AI Compliance
We turn the rules that apply to you into a clear list of things to change.
What is AI compliance?
AI compliance consulting establishes which legal and sector obligations apply to your specific use of AI, then translates them into concrete requirements: what data a system may hold, for how long, where it may be processed, and what evidence you must be able to produce if asked.
For Kenyan businesses the Data Protection Act sets the floor. It governs why you may hold personal data, how much of it, how long you keep it, and what rights the people it describes can exercise.
AI makes each of those harder, because these systems tend to ingest more data than the task strictly requires and retain it longer than anybody intended when the system was switched on.
Sector rules usually bind tighter than the general law. Health, finance and education each impose their own record keeping and decision requirements, and those are what an inspector will actually ask about.
Why we translate rather than opine
Duara handles AI compliance from Nairobi for organisations processing personal data, particularly those in health, finance and education where sector rules sit above the general law.
We translate rather than opine. Our output is a list of changes your systems and staff must make, produced alongside your lawyer rather than in place of one, and we are explicit about which is which.
Who this is for
- You process personal data through AI systems
- You use overseas AI providers
- Clients require compliance evidence from you
- You cannot currently say what your systems retain
Industries we serve
- Banking and microfinance
- Insurance
- Private healthcare
- Schools and colleges
- HR and recruitment
- Government contractors
Problems this solves
Compliance work is almost always prompted by an external request rather than an internal review.
- Systems retaining more than the task needs. An AI tool holds full records when it only ever needed a fragment, which turns a small obligation into a large one.
- Cross-border processing nobody assessed. Data goes to an overseas provider without anybody establishing what that transfer requires under the Act.
- No evidence trail. You believe you are compliant but cannot produce the records that would demonstrate it to a client or regulator.
- Sector rules overlooked. General data protection is addressed while the stricter rules for your specific industry are missed entirely.
What we deliver
A mapped set of obligations specific to your use, the changes each requires in your systems and processes, the evidence you need to retain, and a remediation list ordered by exposure.
The obligations that apply to your use, not a generic summary
Required changes to retention, minimisation and processing location
The records and evidence you must be able to produce
Handling requirements for cross-border transfers
A remediation list ordered by how exposed each gap leaves you
Sector-specific requirements addressed alongside the general law
Features
- Obligations mapped to your actual use. We work from what your systems do rather than issuing a general compliance checklist.
- Retention examined specifically. AI systems keep more for longer by default, so retention gets its own review rather than a passing mention.
- Cross-border transfers addressed directly. Where processing happens abroad, the transfer requirements are set out rather than assumed away.
- Evidence defined as artefacts. We name the specific records you must hold, so compliance is demonstrable rather than asserted.
- Remediation ranked by exposure. The list is ordered by consequence, so limited effort goes where it reduces the most risk.
Benefits
- You can answer a client questionnaire. Compliance requests from corporate customers stop being a scramble across departments.
- Retention stops accumulating quietly. Systems are set to hold what the task needs and no more, which shrinks your exposure permanently.
- Sector rules are covered too. The stricter requirements that actually get inspected are addressed rather than overlooked.
- Effort goes where it matters. Ranked remediation means you fix the dangerous gaps first rather than the easy ones.
Technologies we use
- Data flow mapping. Establishing what personal data enters each system, where it travels and where it comes to rest.
- Retention configuration review. Checking what each system actually keeps against what the task requires and the law permits.
- Processing location assessment. Determining which providers process where, and what each of those transfers obliges you to do.
- Evidence inventory. Listing the records you need to hold and confirming whether your systems currently produce them.
- Rights request testing. Checking whether you can actually fulfil an access or deletion request within the required period.
This is assessment and specification. Any technical change we identify is specified for your team or ours to implement separately.
How the process works, step by step
Compliance work runs three to five weeks depending on how many systems process personal data.
-
Step 1
Free obligations call
We establish what personal data you hold, which sector you operate in, and who has asked you for assurance.
-
Step 2
Data flow mapping
We trace personal data through each system to find where it goes and how long it stays.
-
Step 3
Obligation mapping
We identify which requirements apply to your specific use, including the sector rules above the general law.
-
Step 4
Gap analysis
We compare current practice against those obligations and rank each gap by exposure.
-
Step 5
Remediation plan
You receive the ordered list of changes, the evidence to retain, and what to fix first.
Quality assurance and how we work
Our commitments on compliance work.
- We do not provide legal advice. We translate requirements into operational changes and say clearly when you need a legal opinion instead.
- Findings reference the obligation. Every required change cites the rule it derives from, so your lawyer can verify our reading.
- We assess practice, not policy. What your systems actually do is examined, because a policy describing something else protects nobody.
- Gaps are ranked, not listed alphabetically. You get an order of work based on exposure so limited effort lands where it counts.
- We will tell you if you are badly exposed. An uncomfortable finding is delivered plainly rather than softened into something that reads as acceptable.
Frequently asked questions about AI compliance
What does AI compliance consulting cover?
Establishing which legal and sector obligations apply to your specific AI use, then translating them into concrete changes to systems, retention and evidence.
Does using an overseas AI provider breach the Act?
Not automatically, but it creates cross-border transfer obligations that must be addressed deliberately rather than assumed away.
Do you give legal advice?
No. We translate requirements into operational changes and work alongside your lawyer where an opinion is required.
How long may we keep data?
Only as long as your stated purpose requires. AI systems commonly retain far longer by default, which is worth checking specifically.
Is this only for regulated sectors?
No. Any business holding personal data has obligations under the Data Protection Act regardless of sector.
What is data minimisation?
Holding only the personal data the task actually needs. AI systems frequently ingest far more than required.
What evidence do we need to keep?
Records showing your lawful basis, retention decisions, transfer assessments and how rights requests were handled. We list the specifics.
Can we fulfil a deletion request?
That is one of the things we test. Many AI deployments cannot, which is a gap worth finding before somebody asks.
What if our sector has extra rules?
They usually bind tighter than the general law and they are what inspectors ask about, so we address them alongside.
How long does this work take?
Three to five weeks depending on how many of your systems process personal data.
What is a lawful basis?
The legal ground permitting you to process personal data at all. Every processing activity needs one identified.
Do you assess systems we bought rather than built?
Yes. Obligations follow the data, not the developer, so purchased tools are firmly in scope.
Will you tell us if we are seriously non-compliant?
Yes, plainly. An uncomfortable finding delivered clearly is more useful than one softened until it reads as acceptable.
Can this help with client questionnaires?
Directly. Most corporate compliance questionnaires ask for exactly the evidence this work produces.
What is a cross-border transfer?
Sending personal data outside Kenya, which triggers additional requirements under the Act.
Do you fix the gaps you find?
We specify the changes. Implementation can be done by your team, by us, or by another supplier.
How are gaps prioritised?
By exposure, meaning what each gap would cost you if it were tested, rather than by how easy it is to fix.
Does this cover staff use of public AI tools?
It overlaps with governance, and we say where the boundary falls so neither piece of work assumes the other covered it.
How often should compliance be reviewed?
Annually, and immediately whenever a new system starts processing personal data.
What does compliance work cost?
It depends on the number of systems in scope and your sector. The figure is fixed before work begins.
Glossary of terms
Compliance vocabulary in the sense the Act uses it.
- Data minimisation
- Holding only the personal data the task actually requires, and no more.
- Retention period
- How long you may keep personal data before it must be deleted or anonymised.
- Lawful basis
- The legal ground on which you are permitted to process someone personal data at all.
- Cross-border transfer
- Sending personal data outside Kenya, which carries additional obligations under the Act.
- Data subject rights
- The entitlements individuals hold over their own data, including access and deletion.
- Processing
- Anything done with personal data, including storing, analysing, sharing or deleting it.
Related services in AI Consulting
Talk to us about AI compliance
If a corporate client has sent you a compliance questionnaire, send us their questions. They usually define the scope of the work precisely.
Start your project