- within Technology, Antitrust/Competition Law and Insurance topic(s)
February 2026 – On 6 January 2026, the President of the Republic of Kazakhstan signed a Decree declaring 2026 the Year of Digitalization and Artificial Intelligence. At present, the legislative framework in this area is actively being developed. For instance, a unified conceptual document on the development of digitalisation and artificial intelligence, Digital Qazaqstan, in which all initiatives and projects will be combined into a nationwide strategy is currently being developed. The Law on Artificial Intelligence No. 230-VIII entered into force on 18 January 2025 (the "Law"), and the Digital Code of the Republic of Kazakhstan will take effect on 11 July 2026. There is also ongoing work to align existing legislative acts with the Digital Code.
Law on Artificial Intelligence
The Law introduces fundamental principles for the functioning of artificial intelligence ("AI") systems. It establishes rights and obligations of the owner, proprietor and/or user of AI systems as well as liability for violations of the norms of the Law. In general, the operation (and development, if applicable) of AI systems is subject to compliance with data protection and confidentiality requirements, as well as security and reliability requirements that are intended to exclude unforeseen consequences or abuse.
Obligations of owners and proprietors of AI systems include the following:
- risk management, which includes identifying and analysing known and foreseeable risks of AI systems when used in accordance with its intended purpose, etc.;
- ensuring safety and reliability;
- maintaining documentation on AI systems depending on their impact on the safety, rights, freedoms and legitimate interests of individuals;
- providing user support on issues related to the functioning of AI systems; and
- providing users with the opportunity to familiarise themselves with the user agreement for the AI system before starting to use it.
Additionally, users must be provided with complete information about the operational and other characteristics and limitations of the AI system to ensure the intended use of the AI system. Also, users must be informed that the products, works and services they receive were created or delivered using AI systems.
AI systems categories
Owners and proprietors of AI systems categorise AI systems based
on their impact on user, societal, and state security (in
accordance with the classification rules):
|
Minimum Risk |
Medium Risk |
High Risk |
|
Disruption or interruption of this AI system will have a minimal impact on their users. |
Disruption or interruption of this AI system may lead to a decrease in the efficiency and effectiveness of users' activities and cause moral harm or material damage. |
Disruption or interruption of this AI system may lead to an emergency of a social and/or man-made nature and/or significant negative consequences for defence, security, international relations, the economy, individual sectors of the economy, users, the infrastructure of the Republic of Kazakhstan, and the livelihoods of individuals. |
"High-risk" AI systems that are classified as critical
information and communication infrastructure are subject to
additional requirements.
Copyright law in relation to AI
Works created using AI systems are protected by copyright only if they involve a creative contribution from a human being. Text queries sent to AI systems that are the result of human intellectual creative activity are recognised as objects of copyright. The use of copyrighted works for training AI models is permitted only in the absence of a prohibition by the author or copyright holder.
Liability for violations
The Code of the Republic of Kazakhstan on Administrative Offences provides for liability of owners and proprietors of AI systems for:
- not informing users about synthetic results of AI system activities that may mislead them; and
- not managing the risks of "high-risk" AI systems, resulting in:
- negative impacts on human health or well-being;
- the creation or dissemination of prohibited or false information;
- discrimination or human rights violations, and other harm.
Liability is provided in the form of fines ranging from 15 MCI1 to 200 MCI with suspension or prohibition of the AI system's activities.
Prohibited AI systems
The creation and operation of AI systems with any of the following functionalities are prohibited on the territory of the Republic of Kazakhstan:
- the use of subliminal, manipulative or other methods that distort the behaviour of a physical person and limit their ability to make informed decisions or force them to make decisions that may cause harm or create a threat of harm;
- assessment and classification of individuals or groups of individuals over a period of time based on their social behaviour or known, presumed or predicted personal characteristics, except in cases provided for by the laws of the Republic of Kazakhstan;
- collection and processing of personal data in violation of the laws of the Republic of Kazakhstan on personal data and their protection, etc.
Digital Code
The Digital Code is the key document providing a systematic approach to the development of digital technologies, the introduction of AI, and the creation of a secure and sustainable digital environment.
Smart Contracts
Smart contracts already exist in the framework of the Astana International Financial Centre as "a computer code that represents a contract, and that executes and enforces the terms of such contract on an automated basis, without the need for intermediation by any person". The Digital Code introduces a similar definition of smart contract: "an agreement that provides for the automatic execution of pre‑agreed terms upon the occurrence of specified conditions through the use of digital technologies". It is permissible for parties to express all or part of a smart contract's terms in the form of program code, provided that the code clearly reflects the parties' rights and obligations and can be reproduced in a human‑readable form.
It is provided that a smart contract must include a dispute‑resolution mechanism under which the final decision is made by a human, in accordance with procedures established by Kazakhstan law or by agreement between the parties.
Use of algorithmic systems as decision‑making
tools
The Digital Code outlines rights of individuals in the context of usage of fully automated algorithmic systems as decision‑making tools. Decisions of such systems must not result in discrimination, including on any grounds prohibited under Kazakhstan law.
The concept of a "fully automated decision" has been introduced. It refers to a decision made without human participation in evaluating the circumstances or confirming the result, where allowed by law or agreement. Individuals subject to fully automated decisions are granted several key rights:
- to be informed that an algorithmic system has been applied;
- to receive an explanation of the key factors and criteria that influenced the decision, without disclosure of algorithms, source code, or legally protected information;
- to request a human review of the decision if it has legal consequences or may affect their rights or legitimate interests, within the timelines set by law.
Electronic digital signature and digital
identification
In addition, the Digital Code regulates the use of electronic digital signatures ("EDS") and digital identification mechanisms for citizens and organisations. EDS retains the status equivalent to a handwritten signature, as provided by the Law on Electronic Documents and Electronic Digital Signatures.
The Code also provides for digital authentication – a procedure for confirming the identity of a natural person or the legal capacity of a legal entity when accessing services in a digital environment. Digital authentication performed using multi-factor means is the basis for the emergence, change, or termination of legal relations in the digital environment, as well as for the purposes of proving legally significant actions performed in digital format.
The next step after digital authentication provided for by the Code is digital confirmation – an action expressing consent or another expression of will. Digital confirmations include: codes, passwords, one-time digital identifiers, push notifications, biometric confirmations, and other means generated and sent by digital systems to mobile devices, instant messaging services, email, etc. A digital confirmation is not a digital signature.
The document also provides for the further digitisation of government activities, including the transition to electronic formats for interacting with the public and businesses.
Footnote
1. From 1 January 2026, the monthly calculation index (MCI) in Kazakhstan is 4,325 tenge.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
