The Communications Authority of Kenya has opened applications for its Emerging Technologies Regulatory Sandbox, and the framing has been irresistible: startups will finally get to test artificial intelligence, 5G, 6G and Internet of Things in a safe, supervised space before unleashing them on the market.
It sounds like progress. It photographs like progress. It is not progress. It is a portal.
Let me be precise, because precision is exactly what these announcements are designed to make you skip.
The CA did not think of this last week. It began “developing” this sandbox in January 2023, when it opened a public consultation on the framework.
That is three years between the idea and an online form at sandbox.ca.go.ke. Three years of consultation, stakeholder engagement, and framework revisions to arrive at a place where you can upload a PDF and wait.
Getting the scaffolding right matters. But three years to make operational a testing environment is not diligence, it is drift. In three years, the technologies the sandbox claims to be preparing for have already shipped, scaled and in some cases, already caused the harm the sandbox exists to prevent. Which brings me to the part nobody wants to say out loud.
The tool always arrives after the damage
In 2023, while the CA was busy consulting on how it might one day regulate emerging technologies, Worldcoin was on the ground in Nairobi paying Kenyans to scan their irises in exchange for crypto.
Real biometric data, real people, real queues snaking around Nairobi malls. The government eventually halted it and hauled the operators before a parliamentary committee.
And what did the CA director general tell that committee? That sandboxing was the best way to regulate innovations like this.
Read that again. The regulator’s proposed solution to a harm that had already happened was a tool that did not yet exist and would not exist for three more years.
That is the entire problem with sandbox theatre in one story: the sandbox is always the answer to the last crisis, never ready for the next one. The iris scans were already in a database in San Francisco by the time anyone reached for the shovel and pail.
‘AI applications’ that aren’t really about AI
Here is the sleight of hand in the current announcement. The headlines say “AI”. The tweets say “AI”. But read the CA’s actual eligibility list and a pattern emerges.
It welcomes AI in e-learning platforms. AI in e-health and telemedicine. AI-driven services for the telecommunications sector. Smart-city traffic tools. Drone applications. In other words, it welcomes the AI that is easy to photograph and safe to celebrate: the classroom app, the wearable, the delivery drone.
Now notice what is not on the list. The opaque credit-scoring algorithm quietly redlining borrowers in Eastlands. The deepfake engineered to flood a 2027 campaign. The hiring model silently filtering out CVs from the wrong postcode.
The foreign large language model (LLM) trained on Kenyan data with zero local accountability. The AI that actually decides things about people’s lives, the accountability-heavy, litigation-adjacent, genuinely dangerous category, is precisely the category the sandbox leaves to no one.
That is not an accident of drafting. Scope is a choice, and this scope cherry-picks. It claims the sweeping “AI governance” headline while quietly confining itself to the consumer-friendly, telco-adjacent lane the CA already controls and abandoning the AI that keeps regulators up at night in every serious jurisdiction on earth. Which is exactly where Kenya starts to look isolated.
The world Kenya claims to lead is already doing this properly
Here is the part that should sting. While Kenya was spending three years drafting a framework for classroom apps and delivery drones, other countries were building AI sandboxes with actual reach.
Brazil launched a national AI regulatory sandbox before it even had an AI law, and pointed it straight at the hard stuff: machine-learning and generative-AI systems overseen by the national data protection authority, with academics and civil society in the room.
Singapore built a Generative AI Evaluation Sandbox that pulls model developers, deployers and independent third-party testers together to actually stress-test frontier models and hammer out shared evaluation standards. These are sandboxes aimed at the technology that matters, run by agencies with the mandate to match.
Kenya, by contrast, produced a testbed for e-health wearables supervised by the telecoms regulator. We love to call ourselves the Silicon Savannah and Africa’s innovation capital. But on the specific question of governing AI where it is genuinely risky, we are not leading the continent, let alone the world.
We are shipping a narrower tool, later, with less power and calling it leadership.
A sandbox with no teeth is just a suggestion box
Strip away the vocabulary and ask the only question that matters: what happens after the test?
In a real sandbox, the regulator watches you operate under relaxed rules, gathers evidence and then does something with it. Kenya’s Capital Markets Authority version at least has that muscle.
Firms run for up to 12 months, submit incident reports and the regulator either approves them, writes new regulation off what it learned, or blocks them outright.
Pezesha’s crowdfunding trial directly produced Kenya’s debt-crowdfunding rules. That is a sandbox with a legislative output. Pezesha is a digital lending ecosystem providing working capital loans to micro small and medium enterprises in sub-Saharan Africa.
The CA’s version has published no equivalent track record, no roster of graduated participants, no new regulations born from testing, no evidence of consequences for players who cause harm inside the box. What it has is a portal, a July 30 deadline and a promise that the authority will “evaluate and communicate the outcome.”
Evaluate against what standard? Communicate to whom? Enforce how? A sandbox that cannot bind anyone to anything is not regulation. It is a suggestion box with better branding.
And here is the irony the CA seems determined not to notice. The single greatest technology success this country has ever produced, M-Pesa, was born in 2007 with no sandbox and no framework at all.
The regulators simply extended trust, watched closely and let it run. Kenya’s crown jewel is living proof that breakthroughs come from regulatory courage, not regulatory choreography.
Yet nearly two decades later, the instinct has inverted: three years of paperwork to produce a login page for delivery drones. We learnt the wrong lesson from our own best story.
Why this matters, and who it’s really for
None of this is harmless PR. Regulatory theatre has a cost, and the cost is trust and time.
It gives the government a governance headline without the burden of governing. It lets us tell the world Kenya is “leading Africa on AI regulation”, while the actual hard problems, data governance, algorithmic accountability, biometric protection, sit untouched because they are difficult, contested and un-photogenic.
And it gives cover: the next time a Worldcoin-shaped problem walks into the country, someone will point to the sandbox and say the framework exists. It won’t. Not for that.
The genuine tragedy is that Kenya could lead here. We have the talent, the mobile-money precedent, the fintech-sandbox muscle memory and a National AI Strategy that at least names the right ambitions.
The raw material for real, teeth-bearing, African-authored AI governance is sitting right here. What we keep shipping instead is the announcement of the announcement.
What real would look like
Criticism that offers nothing isn’t worth much, so here is the standard this sandbox should be held to:
A sandbox worth applauding would point at the hard AI the way Brazil and Singapore do, the models that decide on credit, jobs and votes, not just the classroom apps and delivery drones that are safe to celebrate. It would publish its participants, its outcomes and its failures.
It would carry statutory power to convert what it learns into binding rules on a clock measured in months, not years.
It would name real consequences for players who harm consumers mid-test. And it would be run by an agency whose mandate actually spans the technologies it claims to govern, rather than one stretching a communications remit to cover a civilisational one.
Until then, let’s call this what it is. Applications are open. A portal is live. A deadline is set. That is administration, not governance.
And clapping for a login page is how a country talks itself into believing it has solved a problem it has not yet begun to face.
The sandbox is open. The question is whether anything gets built in it, or whether we’re all just admiring the bucket.
Abdirahman is a software engineer and technologist building AI products and infrastructure across Africa. He is the Founderand ME of AIVERSE Africa, and writes on the gap between continent’s AI ambitions and regulatory reality
