SMECOMPLIANCE/kenya-ai-governance-framework-for-kenyanSMEs

A simple, bottom-up AI governance framework for Kenyan SMEs, validated with a Kenyan case study. An open-source project. # Project AIDA: An Open-Source AI Governance Framework for Kenyan SMEs **Empowering Kenyan SMEs to adopt AI responsibly while ensuring compliance with Kenya's Data Protection Act, 2019.** --- ## The Compliance Challenge Despite the opportunities AI presents, most Kenyan SMEs face four key obstacles: * **Knowledge Gap:** Many SME owners and managers lack training in data protection law and AI governance. Concepts such as “lawful basis for processing” or “data protection by design” are often misunderstood or overlooked in day-to-day operations. * **Resource Constraints:** Accessing legal and compliance expertise remains costly with professional advisory fees running into tens of thousands of shillings per hour, well beyond what most SMEs can afford. * **Inadequate Tools:** Existing compliance solutions are designed for large enterprises and are too complex, expensive, or irrelevant to the realities of smaller businesses. * **Active Enforcement Environment:** The Office of the Data Protection Commissioner (ODPC) is actively enforcing the Kenya Data Protection Act, 2019, with penalties of up to KES 5 million or 1% of annual turnover. For many SMEs, a single enforcement action could threaten their survival. --- ## The AIDA Solution Project AIDA (Artificial Intelligence Data Assurance) provides a practical, free, and SME-focused governance framework to help Kenyan businesses adopt AI responsibly and stay compliant with the law. ### Key Components * **The White Paper:** A concise, accessible guide that breaks down Kenya’s AI and data protection landscape, outlines the compliance challenges SMEs face, and introduces a structured, step-by-step AI governance approach. * **The Practical Toolkit:** A collection of ready-to-use templates and checklists designed for immediate application by SMEs, including: * AI-Focused Privacy Policy Template * Data Protection Impact Assessment (DPIA) Form * Record of Processing Activities (RoPA) Spreadsheet * AI Risk Checklist (Ap …