The European Union’s Digital Omnibus marks a significant development in the global debate on regulating artificial intelligence (AI) without stifling innovation and competitiveness.
On November 19, 2025, the European Commission unveiled its Digital Omnibus Package, describing it as an effort to simplify the EU’s digital rulebook rather than deregulate. It seeks to reduce administrative costs, duplication and regulatory friction while preserving fundamental rights, data protection, safety and fairness.
The package covers AI, data and cybersecurity, proposing streamlined compliance and reporting requirements and simpler implementation of the AI Act. It reflects growing concerns that regulatory fragmentation could undermine Europe’s investment, innovation and productivity. The challenge is to maintain strong safeguards without making regulation an obstacle to technological growth.
This experience offers important lessons for Kenya as it implements its National AI Strategy 2025-2030, built around three pillars: AI digital infrastructure; data and AI governance; and AI research, innovation and commercialisation.
First, Kenya should adopt proportionate, risk-based regulation. Compliance costs can disproportionately affect smaller businesses. Start-ups should not face the same regulatory burden as multinational technology companies deploying high-risk AI systems at scale.
Obligations should reflect an organisation’s capacity and the potential risks of each application, allowing local innovators room to experiment and compete while protecting consumers.
Second, Kenya must avoid regulatory duplication. AI is increasingly used in banking, healthcare, telecommunications, transport and insurance. Introducing additional approval layers for every deployment could increase costs without improving accountability. Existing sector regulators should oversee AI applications within their mandates, working alongside data protection authorities.
Third, regulatory sandboxes should become practical tools rather than policy slogans. Supervised testing environments would allow developers to identify algorithmic bias, privacy breaches, cybersecurity vulnerabilities and consumer protection risks before commercial deployment. They would also help regulators build technical expertise and understand emerging technologies.
Fourth, implementation should be phased to reflect local readiness. Regulators, businesses and public institutions need adequate time to develop technical skills, infrastructure, standards and enforcement capacity. Even well-designed legislation can fail without the institutional capacity to implement it effectively.
Kenyan businesses must also consider the cross-border implications.
Companies providing technology, outsourcing, data-processing and digital services to European clients may increasingly face expectations to comply with EU AI and data requirements.
These developments therefore have implications beyond Europe.