Kazakhstan - AI Governance Framework

Overview

Kazakhstan’s regulatory philosophy regarding artificial intelligence (AI) is characterized by a proactive, state-driven approach aimed at achieving technological sovereignty and economic diversification. The government views AI as a critical driver for the 'Digital Kazakhstan' initiative, seeking to transition the nation from a consumer of technology to a regional digital hub. As of 2024, the maturity level of AI regulation in Kazakhstan has evolved from high-level policy declarations to concrete legislative actions. The cornerstone of this approach is the 'Concept for the Development of Artificial Intelligence for 2024–2029,' approved by the Government in July 2024. This document serves as a comprehensive roadmap, prioritizing the creation of a national AI infrastructure, the development of a sovereign Large Language Model (LLM), and the integration of AI into public services (GovTech). The overall approach is deeply integrated with the country's broader digital transformation goals. Kazakhstan emphasizes the 'Data-First' principle, leveraging its 'Smart Data Ukimet' ecosystem to provide the necessary datasets for AI training. The regulatory environment is designed to be attractive to foreign investment while maintaining strict control over data security and national interests. This dual focus is evident in the establishment of the National Center for Artificial Intelligence and the ongoing development of the 'Digital Code,' which aims to unify disparate regulations into a single, cohesive legal framework. The government’s philosophy also includes a strong emphasis on human capital, with mandates for AI education across all levels of the academic system to support a sustainable technological ecosystem. Furthermore, the President of Kazakhstan, Kassym-Jomart Tokayev, has repeatedly emphasized that AI is not just a technological tool but a strategic asset that will determine the country's competitiveness on the global stage. This high-level political backing has accelerated the legislative process, leading to the rapid drafting of ethical guidelines and technical standards that aim to balance innovation with the protection of citizen rights.

Regulatory Approach

Kazakhstan currently employs a hybrid regulatory approach that combines horizontal strategic planning with sector-specific implementation. Historically, AI was governed under the broad umbrella of the Law 'On Informatization,' which provided general rules for digital systems. However, the current trend is moving toward a more prescriptive and risk-based framework. The 2024–2029 Concept introduces the necessity of categorizing AI systems based on their potential impact on human rights and safety, signaling a shift toward a risk-based model similar to the European Union’s AI Act. While much of the current guidance remains 'soft law' in the form of government decrees and ethical guidelines, these are rapidly being codified into 'hard law' through amendments to existing codes and the drafting of the comprehensive Digital Code. The regulatory structure is highly centralized, with the Ministry of Digital Development, Innovations and Aerospace Industry (MDDIAI) serving as the primary architect of AI policy. This centralized model allows for rapid deployment of national-scale projects, such as the unified AI platform and the national GPU cluster. Simultaneously, the government utilizes 'regulatory sandboxes,' particularly within the Astana International Financial Centre (AIFC), to test AI applications in finance and law under a separate, English-law-based jurisdiction. This dual-track approach allows Kazakhstan to maintain strict national standards for public sector AI while offering a flexible, internationally recognized environment for private sector innovation and global startups. The government also places a significant emphasis on 'Sovereign AI,' which involves the development of local infrastructure and models that are culturally and linguistically adapted to the Kazakh context, reducing reliance on external technology providers and ensuring that the regulatory framework supports local intellectual property development.

Key AI Legislation

The legislative landscape for AI in Kazakhstan is currently anchored by several key instruments that define the boundaries of digital innovation and data usage. The most significant recent addition is the Decree of the Government of the Republic of Kazakhstan No. 523 (July 3, 2024), which approved the 'Concept for the Development of Artificial Intelligence for 2024–2029.' This decree is not merely a policy document; it sets binding targets for government agencies and provides the legal mandate for the creation of the National AI Center. Another foundational piece is the Law of the Republic of Kazakhstan 'On Informatization' (2015), which governs the creation and operation of all state information systems. This law provides the legal basis for the 'Smart Data Ukimet' platform, which serves as the primary data source for training national AI models. The Law of the Republic of Kazakhstan 'On Personal Data and their Protection' (2013) is equally critical, as it mandates that all personal data of Kazakhstani citizens must be stored on servers located within the country, a requirement that significantly shapes how AI companies operate. Looking forward, the Draft Digital Code of the Republic of Kazakhstan is expected to be the most comprehensive piece of legislation, consolidating rules on AI ethics, algorithmic accountability, and the legal status of AI-generated content. Additionally, the Law 'On Science and Technology Policy' (2024) provides the framework for state funding of AI research and development, ensuring that academic and commercial AI projects align with national strategic priorities. These laws collectively create a structured environment where AI development is encouraged but strictly monitored to ensure compliance with national security and data privacy standards.

Governance & Enforcement Bodies

The primary regulatory authority for AI in Kazakhstan is the Ministry of Digital Development, Innovations and Aerospace Industry (MDDIAI). The Ministry is responsible for formulating national policy, developing the legal framework, and overseeing the implementation of the AI Development Concept. It holds the mandate to coordinate between various government agencies and ensure that AI initiatives align with the broader 'Digital Kazakhstan' strategy. Under the MDDIAI, the Information Security Committee plays a crucial role in enforcing data protection and cybersecurity standards, ensuring that AI systems do not compromise national security or individual privacy rights. Supporting the Ministry is the National Center for Artificial Intelligence, established to act as a technical operator and research hub. This center is tasked with managing the national AI platform, providing computing power (GPU clusters) to researchers and startups, and developing the national LLM. From an enforcement perspective, the Digital Government Support Center monitors the use of AI in public services, ensuring compliance with service-level agreements and ethical standards. In the financial sector, the Astana International Financial Centre (AIFC) Authority acts as an independent regulator for AI applications within its jurisdiction, providing a specialized legal regime for fintech and AI-driven investment services. The State Technical Service (STS) also plays a vital role, particularly in the security auditing of AI algorithms used in critical infrastructure and government platforms. This multi-layered governance structure ensures that while the MDDIAI sets the strategic direction, specialized bodies handle the technical, ethical, and security-related aspects of AI oversight, creating a comprehensive system of checks and balances.

Penalties & Enforcement

Enforcement of AI-related regulations in Kazakhstan is primarily conducted through the Code of the Republic of Kazakhstan on Administrative Offenses (KoAP). Penalties are currently focused on data breaches and the improper use of information systems. For instance, violations of the Law on Personal Data—such as failing to ensure data localization or processing data without consent—can result in significant administrative fines ranging from 100 to 1,000 Monthly Calculation Indices (MCI) for legal entities. In cases of repeated violations or those causing substantial harm, criminal liability may be triggered under the Criminal Code, particularly for 'Unlawful access to information' or 'Violation of the operation of information systems.' As the Digital Code comes into force, enforcement mechanisms are expected to expand to include specific sanctions for 'high-risk' AI systems that fail to meet transparency or safety audits. The MDDIAI and the Information Security Committee have the power to issue binding orders to suspend the operation of non-compliant AI systems. Appeals against regulatory decisions can be made through the administrative court system under the Administrative Procedural-Processual Code (APPC), which allows businesses and individuals to challenge the legality of government actions. The government is also exploring the creation of an 'AI Ethics Commission' that would have the power to blacklist AI developers who violate the national Ethical Code of AI. This commission would serve as a quasi-judicial body, providing recommendations to the MDDIAI on whether specific AI applications should be permitted to operate within the country. The enforcement landscape is thus evolving from a focus on general digital misconduct to a more nuanced system that addresses the specific risks posed by autonomous and algorithmic systems.

Data Protection Framework

Kazakhstan’s data protection framework is anchored by the Law 'On Personal Data and their Protection,' which has been progressively updated to align with international standards like the GDPR, albeit with distinct national requirements. The most critical feature of this framework is data localization: the law requires that the collection, storage, and processing of personal data of Kazakhstani citizens must occur on servers physically located within the Republic of Kazakhstan. This presents a significant compliance requirement for international AI providers who must establish local infrastructure or use local cloud providers to serve the Kazakhstani market. The framework also emphasizes the principle of 'informed consent,' requiring explicit permission from data subjects for any automated processing or profiling. The Information Security Committee serves as the data protection authority, conducting audits and investigating complaints. In 2024, new amendments introduced stricter requirements for 'depersonalized data,' which is essential for training AI models. These amendments aim to ensure that even when data is stripped of identifiers, it cannot be re-identified through AI-driven correlation, thereby protecting citizen privacy in the age of big data analytics. Furthermore, the government has implemented the 'Digital Family Card' and other big-data initiatives that require high levels of data security. AI systems interacting with these platforms must adhere to the 'Information Security Requirements for Information Systems,' which include mandatory encryption standards and regular vulnerability assessments. The data protection regime is designed to foster trust in digital services while ensuring that the state maintains control over the 'digital footprint' of its citizens, a priority that is central to Kazakhstan's concept of digital sovereignty.

Sector-Specific Rules

In the financial sector, AI regulation is bifurcated between the National Bank of Kazakhstan and the AIFC. The AIFC has introduced specific guidelines for the use of AI in automated trading and robo-advisory services, emphasizing the need for 'human-in-the-loop' oversight and algorithmic transparency. These rules are designed to prevent market manipulation and ensure that AI-driven decisions are explainable to regulators. In the healthcare sector, the Ministry of Healthcare regulates AI-driven diagnostic tools through the 'e-Health' platform. AI systems used for medical purposes must undergo clinical trials and certification by the National Center for Medicines and Medical Products to ensure they meet safety and efficacy standards equivalent to traditional medical devices. The public sector (GovTech) is perhaps the most regulated area, governed by strict protocols for the 'Smart Data Ukimet' ecosystem. Any AI model used by a government agency must undergo a security audit by the State Technical Service. For autonomous vehicles, Kazakhstan has begun developing specialized traffic regulations and infrastructure standards, primarily focused on pilot zones in 'smart cities' like Astana and Almaty. These rules emphasize liability frameworks, shifting responsibility from the driver to the software operator or manufacturer in specific autonomous modes, provided the vehicle meets national technical regulations. In the industrial sector, particularly in mining and energy, AI applications are subject to the 'Industrial Safety Rules,' which require that automated systems include fail-safe mechanisms to prevent environmental disasters or workplace accidents. These sector-specific rules ensure that the unique risks of AI are addressed within the context of existing industry standards and regulatory bodies.

International Alignment

Kazakhstan actively seeks to align its AI regulations with international norms to facilitate cross-border cooperation and attract global tech giants. The country has officially endorsed the OECD Principles on Artificial Intelligence, committing to promote AI that is innovative, trustworthy, and respects human rights. This alignment is a key component of Kazakhstan’s bid to join the OECD. Furthermore, the 2024–2029 AI Concept explicitly references the EU AI Act as a benchmark for its developing risk-based classification system, indicating a desire for regulatory interoperability with the European market. Regionally, Kazakhstan plays a leading role in the Eurasian Economic Union (EAEU) digital agenda, working toward harmonized standards for data exchange and AI ethics across member states. The country has also signed bilateral agreements with technological leaders like the United Arab Emirates (specifically with G42 and Presight AI) to co-develop infrastructure and large-scale AI models. These partnerships often include clauses on technology transfer and joint regulatory development, ensuring that Kazakhstan’s local rules remain compatible with global industry standards while protecting national data interests. Kazakhstan is also a participant in the UNESCO recommendations on the ethics of AI, integrating these global ethical standards into its national policy framework. By positioning itself as a bridge between Western regulatory models (like the EU's) and Eastern technological partnerships, Kazakhstan aims to create a unique regulatory environment that is both globally compatible and nationally protective, fostering an ecosystem where international companies can operate with legal certainty.

Future Developments

The most significant upcoming development is the formal adoption and implementation of the Digital Code, expected to be finalized by late 2025 or early 2026. This Code will provide the first comprehensive legal definition of AI in Kazakhstani law and establish a clear hierarchy of liability for AI-driven harms. It is also expected to introduce a 'Regulatory Sandbox' regime at the national level, expanding the successful model used in the AIFC to other sectors like agriculture and industry. This will allow for the temporary suspension of certain regulations to facilitate the testing of innovative AI solutions under government supervision. Additionally, the government plans to establish a National AI Ethics Council, which will be responsible for drafting and updating the National Ethical Code for AI. This council will likely include representatives from academia, industry, and civil society to ensure a multi-stakeholder approach to AI governance. On the technical side, the expansion of the national GPU cluster and the launch of the sovereign LLM (KazLLM) will likely lead to new technical standards for 'sovereign AI,' focusing on linguistic accuracy and cultural relevance for the Kazakh language. The government is also planning to introduce 'AI-Ready' certification for businesses, providing tax incentives and preferential access to state data for companies that meet high standards of algorithmic transparency and data security. These developments suggest that Kazakhstan will continue to move toward a highly structured, state-monitored AI ecosystem that prioritizes national strategic interests while providing a clear roadmap for technological advancement and ethical compliance.

Key Regulations

Enforcement Bodies