Kenya Health Act 2017 Part VII: Single Regulator, Licences and Standards

Content verification date: October 30, 2026

1. Key takeaways

• The Health Act, 2017 is Kenya’s No. 21 of 2017, assented June 21, 2017 and effective July 7, 2017; Section 1 provides that it comes into operation 90 days after publication.
• Part VII, Sections 62–67, is a dedicated chapter on the regulation of health products and technologies: Section 62 establishes a single regulatory authority; Section 63 functions; Section 64 conditions; Section 65 licences; Section 66 standards; Section 67 procurement.
• The single regulatory authority design in Section 62 is precisely the parent-statute pointer behind the current proposal for the KHPTA to take over PPB functions — Section 62 and the institutional-change legislation are connected.
• Part XV, Sections 103–105, governs e-Health, electronic legislation and health information systems, and is the parent-statute basis for digital health devices.
• In Section 2, a health technology is defined as the organized knowledge and skills applied in the form of devices, medicines, vaccines, procedures and systems, developed to solve health problems and improve quality of life.

2. Legal basis

3. Expert insights

Insight 1: Section 62 is the legal origin of institutional consolidation in Kenyan device regulation

Section 62 of the Health Act requires the establishment of a single regulatory authority for health products and technologies. That design appeared nearly 7 years before the current KHPTA legislation, yet it has long remained unimplemented — the authority actually exercising device powers is still PPB, established under Cap. 244. GRZAN’s reading: Kenya’s regulatory reform follows the path of setting the target architecture in law first, then migrating functions step by step, rather than a one-off reorganization. Companies should treat Section 62 as a stable signal about the direction of reform: the direction of consolidation is settled; the pace is not.

Insight 2: Sections 65 and 66 separate licences from standards, mapping to two sets of compliance actions

Part VII places licences and standards in two independent provisions. GRZAN’s note: this explains the two-track structure of device compliance in Kenya — Section 65 corresponds to PPB registration and the various licences (practice, wholesale, manufacturing), while Section 66 corresponds to KEBS standards and conformity assessment (PVoC / CoC). A common error is to complete PPB registration and ship immediately, only to be stopped on the standards track under Section 66.

Insight 3: Section 67 writes procurement into the regulatory chapter — a substantive variable for tender-driven companies

Section 67 is dedicated to the procurement of health products and technologies. GRZAN’s judgment: this brings government procurement and public health facility purchasing into the same statutory framework, meaning products entering public procurement channels such as KEMSA must satisfy procurement-side qualification and standard requirements in addition to PPB registration. For companies whose main channels are public hospitals and government programmes, procurement compliance should be planned alongside registration compliance, not after the certificate arrives.

Insight 4: Sections 103–105 are the parent-statute anchor for digital health devices

Part XV contains Section 103 on e-Health, Section 104 on electronic legislation and Section 105 on health information systems; Section 2 defines e-Health as the integrated use of electronic communication and information technology in the health sector, including telemedicine. GRZAN’s reading: telemedicine and standalone medical software are not beyond the law in Kenya — their legality traces back to Section 103 of the Health Act, while data compliance duties fall under the Data Protection Act, No. 24 of 2019. The two statutes form a dual parent-statute for digital health devices.

4. Practical recommendations

1. Treat Section 62 as a reform-direction signal, not a current duty. The compliance counterparty today remains PPB, but internal planning should build redundancy around the post-consolidation architecture.
2. Run the licence and standards tracks in parallel. Start PPB registration (Section 65) and KEBS conformity assessment (Section 66) at the same time.
3. Align procurement compliance early for tender-driven companies. Products destined for public procurement channels should be checked in parallel against procurement-side qualification, standard and registration requirements.
4. Apply dual-statute compliance to digital health products. Build an obligation list against both Sections 103–105 of the Health Act and the Data Protection Act, No. 24 of 2019.
5. Watch county-level responsibilities in the health system. Sections 19–21 of the Health Act contain specific provisions on county government health systems and coordination mechanisms; check them when planning cross-county distribution and installation services.
6. Retain the version of the legal text. The Health Act may be amended by KHPTA legislation; when citing it, note the version relied upon and the verification date.

5. Verification checklist

• □ Has the cited version of the Health Act been confirmed as No. 21 of 2017 (assented 2017-06-21 / effective 2017-07-07)?
• □ Have the two compliance tracks under Section 65 (licences) and Section 66 (standards) been distinguished?
• □ Have PPB registration and KEBS conformity assessment been scheduled in parallel?
• □ Have Section 67 procurement requirements been checked for tender-driven products?
• □ Have digital health products been mapped against Sections 103–105?
• □ Has the applicability of the Data Protection Act, No. 24 of 2019, been checked in parallel?
• □ Does internal planning leave redundancy for the architecture once the single regulatory authority lands?
• □ Do documents citing the Health Act state the version and verification date?

Regulatory information verified as of October 30, 2026.

In African markets, the GRZAN regulatory team focuses on jurisdictions including Kenya, Nigeria, South Africa and Egypt and maintains a verification mechanism built on primary regulatory sources: every regulatory conclusion published externally is based solely on official gazettes, the original text of agency guidelines and public legal databases, with the verification date stated; figures, timelines and amounts that cannot be located in official sources are marked as practical estimates, with no assumptions made.

GRZAN services cover: market access strategy and risk classification; preparation and review of registration dossiers (CSDT / STED / CTD formats); selection and management of Local Authorized Representatives (LAR); quality management system and GMP / GSDP compliance support; post-market vigilance, change management and recall response; import clearance and PVoC coordination; regulatory intelligence subscriptions and corporate compliance ledgers.

For a Kenya market access plan tailored to your product, contact the GRZAN regulatory team at info@grzanglobal.com.