Kazakhstan Informatization Law

Overview

The Law of the Republic of Kazakhstan of November 24, 2015 No. 418-V was originally enacted as the Law 'On Informatization'. Following legislative reforms under Law No. 256-VIII of January 9, 2026 (which entered into force on July 12, 2026), the statute was officially renamed to the Law 'On Cybersecurity'. This reform shifted the primary focus of Law No. 418-V from general informatization to cybersecurity, the protection of digital objects, and defense of critical digital infrastructure across Kazakhstan.

Definitions

Article 1 of the Law, as amended by Law No. 256-VIII, provides a comprehensive glossary of cybersecurity terminology. It defines 'cybersecurity' as the state of protection of digital objects from violations of their confidentiality, integrity, or availability. Key statutory definitions include 'critical digital objects', 'cybersecurity threat', 'cybersecurity event', 'cybersecurity incident', 'cybersecurity audit', and 'cybersecurity incident response service'. It also defines technical mechanisms such as the National Repository of Source Codes, single Internet access gateways, event logging, and security protection profiles.

Governance and Institutional Framework

The governance structure is led by the Authorized Body in the field of cybersecurity (the central executive body), which oversees state policy and cross-sectoral coordination. Key operational functions are assigned to the State Technical Service—a state entity created by decision of the Government of Kazakhstan—and the National Coordination Center for Cybersecurity. The framework also includes sectoral cybersecurity centers, specialized cybersecurity centers, and cybersecurity incident response services responsible for local monitoring, vulnerability discovery, and incident handling.

Key Focus Areas

One of the primary focus areas of the Law is the continuous development and refinement of the 'Electronic Government.' The law mandates that state bodies must provide services in electronic form, prioritizing the 'proactive' and 'one-stop-shop' principles. This involves the integration of various departmental systems through the 'Smart Bridge' platform, which facilitates secure data exchange between the public and private sectors. The law also emphasizes the 'Open Data' initiative, requiring state bodies to publish non-confidential datasets in machine-readable formats to encourage commercial innovation and public transparency. By centralizing these resources, the government aims to reduce administrative barriers and eliminate the need for citizens to provide paper documents that are already available in state databases. Another significant focus area is the regulation of the National Artificial Intelligence Platform. This platform serves as a unified infrastructure for the development, training, and pilot operation of AI models using state-held data. The law establishes strict rules for accessing this data, ensuring that personal information is anonymized before being used for AI training. Furthermore, the law introduces mandatory labeling for synthetic content generated by AI systems, particularly in the context of mass media and public communications, to prevent the spread of misinformation. The 2025 updates also prioritize 'Digital Sovereignty,' encouraging the use of domestic software and hardware in state informatization projects to reduce dependency on foreign technology providers and mitigate cyber risks.

Implementation Framework

The implementation of informatization projects in Kazakhstan follows a rigorous lifecycle defined by the Law and its subordinate regulations. For state agencies, every project must begin with the development of an 'Architecture of the State Body,' which aligns its IT needs with its functional tasks. This is followed by the creation of investment proposals and technical specifications, which must be approved by the Authorized Body and the State Technical Service. The law promotes the 'Service Model,' where agencies are encouraged to lease infrastructure and software from the National Operator or private providers rather than investing in their own hardware, thereby optimizing budget expenditures and ensuring technical standardization. For AI systems, the implementation framework includes a mandatory risk-based assessment. Before deployment, AI systems are classified into risk categories: low, medium, or high. High-risk systems, especially those used in healthcare, transport, or law enforcement, must undergo a 'Conformity Assessment' to ensure they do not exhibit bias or pose a threat to public safety. The law also requires the appointment of a 'Responsible Person' for the operation of AI systems within an organization. Furthermore, the National AI Platform provides a 'Sandbox' environment where developers can test their solutions under regulatory supervision before full-scale commercial or state deployment, ensuring that innovation does not bypass legal and ethical safeguards.

Data Protection and Localization

A critical pillar of the Informatization Law is the protection of electronic information resources and the enforcement of data sovereignty. The law mandates that all information systems processing the personal data of citizens of the Republic of Kazakhstan must be physically located on servers within the national territory. This localization requirement is designed to ensure that the state can exercise legal jurisdiction over the data and protect it from unauthorized access by foreign entities. Furthermore, the law establishes strict protocols for the classification of information resources into 'state' and 'non-state' categories, with state resources being subject to the highest levels of security and encryption standards. In the context of the 2025 AI amendments, these data protection rules have been extended to the training sets used for machine learning. Developers utilizing the National AI Platform must adhere to 'Privacy by Design' principles, ensuring that data is stripped of identifying characteristics before it enters the training pipeline. The law also grants the State Technical Service the authority to inspect the data centers of private operators to ensure compliance with these localization and security mandates. Failure to comply can lead to the immediate suspension of the information system's operation and significant administrative fines, reflecting the government's view that data security is a fundamental component of national security.

Monitoring and Evaluation

Monitoring and evaluation are critical components of the Law to ensure the efficiency and security of the digital landscape. The Authorized Body conducts annual monitoring of the 'Architecture of the Electronic Government' to identify redundancies and ensure that all state systems are functioning as intended. This includes evaluating the quality of electronic services provided to the public and the level of integration between different state databases. For local executive bodies, the law establishes a 'Digital Maturity' index, which ranks regions based on their success in implementing digital initiatives and providing e-services to their populations. In terms of technical oversight, the State Technical Service (STS) performs mandatory periodic audits of all state-owned information systems and objects of critical information infrastructure. These audits check for vulnerabilities, compliance with encryption standards, and the integrity of data protection mechanisms. With the integration of AI, the monitoring framework now includes 'Algorithmic Audits' for high-risk AI systems. These audits are designed to detect 'black box' issues, where the decision-making process of an AI becomes opaque or discriminatory. The results of these evaluations are used to update the 'National Register of Informatization Objects,' and systems that fail to meet security or performance standards can be ordered to suspend operations until the deficiencies are rectified.

Penalties, Liability, and Appeals

The Law on Informatization establishes a comprehensive liability framework for violations of its provisions. Subjects of informatization—including system owners, operators, and users—bear civil, administrative, or criminal liability depending on the severity of the infraction. Administrative penalties are primarily governed by the Code of the Republic of Kazakhstan on Administrative Offenses (KAP). Common violations include the failure to ensure the security of information systems, the illegal collection or processing of electronic information resources, and the non-fulfillment of requirements regarding the localization of data on servers within Kazakhstan. For AI systems, specific penalties have been introduced for the failure to label synthetic content or for deploying high-risk systems without the required safety certifications. Liability for harm caused by automated systems, including AI, follows the principle of 'Responsibility by Role.' This means that the owner or operator of the system is generally liable for damages caused by the system's output unless they can prove that the harm resulted from unauthorized interference or a failure by the user to follow instructions. The law also provides a robust appeals process. Citizens and legal entities have the right to challenge the decisions of state bodies or the outcomes of automated processes through the Administrative Procedural and Process-Related Code (APPC). In the case of AI-driven decisions, individuals have the specific right to request a human review and a detailed explanation of how the automated decision was reached, ensuring that technology does not undermine the right to due process.

Relationship to Other Instruments

The Law on Informatization does not operate in isolation but is part of a broader legal ecosystem. Its most significant relationship is with the Law 'On Personal Data and its Protection' (No. 94-V). While the Informatization Law provides the technical framework for data systems, the Personal Data Law provides the rights-based framework for how that data is handled. Any object of informatization that processes personal data must comply with both statutes, including requirements for explicit consent and data localization. The law also intersects with the Law 'On Communications,' which regulates the physical networks and telecommunications infrastructure that transport the data generated by informatization objects. Furthermore, the law is closely linked to the Law 'On Digital Assets,' which regulates the mining and circulation of cryptocurrencies and other digital tokens. The 2025 amendments ensured that the National AI Platform and digital asset infrastructures are interoperable, particularly concerning the use of high-performance computing resources. In the realm of intellectual property, the Informatization Law works alongside the Patent Law and the Law on Copyright to determine the ownership of software codes and AI-generated content. Specifically, the law now clarifies that works created solely by AI without human creative input do not receive copyright protection, whereas the 'prompts' and creative requests of users may be protected as intellectual property.

International Alignment

Kazakhstan has designed the Law on Informatization to align with international standards and regional agreements. As a member of the Eurasian Economic Union (EAEU), Kazakhstan harmonizes its digital regulations with the EAEU Digital Agenda, which focuses on cross-border data exchange, digital trade, and unified technical standards for information systems. This alignment ensures that Kazakhstani IT companies can operate more easily within the EAEU market and that state systems are compatible with those of neighboring member states. The law also references international technical standards, such as ISO/IEC for information security management, which are mandatory for critical infrastructure operators. In the context of AI and emerging technologies, Kazakhstan has looked toward the OECD Principles on Artificial Intelligence and the European Union's AI Act for regulatory inspiration. While the Kazakhstani law is less prescriptive than the EU's framework, it adopts a similar risk-based approach and emphasizes transparency, safety, and human-centricity. The law also supports international cooperation in the field of cybersecurity, mandating that the State Technical Service collaborate with international computer emergency response teams (CERTs). By maintaining this international alignment, Kazakhstan aims to improve its standing in global rankings, such as the UN E-Government Development Index, and to attract foreign investment in its growing technology and AI sectors.

Implementation Timeline

The statutory implementation timeline includes the following milestones:

Sources and References

The official text of Law No. 418-V is published and maintained on the Adilet Information and Legal System of the Ministry of Justice of the Republic of Kazakhstan. The statutory framework rests on the Constitution of the Republic of Kazakhstan, federal statutes, and international treaties ratified by Kazakhstan. The law has been modified through major amending statutes, including Law No. 256-VIII of January 9, 2026, which changed the title of the act to 'On Cybersecurity' and updated its provisions regarding digital objects and cybersecurity supervision.