What is AI regulation in Kazakhstan?

How it works

The core instruments

Kazakhstan's AI governance rests on four pillars. First, the strategy layer: the Concept for the Development of Artificial Intelligence for 2024-2029, approved by Government Resolution No. 592 of 24 July 2024, sets targets and mandates infrastructure such as the National AI Platform. Second, the dedicated statute: Law No. 230-VIII "On Artificial Intelligence" (signed 17 November 2025, in force 18 January 2026), consisting of seven chapters and 28 articles. Third, the amendment law No. 231-VIII, which aligned the personal data law, consumer-protection law, mass-media law, informatisation law and digital-assets law with the AI rules. Fourth, the Digital Code No. 255-VIII (enacted 9 January 2026, effective 11 July 2026), which regulates the broader digital environment and treats AI systems as "digital objects". The older Law "On Informatization" (2015), which had introduced the concept of an "intelligent robot" and a national AI platform, previously provided the only indirect AI rules.

Legal status and effective dates

The AI Law is in force as of 18 January 2026; its subordinate regulatory framework is being built out progressively through 2026 under an implementation plan approved by Prime Minister's Order No. 2-r of 14 January 2026. Some implementing acts, such as criteria for classifying informatization objects as AI systems, have been adopted, while others remain in development. The Digital Code is enacted but not yet applicable, taking effect on 11 July 2026. The 2013 personal data law remains in force and was amended by No. 231-VIII. Leaders should treat the AI Law itself as settled but expect the detailed by-laws (documentation lists, audit rules, machine-readable form standards) to keep arriving through 2026.

How AI is defined

The AI Law defines artificial intelligence as "the functional ability to imitate cognitive functions characteristic of humans, providing results comparable to or exceeding the results of human intellectual activity". An "AI system" is an informatization object functioning on the basis of one or more AI models; an "AI model" is a software product able to learn from experience and adapt. "Synthetic outputs" are images, video, audio or text created or modified by an AI system that imitate a real person's appearance, voice or behaviour, or events that did not occur. The law also defines "data library" (a collection of structured data suitable for training models) and "machine-readable form".

The risk-based and autonomy classification

The law uses a two-dimensional classification. By impact on safety and rights, AI systems are minimal, medium or high risk: minimal where failure has little user impact; medium where failure could cause material damage or moral harm; high where disruption could trigger a social or man-made emergency or significant harm to defence, security, the economy, infrastructure or individuals. Classification is performed by the owner or holder under informatization-object rules. Separately, systems are classified by autonomy: low (human takes all final decisions), medium (autonomous decisions that a human can correct or cancel) and high (human correction excluded or technically impossible). High-risk and high-autonomy systems attract additional requirements, and special rules for high-autonomy systems are to come through separate legislation.

Prohibited practices

The law bans creating or operating AI systems that use subliminal or manipulative techniques that distort behaviour and impair informed decision-making; exploit vulnerabilities of age or disability to cause harm; perform social scoring based on behaviour or personal characteristics (except where law permits); determine emotions without consent (with legal exceptions); classify people by biometric data for discriminatory purposes; or collect and process personal data in breach of the data-protection law. These prohibitions mirror the EU AI Act's banned-practices list.

Duties on developers, owners, holders and users

The law assigns responsibility by role across the lifecycle. Owners and holders must manage risks continuously (identifying foreseeable risks, assessing misuse, applying mitigations and updating at least annually); ensure security and reliability, including protection from unauthorised access; maintain documentation proportionate to the system's impact; support users; and provide the user agreement before use begins. Where prohibited-practice risks emerge, they must act immediately to prevent harm, including suspending the system. Users have rights to review the user agreement, have personal data protected, receive explanations of AI decisions affecting them, request information on the data underlying decisions, object to automated processing and decline AI interaction unless legally required.

Transparency, labelling and synthetic content

Synthetic outputs may only be distributed if labelled in machine-readable form and accompanied by a visible or otherwise perceptible warning, with special attention to deepfakes involving real people's images or voices. Users must be told when goods, works or services are produced using AI, and the responsibility for informing users about synthetic outputs rests on owners and holders. Mass-media products created using AI may only be distributed with the required disclosure. Labelling can take forms such as a "Created with AI" mark, a text notice, or an audio message.

Institutions and the National AI Platform

The authorised body is the Ministry of Artificial Intelligence and Digital Development, created by Presidential Decree No. 997 of 18 September 2025 from the former Ministry of Digital Development, Innovations and Aerospace Industry. It exercises strategic, regulatory, implementation and supervisory functions, approves the documentation list and sets classification criteria. The Government approves the list of priority economic sectors for AI and designates the National AI Platform operator; National Information Technologies JSC is the designated operator. Sector-specific state bodies compile and publish lists of "trusted" high-risk AI systems and create industry data libraries. The platform provides a controlled environment for development, training and pilot operation, and routes access to compute via Alem.Cloud, built on 64 HGX servers with 512 NVIDIA H200 GPUs and delivering up to 2 exaflops at FP8; it is described as the most powerful supercomputing cluster in Central Asia and was ranked 86th in the global TOP500 list. It is hosted at the Alem.AI centre.

Trusted high-risk systems and audit

For high-risk systems seeking inclusion on a sector "trusted" list, the owner or holder must submit an application, proof of intellectual-property rights and a positive audit conclusion. Audits follow the rules for auditing information systems and additionally assess the quality and lawfulness of training data libraries and the absence of prohibited functional capabilities. The relevant agency reviews within 10 working days and publishes approved entries. Participation in trusted lists is a route to building confidence rather than a universal prerequisite, though high-risk systems forming part of critical digital infrastructure face mandatory obligations.

Enforcement and penalties

Administrative liability sits in the Code of Administrative Offences and covers two failures: not informing users about misleading synthetic outputs, and not managing high-risk-system risks where harm, prohibited or false information, discrimination or rights violations result (and the conduct is not a crime). Fines run from 15 monthly calculation indices for individuals up to 100 for large businesses on a first offence, rising on repeat offences within a year, with possible suspension or prohibition of the system. The monthly calculation index is 4,325 tenge effective 1 January 2026 (up from 3,932 tenge in 2025), set by the 2026-2028 Republican Budget Law and equivalent to about USD 8.5. Compensation for harm caused by AI systems follows the Civil Code, and liability insurance follows insurance legislation; the Senate added a mandatory liability-insurance requirement during passage.

Copyright and training data

Works made with AI are protected by copyright only where there is human creative contribution; purely autonomous outputs are not protected, since authorship remains reserved for natural persons. Creatively formulated prompts can themselves be copyright objects. Using works to train AI is permitted only where the rights-holder has not set a machine-readable prohibition (an opt-out), and training does not fall under free-use exceptions for education or science.

The data-protection framework and how it meets AI

The Law "On Personal Data and Their Protection" (No. 94-V of 2013) is the data backbone. It requires personal data to be stored in databases located in Kazakhstan (the localisation rule effective 1 January 2016) and permits cross-border transfer only to states ensuring adequate protection, or otherwise with the data subject's consent, under ratified treaties or specified public-order grounds. Processing generally rests on consent, and consent validity may not exceed the period needed to achieve the collection purpose. A breach-notification duty requires notifying the authorised body within one working day of detection, effective 1 July 2024. The authorised body is the Ministry of Artificial Intelligence and Digital Development (operating through its Information Security Committee), while the Prosecutor General's Office exercises supreme supervision. The amendment law No. 231-VIII updated the personal-data definition to include biometric data, introduced rules on automated processing and tightened consent-withdrawal handling.

Comparison with the EU AI Act and international standards

The drafting is explicitly inspired by the EU AI Act and by OECD and UN frameworks, sharing a risk-based structure and a banned-practices list. But it is materially leaner: the EU Act runs to 113 articles and 13 annexes against Kazakhstan's 28 articles, and the Kazakh law leans towards a user-centred model rather than the EU's detailed split between providers, importers and deployers. Kazakh scholars have flagged gaps relative to the EU model, including a less detailed risk-classification system, weaker transparency obligations for generative models, limited personal-data safeguards and thinner enforcement institutions. Kazakhstan has endorsed OECD AI principles as part of its OECD-accession ambitions and positions the Digital Code as a model for Eurasian Economic Union digital harmonisation.

Central Asian and state-led context

Kazakhstan frames AI as a state-building project. It established a dedicated AI ministry, launched Central Asia's most powerful supercomputer in July 2025 at the Alem.AI national centre in partnership with the UAE firm Presight (part of the G42 group), built sovereign large language models (KazLLM, developed at the Institute of Smart Systems and Artificial Intelligence at Nazarbayev University, and AlemLLM) and piloted government AI agents. The President declared 2026 the Year of Digitalization and Artificial Intelligence, and a unified "Digital Qazaqstan" strategy is in development. Kazakhstan ranked 24th of 193 countries (up from 28th in 2022) and 10th globally on the Online Services Index in the UN E-Government Survey 2024, and presents itself as the regional digital frontrunner.