Kazakhstan AI Regulation Overview

Overview

Kazakhstan's national approach to artificial intelligence (AI) governance reflects a rapid evolution from general digital administration to targeted, risk-based AI regulation. Historically grounded in Law No. 418-V of November 24, 2015 (originally the Law 'On Informatization', renamed to the Law 'On Cybersecurity' by Law No. 256-VIII in 2026), the framework has been expanded through comprehensive legislative acts, including the standalone Law 'On Artificial Intelligence' enacted in late 2025 and the me overarching Digital Code of the Republic of Kazakhstan (RAI-KZ-NA-DIGITAL-2026), which enters into force on July 1, 2026. This legal architecture aims to balance technological innovation with human-centric safeguards, public safety, and national digital sovereignty.

Strategic development is directed by major executive policy frameworks, most notably the 'Concept for the Development of Artificial Intelligence for 2024–2029' (approved by Government Resolution No. 592) and the 'Concept of Digital Transformation, ICT Industry Development and Cybersecurity for 2023–2029' (Resolution No. 269). These policies prioritize national computing infrastructure—including state data centers, supercomputing capacity, and the National AI Platform—to enable model training and testing using state datasets across key economic sectors while maintaining rigorous oversight.

Regulatory Approach

Kazakhstan employs a hybrid regulatory approach that combines binding statutory requirements with voluntary soft-law guidelines. Hard-law obligations are established under the Law 'On Artificial Intelligence', the Digital Code, and amendments to the Code of Administrative Offences (Law No. 232-VIII). This legal pillar adopts a three-tier risk classification (low, medium, and high risk). High-risk AI systems—defined as those capable of significantly impacting human health, safety, fundamental rights, or public order—are subject to mandatory pre-deployment testing, continuous lifecycle risk management, technical documentation maintenance, and conformity assessments. Certain AI functionalities are explicitly prohibited, including manipulative behavioral influence technologies and unauthorized biometric surveillance in public spaces.

Complementing statutory mandates, soft-law principles are codified in the National Ethical Code in the Field of Artificial Intelligence (2024). Operating under a voluntary signatory model, the Ethical Code establishes six foundational principles: Human-Centricity, Safety and Reliability, Transparency and Explainability, Accountability, Fairness and Non-Discrimination, and Environmental Sustainability. Organizations implementing the Ethical Code are encouraged to adopt an 'Ethics by Design' model, appoint organizational Ethics Commissioners, and perform ethical impact assessments during software development.

Key AI Legislation

• Digital Code of the Republic of Kazakhstan (2026): A comprehensive legislative instrument (RAI-KZ-NA-DIGITAL-2026) consolidating digital legislation. It establishes human-centric digital rights, risk-based AI governance, digital sovereignty requirements, and the legal framework for the National AI Platform.
• Law 'On Artificial Intelligence' (2025): Primary substantive legislation (RAI-KZ-NA-DAIPSXX-2025) defining AI systems, synthetic outputs, risk tiers, developer/operator obligations, technical recordkeeping rules, and prohibited AI practices.
• Law No. 232-VIII Amending the Code of Administrative Offences (2025): Enforcement legislation (RAI-KZ-NA-RKAACXX-2025) inserting Article 641-1 into the Code of Administrative Offences to penalize non-disclosure of synthetic content and risk management failures for high-risk AI.
• Concept for the Development of Artificial Intelligence for 2024–2029: Strategic policy framework (Government Resolution No. 592, RAI-KZ-NA-CDAI2XX-2024) setting national targets across data curation (KazLLM), supercomputing infrastructure, talent development, R&D, and regulatory safeguards.
• National Ethical Code in the Field of Artificial Intelligence (2024): A soft-law framework (RAI-KZ-NA-KAZAKHS-2024) establishing six core ethical principles and voluntary compliance mechanisms for developers and deployers.
• Law No. 418-V 'On Cybersecurity' (formerly 'On Informatization'): Foundational digital infrastructure statute (RAI-KZ-NA-NO418V0-2015), amended to enforce personal data localization, Smart Bridge system integration, and mandatory cybersecurity/algorithmic audits.

Governance & Enforcement Bodies

Primary policy formulation and regulatory oversight are centralized under the Ministry of Artificial Intelligence and Digital Development (formerly the Ministry of Digital Development, Innovations and Aerospace Industry). As the authorized central executive body, the Ministry sets technical standards, manages the National Data Register, conducts digital maturity assessments, and oversees the operation of the National AI Platform. Operational coordination is supported by the Committee for Artificial Intelligence and Innovation Development, established under Government Resolution No. 342 in April 2024.

Technical verification, market surveillance, and security enforcement are executed by specialized state entities. The State Technical Service (STS)—a state body established by Government decision—alongside the National Coordination Center for Cybersecurity, conducts mandatory cybersecurity audits, performs algorithmic audits of high-risk AI systems, manages the National Repository of Source Codes, and enforces data protection and system security baselines across state and critical infrastructure objects.

Penalties & Enforcement

Administrative enforcement for AI violations is governed by Article 641-1 of the Code of Administrative Offences, introduced via Law No. 232-VIII. Article 641-1 penalizes two distinct categories of offences: (1) failure by owners or operators to inform users that outputs are synthetic or generated by AI in circumstances likely to mislead, and (2) failure by owners or operators of high-risk AI systems to implement mandatory risk management practices when such failure results in harm to health, discrimination, dissemination of prohibited information, or legal rights violations, provided the conduct does not constitute a criminal offence.

Financial penalties are structured according to the Monthly Calculation Index (MRP). Initial breaches carry fine ranges of 15 MRP for natural persons, 20 MRP for small entities and non-profits, 30 MRP for medium enterprises, and 100 MRP for large enterprises. Repeated violations within a 12-month period incur escalated fines up to 200 MRP for large enterprises alongside potential remedial measures, including the formal administrative suspension or prohibition of the non-compliant AI system.

Data Protection Framework

Data privacy and governance within Kazakhstan's AI landscape are heavily dictated by national data sovereignty and localization mandates established under Law No. 418-V and the Digital Code. Information systems that process the personal data of Kazakhstani citizens must be physically located on servers situated within the territory of the Republic of Kazakhstan. Inter-agency public sector data sharing is routed through the Smart Data Ukimet (SDU) analytic environment and the Smart Bridge platform.

For AI lifecycle operations and model training, state rules enforce data minimization and anonymization. Developers utilizing state datasets via the National AI Platform must ensure personal data is anonymized prior to ingestion into machine learning pipelines. Mandatory data cataloguing and metadata standards—previously established under ministerial Orders No. 385/NQ and No. 90/NQ before their formal revocation by Order No. 691/NQ in November 2024—are superseded by revised government-wide data management requirements under Government Resolution No. 925. Additionally, the Digital Code formalizes citizen digital rights, including the Right to be Forgotten.

Sector-Specific Rules

Kazakhstan's strategic AI framework targets key priority sectors for automated transformation, including public administration, healthcare, energy, transportation, agriculture, water management, mining, and financial services. State agencies are mandated to align departmental technology with digital transformation policies, delivering public services via 'proactive' and 'one-stop-shop' automated models.

Deployments in sensitive or high-risk contexts—such as healthcare diagnostics, autonomous transport, critical infrastructure management, and law enforcement—are subject to heightened scrutiny. These systems require formal risk assessments, pre-deployment testing, human-in-the-loop (HITL) oversight mechanisms, and documentation logging. Furthermore, in mass media and public communications, synthetic media and deepfakes must be flagged with explicit human-readable and machine-readable transparency labels.

International Alignment

Kazakhstan aligns its national AI regulatory structures with international legal and ethical norms, drawing principles from UNESCO, the OECD, and the European Union AI Act. The adoption of a three-tier risk classification framework, mandatory transparency disclosures, and explicit prohibitions on harmful AI practices (such as social scoring or manipulative behavioural distortion) reflects global consensus on trustworthy AI governance.

The country benchmarks its digital and cybersecurity performance against international metrics, including the UN E-Government Development Index and the Global Cybersecurity Index. While adopting international standard concepts, Kazakhstan maintains strict sovereign controls over national critical data, domestic computing infrastructure, and the development of sovereign language models like KazLLM.

Future Developments

The implementation roadmap for Kazakhstani AI regulation is marked by several near-term legislative and operational milestones. Following the presidential signing of the Law 'On Artificial Intelligence' and Law No. 232-VIII in late 2025, administrative enforcement provisions under Article 641-1 enter into force in January 2026, followed by the entry into force of the Digital Code on July 1, 2026.

Under the 'Concept for the Development of Artificial Intelligence for 2024–2029', the Ministry of Artificial Intelligence and Digital Development submits annual progress reports to the Government every February. Ongoing implementation efforts center on expanding supercomputing capacity, issuing detailed technical standards for high-risk system risk management, testing emerging applications within Experimental Legal Regimes (regulatory sandboxes), and assessing 'Digital Maturity' across state entities through 2029.

Enforcement Bodies