Kenya's CA Opens 2026/27 Emerging Technologies Sandbox: The 8-Day Window Founders Cannot Miss

For the next eight days, Kenya's Communications Authority (CA) is taking applications for its 2026/27 Emerging Technologies Regulatory Sandbox. The window opened on 7 July 2026 and closes on 30 July 2026. The application portal is sandbox.ca.go.ke, the notice is signed by Director General David Mugonyi, and the sectors in scope are not subtle: 5G and early 6G applications, AI products across e-learning and e-health, IoT and Machine-to-Machine (M2M) communications, Over-the-Top (OTT) services, digital broadcasting, and cybersecurity tools.

The line every founder should read twice is what kind of organisation the CA is inviting. Innovators, entrepreneurs, technology companies, and researchers. Not just mobile network operators. Not just telcos. Founders building AI for radiology, founders shipping an M2M fleet layer for logistics, founders prototyping a 5G fixed-wireless access box for a county hospital — the door is open.

What the sandbox actually is

The CA's sandbox is a controlled environment in which innovators can test novel digital communication products, services, and business models that potentially fall outside existing regulatory frameworks, under the Authority's supervision and before taking them fully to market. That is the definition regulators use, but the strategic meaning is sharper. A sandbox is a place where a founder does not get sued first and approved later. The regulator looks over your shoulder while you are still in private beta.

The 2026/27 sandbox is built on the same model the Capital Markets Authority (CMA) and the Insurance Regulatory Authority (IRA) have used since 2019 and 2020 respectively. The CMA sandbox produced Pezesha, a Kenyan debt-based crowdfunding platform that used its time inside the sandbox to help shape the very regulations that govern Kenyan debt-based crowdfunding today. The lesson is that the sandbox does not just test products. It tests regulation. The CA is signalling that it is willing to write the rulebook with you, not after you.

What is in scope

The CA's public notice is explicit about the technologies it wants to see. The list is broad enough to be useful and narrow enough to be serious.

5G and early 6G applications. Kenya's 5G rollout is uneven, and the regulator is still drafting the technical rules for new spectrum use cases. A sandbox applicant gets a forum to push the regulator on what is and is not permissible, with a real product in hand.

Artificial intelligence. E-learning platforms that deploy AI, e-health platforms that deploy AI, and AI products inside digital broadcasting all fall in scope. This is the first time the CA has named AI as a sandbox category in a public notice this explicitly, and it tracks with the Ministry of ICT's national AI policy work that is currently in flight.

IoT and M2M communications. Kenya's telco-grade IoT footprint is still small, but the application layer is growing fast. Logistics, agriculture, and energy are the three verticals most often cited.

OTT services. WhatsApp voice, Telegram channels, Zoom — these already operate in Kenya. The sandbox gives newer entrants a route to a structured dialogue with the regulator instead of the current grey-zone operations.

Cybersecurity tools. This is a notable inclusion. With Kenya's cyber threat volume reported in the billions per quarter, the regulator is now treating defensive tooling as a sector worth cultivating, not just regulating.

What the application actually requires

The CA's seven evaluation criteria are listed in the public notice. Founders should plan around them.

• Genuine innovation. The CA is not looking for another mobile wallet. It is looking for a product that does not fit cleanly inside the existing rulebook.


• Consumer benefit. The product must add real value to a Kenyan user or business, not just a foreign investor's pitch deck.


• The need for sandbox testing. If your product can launch without a sandbox, the CA will tell you to launch without a sandbox.


• Test readiness, with defined scenarios and outcomes. Vague applications get filtered early.


• Consumer protection. The product cannot put Kenyan users at risk during the test.


• Risks and their mitigation. Be honest about what could go wrong.


• A credible exit strategy. The CA wants to know how you will leave the sandbox, not just how you will enter it.

The documents required are also spelled out. A fully completed online application form. Certified copies of all registration documents. A certified list of directors. Founder and key management CVs. An outline of the business model. A projected plan and clear strategy for exiting the sandbox. The list is the standard African regulatory-sandbox list. What is unusual is that the CA is doing it without charging an application fee, which lowers the friction for early-stage founders but does not lower the operational cost of running a supervised test.

The friction founders should plan for

The sandbox is not free. The CA charges no application fee, but the innovator funds their own testing. For a pre-seed AI health platform, that is a real budget line. Founders should plan for hosting, data labelling, security audits, and a compliance officer before they plan for marketing.

The second friction is product maturity. The CA requires a fully developed solution. This is a sandbox for a working beta, not a sandbox for an idea on the back of a napkin. If you are still in the design phase, you will need to ship enough of the product to demonstrate test scenarios before you apply.

The third friction is the application itself. The CA weighs seven areas, and the seven are not optional. A weak business model document or a thin exit strategy will drop an application before it reaches the screening committee.

What successful applicants gain

The benefits are real. A safe testing environment with regulatory oversight and flexibility. Direct feedback and guidance from the CA and other stakeholders. Lower time and cost to launch, because compliance is resolved early instead of litigated late. Access to a network of potential partners, investors, and customers — the sandbox is a curated room, not an open hallway.

The strategic signal is the most important benefit of all. A successful sandbox exit gives a Kenyan AI, 5G, or cybersecurity company a credible regulatory history. When a Series A investor or a continental partner asks whether the product is regulator-ready, the answer is not a slide in a deck. It is a public record from the CA.

The four-week track to 30 July

For founders who want to apply, the next four weeks are a sequence.

Week one: confirm eligibility. The applicant must be a company incorporated in Kenya, or licensed by an ICT market regulator in an equivalent jurisdiction, and must intend to offer the product in Kenya following a successful exit. If the company is not yet incorporated, that is the first task.

Week two: write the application. The seven evaluation criteria are the document outline. The CVs, the business model, the exit strategy, and the test scenarios are not optional.

Week three: submit, get screened, and respond to CA questions. The CA's screening process is not a black box — the public notice names the criteria, which means the founders who match the criteria win.

Week four: prepare for supervised testing. The founders who enter the sandbox with a 90-day test plan are the founders who exit on time.

What to watch

Three signals in the next two months will tell us whether the 2026/27 sandbox is producing real products or just paperwork. First, the count of AI applications — the CA has named AI as a sandbox category for the first time, and the volume will tell us whether Kenya's AI founders treat the regulator as a partner or a gatekeeper. Second, the 5G and 6G cohort — the regulator is signalling that it wants to see early 6G thinking, and that is a forward-looking bet. Third, the cybersecurity cohort — including defensive tools inside a sandbox is a structural shift, and the founders who take advantage will be the ones who set the standard for what regulated defensive AI looks like in Kenya.

The 30 July deadline is real. The CA has signed the notice. The portal is open. The question for Kenyan AI, 5G, IoT, and cyber founders is not whether the regulator is serious. The question is whether the founders are.

Apply at sandbox.ca.go.ke.