We offer AI policy development in Kenya for companies, NGOs, schools and SACCOs, so your staff get a clear AI use policy they can follow: which tools are approved, what data must never go into them and who checks AI output before it is used. We write it with your leaders and then train your staff on it.
Our corporate partners
“I had an excellent experience learning with EddyLabs. The courses are well-structured, beginner-friendly, and super practical, even if you do not have any technical background.”
A member of your team needs to analyse a customer spreadsheet. An AI tool could help, but the file contains names and contact details. Can they upload it? Which account should they use? What happens to the information after they share it?
Without clear guidance, staff have to make those decisions on their own. The same uncertainty can arise when a team drafts a donor report, prepares a contract or uses AI to answer a customer. A policy gives people a shared starting point: which tools are approved, what information needs protection and who checks the result.
Kenya’s Data Protection Act sets duties for organisations that process personal data. The Office of the Data Protection Commissioner has also called for safeguards when personal data is used with AI. Your policy should fit those duties and the work your people do.
The goal is to make safe use easier, not to stop useful work. Staff should be able to find an answer before they share information, and know who to ask when a case is unclear.
We list the AI tools your staff may use, the accounts they must use them on and the settings to switch on, such as turning off chat history for training where a tool allows it.
The list is short and practical, so staff do not need to guess which new app is allowed.
We set clear rules on which information can never go into an AI tool, such as personal data, health details, client files and confidential plans, and how to remove identifying details when AI help is needed.
The rules follow the Kenya Data Protection Act, 2019, and any rules from your regulator, funders or clients.
AI can invent facts, figures and sources. The policy says who must check AI output, what they check and when you tell a client, donor or regulator that AI was used.
It also makes clear that a person, not a tool, stays responsible for every decision and document.
A policy that nobody reads does not protect you. We run a short session for staff that explains each rule with examples from their own work.
We also give you a one-page summary to share, and a simple process to review the policy as tools and laws change.
Tell us about your organisation and how your staff use AI today.
Plan your AI policyStaff need more than a warning to be careful. A simple guide can help them decide when to stop, when to ask and when a task may be suitable for an approved tool.
| Category | Example | Starting point |
|---|---|---|
| Red | M-Pesa statements, KRA PINs, SACCO member loan files, beneficiary lists, employee health details or unredacted contracts | Do not enter the information into an unapproved AI tool. Ask the person responsible for data protection. |
| Amber | De-identified survey results, donor report drafts with personal and location identifiers removed, or internal SOP drafts | Check the tool, the information and your organisation’s rules before use. Removing names alone may not make data anonymous. |
| Green | Publicly published reports, general correspondence templates, public FAQs for Kiswahili or English translation, or fictional training examples | Use an approved tool and check its output before relying on or sharing it. |
This is an illustration, not a legal classification. Your rules depend on the information, the tool, your organisation’s approvals and the duties that apply to you.
Discuss a policy for your teamA policy is useful when staff can apply it to the decisions they face at work.
A long document can leave people unsure about an ordinary task. We organise the rules around practical questions and prepare a short summary staff can refer to.
A generic template may miss the tools, documents and decisions your teams use. We discuss those workflows with you before drafting the policy.
People need to know how the rules apply to their role and who can answer questions. We include a staff session with examples drawn from your organisation’s work.
The risks and rules depend on the people and information your team works with.
Consider financial data confidentiality, audit trails and the applicable CBK or SASRA requirements.
Protect beneficiary information and account for donor requirements when staff use AI for monitoring, evaluation and reporting.
Set rules for administrative and teaching work, student assessment and academic integrity.
Protect client proposals, pricing information and internal intellectual property across sales, HR and operations.
We talk to your leaders and staff to learn how AI is used today, which data you hold and which rules already apply to you.
You receiveA short risk summaryWhere AI is used and where the risks are.
We write a policy in plain English that fits your size and sector, with rules staff can follow without a lawyer.
You receiveA draft AI use policyA 3 to 5 page core policy in Word or PDF, plus a one-page staff quick reference covering approved tools, data rules, human checks and incident reporting.
We review the draft with your management, and board where needed, and make the changes they ask for.
You receiveAn approved policyReady to share with every member of staff.
We train your staff on the policy with examples from their own work and answer their questions.
You receiveStaff who follow itA staff session and a date to review the policy.
We agree on the scope and fee before work begins. These depend on your organisation, the people involved and the training you need.
Book a free 30-minute call. We will look at how your team uses AI today and plan your policy.
Book a free call