The proposed KSh194 billion artificial-intelligence data centre in Mombasa is remarkable not merely for the size of the proposed investment, but for the regulatory questions it presents. Greek energy company Amaco Energy Group has proposed a US$1.5 billion facility designed to operate independently of Kenya’s national grid, using its “Hercules” concept to integrate LNG-powered electricity generation, cooling and AI-ready data-centre infrastructure. The Government has confirmed discussions with Amaco on the integrated LNG-powered data-centre proposal, while Amaco has subsequently announced a partnership with GE Vernova for gas turbines for the project. The proposal nevertheless remains subject to approvals and is not yet an operational facility.
The legal significance is that Kenya may be approaching a point where a project can no longer be neatly classified as simply a “data centre”. The Mombasa proposal potentially sits at the intersection of telecommunications regulation, data protection, AI governance, energy licensing, environmental law and maritime regulation. The challenge for Kenyan law is therefore one of regulatory coordination as much as regulation itself.
The Communications Authority of Kenya (CA) is already confronting this question. Its current consultation proposes a standalone Data Centre licence, replacing the treatment of co-location data centres under the Network Facilities Provider framework. The proposed licence would cover entities providing co-location data-centre services and attendant supporting services. That development recognises that the physical infrastructure supporting digital services has acquired regulatory importance of its own. A hyperscale AI facility introduces questions around resilience, cybersecurity, connectivity, operational standards and the concentration of computing capacity that are not necessarily captured by traditional telecommunications licensing. Yet the CA proposal is still a regulatory proposal, not a basis for treating the proposed Mombasa facility as already subject to a dedicated data-centre licence. The legal issue is therefore whether Kenya should license data centres, but whether licensing regimes across different regulators can be coordinated sufficiently to avoid a project being simultaneously subject to fragmented and potentially overlapping requirements.
The Data Protection Act 2019 provides another reason why location matters. Section 50 permits the Cabinet Secretary to prescribe categories of processing which, on grounds including strategic state interests or protection of revenue, must be undertaken through a server or data centre in Kenya. The Data Protection (General) Regulations 2021 give effect to localisation requirements for specified strategic-interest processing, while the Act and Regulations establish conditions and safeguards for transfers of personal data outside Kenya. This does not mean that Kenyan law generally requires all Kenyan data to remain in Kenya. Cross-border transfers are permitted subject to the statutory conditions, while specified categories of processing attract localisation requirements. That framework makes domestic data-centre capacity legally significant: for certain workloads, local infrastructure is not merely a commercial preference but part of the compliance architecture.
Kenya’s regulatory framework is also moving beyond data protection. The Artificial Intelligence Bill, 2026, currently before Parliament, proposes an Office of the Artificial Intelligence Commissioner and a four-tier risk classification system comprising unacceptable, high, limited and minimal-risk systems. For high-risk systems, the Bill proposes risk and human-rights impact assessments, transparency and explainability requirements, cybersecurity safeguards and record-keeping obligations. However, an AI data centre is not necessarily itself an “AI system”. The Bill primarily regulates providers and deployers of AI systems, rather than the concrete, servers and power infrastructure on which those systems operate. A facility may host numerous AI systems belonging to different customers, each potentially attracting different regulatory obligations.
The eventual legal question will therefore be how the AI regime interfaces with data-centre operators, cloud providers, data controllers and deployers. Without clear allocation of responsibility, the same physical infrastructure could sit at the centre of several overlapping compliance regimes without a clear statutory answer as to where responsibility begins and ends.
The Hercules proposal makes the regulatory picture still more complex. Electricity generation in Kenya is ordinarily subject to licensing under the Energy Act; section 117 requires a person undertaking electricity generation, subject to the statutory exception for own-use generation not exceeding one megawatt, to obtain the requisite licence. If the project proceeds with an offshore floating generation facility, the energy approvals will not be the end of the inquiry. NEMA requires environmental impact assessment and approval for projects likely to have significant environmental effects before implementation. The maritime dimension would also engage the Kenya Maritime Authority’s mandate over offshore installations and marine pollution, while the Merchant Shipping Act expressly addresses fixed and floating platforms within Kenyan continental waters and provides for protection of the marine environment from pollution.
The real legal significance of Mombasa’s proposed AI facility is that Kenya is not simply being asked to approve another data centre. It is being asked to regulate an integrated digital, energy and potentially offshore infrastructure project using legal regimes that were developed largely in separate regulatory silos. The success of the project, therefore, may depend as much on regulatory clarity as on capital, computing capacity or power availability.
