems. The guidance is still marked as a draft and has no stated commencement date, so nothing is law yet. It does show which uses regulators are looking at first.
Automated decisions already have a legal hook
The Data Protection Act 2019 already limits decisions based solely on automated processing when they significantly affect a person. Under those provisions, an individual can ask for a meaningful explanation of the logic behind such a decision, not just the outcome. That is a higher bar than most small providers meet today. A notice that says "your account is restricted" with no reason attached is exactly the kind of decision that can be challenged.
A court case is testing the principle
In April 2026, a petition was reported as filed in the High Court challenging Safaricom's use of AI in M-Pesa credit decisions and in its customer service chatbot, Zuri. The petitioners describe the system as a "black box". They argue that customers whose credit limits drop have no meaningful reasons to work with, and that reaching a human agent over urgent problems is hard. These are allegations, not findings. In the most recent reporting we reviewed, the case was still pending. Even so, a challenge aimed at one of East Africa's largest mobile money platforms is a signal to every operator that will be asked the same questions.
Kenya's AI law and regulator are also in motion
A Kenyan AI Bill 2026 was introduced in the Senate in March and proposes an AI Commissioner to oversee the sector. Separately, the Data Protection Commissioner's post is changing hands. The Public Service Commission received 152 applications, shortlisted 13, and scheduled interviews for 5 October 2026. The incoming commissioner will inherit oversight of AI systems that connect to business data through APIs, so the questions about automated decisions will not go away with the current leadership.
What ISPs should do before the rules are final
You don't need final guidance to get ready. Practical steps for any ISP:
- Write down the rules behind every automatic action. Know which condition disconnects a subscriber, which one restores them, and what threshold places a payment on fraud hold.
- Keep a reason on record. When a subscriber asks why their service stopped, the answer should come from the system, not from memory.
- Keep a human route for urgent problems. Failed payments and mistaken transfers need a path to a person, not only a chatbot.
- Be careful what personal data leaves Kenya. The ODPC draft also proposes safeguards for organisations sending personal data to AI providers offshore.
This is where rule-based billing has a practical advantage. XpressRADIUS enforces subscription status through explicit rules in RADIUS: a PPPoE client is disconnected when a subscription lapses and reconnected when payment arrives through M-Pesa or Kopo Kopo. Those are rules an operator can state, document and explain, which is the foundation any future explanation requirement will rest on.
Want billing and enforcement rules you can explain to a subscriber? Start a free trial of XpressRADIUS.
Start a free trial