The Law of the Republic of Kazakhstan dated November 17, 2025, No. 230-VIII “On Artificial Intelligence” (the “Law”) establishes the legal framework for regulating artificial intelligence (“AI”) in the Republic of Kazakhstan (“Kazakhstan”), based on the principles of legality, fairness, transparency, accountability, data protection, and the priority of human well-being. The Law defines the following:

  1. Terms in the field of AI

The Law defines the terms “AI”, “AI System”, “AI Model”, “Data Library”, “Synthetic Outputs of AI Systems”, “Output of AI System”, “National AI Platform”, “Machine-Readable Form”, etc. According to the Law:

AI is the functional ability to imitate cognitive functions which are characteristic of humans, providing results comparable to or superior to the results of human intellectual activity;

AI System is an information technology object which functions on the basis of one or several AI models;

AI Model is a software product developed to perform specialized tasks and capable of adapting to changing conditions, learning from accumulated experience, and optimizing the processes and results of its activities;

Output of AI System is information or a decision, regardless of the form in which they are provided, or actions, including work and/or services, produced and/or provided by the AI ​​System.

  1. Powers of government agencies in the field of AI

The Government of Kazakhstan, the authorized body in the field of AI (the Ministry of AI and Digital Development of Kazakhstan), and industry-specific government agencies are vested with powers in the field of AI.

In particular, the Government of Kazakhstan approves a list of priority economic sectors for AI implementation. The Ministry of AI and Digital Development of Kazakhstan exercises oversight and regulatory functions in the field of AI. Industry-specific government agencies create industry Data Libraries in accordance with data management requirements.

The Operator of the National AI Platform, National Information Technologies JSC, is designated as responsible for the creation, development, and operation of the National AI platform, as well as for the performance of other functions in the field of AI.

  1. Copyright

Works created using AI are protected only if they contain a human creative contribution. Using works to train AI models is not automatically considered free use; the absence of a prohibition from the author, expressed in machine-readable form, is required.

According to the Law of Kazakhstan dated June 10, 1996, No. 6-I “On Copyright and Related Rights,” copyright is the personal non-property and property rights of the author, and the author is an individual whose creative work creates a work of science, literature, or art. Accordingly, copyright is vested in the individual.

  1. Rights and responsibilities of AI System owners/holders and users

The Law defines the rights and obligations of owners/holders of AI Systems and users.

Thus, owners/holders of AI Systems, among other things, have the right to determine the terms of use of AI Systems and protect their rights to AI Systems and are obliged to manage risks, ensure the security and reliability of AI Systems, maintain documentation, support users, and provide terms of use in advance.

Users have the right, among other things, to review the terms of use, protect their personal data and intellectual property rights, receive explanations regarding the Outputs of AI System, which affects their rights, freedoms, and legitimate interests, request information about the data on which the AI ​​System based its decisions, and refuse the use of AI (unless required by law). Users are also obligated to use AI within the limits of their granted access rights and comply with security measures and rules.

  1. Transparency in the use of AI Systems, including labeling

Any distributed synthetic images/text/videos and other Synthetic Outputs of AI Systems must be machine-readable and marked with a visual or other warning.

Users must be notified about the use of AI Systems in the production of goods, performance of work, and provision of services.

The responsibility for informing users about the Synthetic Outputs of AI Systems rests with the owners or holders of these systems.

According to the Law, Synthetic Output of AI System is an image, video, audio, text, or combination thereof, created or modified by an AI System, simulating the appearance, voice, behavior of an individual, or events which have not actually occurred.

  1. Classification and risk assessment

AI Systems are classified by risk, autonomy, and mode of use, and are subject to appropriate risk management measures, documentation, and controls.

  1. Mandatory documentation and audit

Owners and holders of AI Systems are required to manage the risks of AI Systems and maintain documentation for the AI ​​System, depending on the degree of its impact on the security, rights, freedoms, and legitimate interests of individuals and public order in accordance with the list of documentation for AI Systems, which is approved by the authorized body in the field of AI (the Ministry of AI and Digital Development of Kazakhstan).

Lists of trusted high-risk AI Systems are compiled by industry-specific government agencies to ensure trust and promote best practices for the use of AI Systems in the relevant industry. These lists are regularly published on government agency websites in the manner determined by the authorized body (the Ministry of AI and Digital Development of Kazakhstan). Owners and/or holders of AI Systems applying for inclusion on the trusted list must conduct an audit of their AI Systems.

AI System audits are conducted by qualified persons/entities in accordance with the Rules for Conducting Information System Audits and the agreement between the client and the auditor.

  1. Rules for work with Data Libraries

The Law establishes requirements for the quality and transparency of the origin of Data Libraries. Data Library is a collection of structured and/or grouped data suitable for training AI Models.

Information about the creator of the Data Library must be provided in machine-readable form when creating the Data Library and when sharing it, regardless of any subsequent transfer of ownership or possession.

AI Models are trained using Data Libraries provided by data owners or holders for pre-defined and legitimate purposes.

  1. Functional limitations (prohibitions)

The Law prohibits the implementation of functions which use subconscious, manipulative, or other methods to distort an individual’s behavior and limit their ability to make informed decisions or force them to make decisions which could cause harm or create a threat of harm, classify people based on sensitive characteristics for the purpose of discrimination, determine emotions without consent, etc.

  1. Automated processing

Users in relation to whom decisions are made using AI Systems have the right to be informed about the automated processing procedure and its consequences, the possibility of objecting to automated processing, as well as the procedure for protecting their rights, freedoms, and legitimate interests.

  1. National Platform

Provisions have been introduced according to which the National AI Platform provides a controlled environment for the development, training, and trial operation of platform-based software products and AI Models for a limited period of time. Access to computing resources is provided by the Operator of the National AI Platform (National Information Technologies JSC) in accordance with the rules approved by the authorized body (the Ministry of AI and Digital Development of Kazakhstan).

  1. Insurance and legal liability

Compensation for damage caused by AI Systems is provided in accordance with the procedure established by the Civil Code of Kazakhstan. Liability insurance for damage caused by AI Systems and risks associated with the use of AI Systems is provided in accordance with the laws of Kazakhstan.

The Law enters into force 60 calendar days after its first official publication, which took place on November 18, 2025, i.e., on January 18, 2026.

The Law of Kazakhstan No. 231-VIII of November 17, 2025, “On Amendments and Supplements to Certain Legislative Acts of the Republic of Kazakhstan on Artificial Intelligence and Digitalization” was adopted

The Law of Kazakhstan dated November 17, 2025 No. 231-VIII “On Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Artificial Intelligence and Digitalization” (the “Law No. 231-VIII”) amends the following legislative acts:

  • Law of Kazakhstan dated September 15, 1994 “On Operational-Investigative Activities”;
  • Law of Kazakhstan dated December 21, 1995 “On the National Security Agencies of the Republic of Kazakhstan”;
  • Law of Kazakhstan dated April 12, 2004 “On Regulation of Trade Activities”;
  • Law of Kazakhstan dated July 5, 2004 “On Communications”;
  • Law of Kazakhstan dated May 4, 2010 “On Protection of Consumer Rights”;
  • Law of Kazakhstan dated May 21, 2013 “On Personal Data and Their Protection”;
  • Law of Kazakhstan dated May 16, 2014 “On Permits and Notifications”;
  • Law of Kazakhstan dated November 24, 2015 “On Informatization”;
  • Law of Kazakhstan dated April 9, 2016 “On Post”;
  • Law of Kazakhstan dated February 6, 2023 “On Digital Assets in the Republic of Kazakhstan”;
  • Law of Kazakhstan dated June 19, 2024 “On Mass Media”.

Key changes include the following:

Law of Kazakhstan dated April 12, 2004 “On Regulation of Trade Activities”

Introduction of a provision that domestic trade entities when retailing goods marked with identification means in the manner established by the legislation of Kazakhstan on the regulation of trade activities are obliged to record transactions through cash register machines with the function of recording and/or transmitting data by reading identification means.

Law of Kazakhstan of May 4, 2010 “On Protection of Consumer Rights”

Introduction of a requirement that the seller (manufacturer, contractor) is obliged to inform the consumer about the possible risks and conditions for the safe use of goods (work, service) containing AI components (produced, performed and/or provided by AI System), by indicating the necessary information in the documentation attached to the goods (work, service), on consumer packaging, labels or in another manner approved for certain types of goods (works, services).

Law of Kazakhstan dated May 21, 2013 “On Personal Data and Their Protection”

  • The term “personal data” has been amended. In the new version, personal data (“PD”) are data, including biometric data (previously – information), related to a specific or determinable subject of PD, recorded on electronic, paper and/or other tangible media;
  • The term “Automated Processing of PD” has been introduced;
  • Introduction of a rule that the collection and processing of PD for the purpose of causing property damage and/or moral harm, restricting the exercise of rights, freedoms and legitimate interests of the subject is not permitted;
  • Introduction of a rule prohibiting the collection and processing of PD for the purpose of creation or expansion of databases through inappropriate extraction of PD from publicly available sources;
  • Introduction of a rule that the use of technological means for collecting biometric data and identifying a subject in public places, as well as the use of collected biometric data and identification information may be carried out solely for the purpose of protecting the constitutional order, protecting public order, human rights and freedoms, and the health and morals of the population, except in cases where the consent of the subject has been obtained;
  • Introduction of a provision stating that the validity period of consent to PD processing cannot exceed the period necessary to achieve the purposes of collecting and processing PD, unless otherwise provided by the laws of Kazakhstan or an agreement. If the validity period of consent to collect and process PD is not specified, it is considered valid until the processing purposes specified at the time of its provision have been achieved.
  • Introduction of a rule that if a subject revokes consent to the collection and processing of PD, the owner and/or operator, as well as a third party are required to stop processing PD within 15 business days unless their storage or processing is required in accordance with the legislation of Kazakhstan or provide a reasoned refusal;
  • Requirements for automated processing of PD have been transferred and adapted from the Law of Kazakhstan dated November 24, 2015, No. 418-V “On Informatization”. A requirement has been introduced that the owner and/or operator, as well as a third party are obligated to consider an objection to the automated processing of PD within 3 business days of its receipt and notify the subject of the results of the objection.

Law of Kazakhstan dated February 6, 2023 “On Digital Assets in the Republic of Kazakhstan”

  • Introduction of the terms “Digital Asset Turnover” and “Digital Asset Issue.” Digital Asset Turnover means the execution of civil law transactions involving a digital asset; Digital Asset Issue means an action aimed at creating a digital asset as an object of civil rights;
  • Amendments in the “Digital Mining Data Processing Center” term. Digital Mining Data Processing Center is an information and communications infrastructure facility consisting of a hardware and software complex for digital mining, ensuring the operation of computing power, located (previously – and an industrial building located) outside the territory of a residential area, using electrical energy in accordance with the Law of Kazakhstan “On Electric Power Industry”;
  • Amendments in the “Digital Mining Pool” term. Digital Mining Pool is a legal entity accredited in accordance with the legislation of Kazakhstan on digital assets, providing a service constituting combination of the capacities of a hardware and software complex for digital mining of digital miners, distributing digital assets among digital miners which arose (or were created) (previously – were received) as a result of their joint activities;
  • Exclusion of the rule that in the event of the sale of digital assets obtained as a result of digital mining on the territory of Kazakhstan, these digital assets are subject to mandatory sale through digital asset exchanges licensed by the Astana International Financial Center, in an amount of at least 75 percent in accordance with the rules for submitting information on the income of digital miners and digital mining pools for tax purposes;
  • Exclusion of the rule that prohibits digital miners from engaging in other activities not related to digital mining, as well as the acquisition of shares in the authorized capital or stocks of legal entities, the creation and participation in the activities of non-profit organizations, with the exception of membership in a self-regulatory organization and the National Chamber of Entrepreneurs of Kazakhstan;
  • Introduction of a rule that organizing of digital assets circulation shall be carried out by digital asset exchanges;
  • Introduction of a rule that the National Postal Operator of Kazakhstan has a right to open bank accounts in accordance with the legislation of Kazakhstan for the digital asset exchange as well as for a participant in the Astana International Financial Center which has the appropriate license to carry out activities related to digital assets;
  • The provision that the issue and circulation of unsecured digital assets as well as the activities of digital asset exchanges related to unsecured digital assets shall be prohibited on the territory of Kazakhstan, with the exception of the territory of the Astana International Financial Center and the special regulatory regime of the National Bank of Kazakhstan, has been replaced by a provision that the organization of the circulation of digital assets without an appropriate license or permit to carry out activities related to digital assets, issued in accordance with the current law of the Astana International Financial Center or the laws of Kazakhstan shall be prohibited.

Law of Kazakhstan dated June 19, 2024 “On Mass Media”

Introduction of a rule stating that the distribution of mass media products created using an AI system shall be permitted only if information about these products is provided in accordance with the Law of Kazakhstan “On Artificial Intelligence.”

The Law No. 231-VIII shall enter into force 60 calendar days after the date of its first official publication. The Law No. 231-VIII was published on November 18, 2025, i.e. it shall enter into force on January 18, 2026.

Amendments were introduced to the Rules for the Implementation of Measures for Protection of PD by the Owner and/or Operator, as well as by a Third Party

Amendments to the Rules for the Implementation of Measures for Protection of PD by the Owner and/or Operator, as well as a Third Party, approved by Order No. 179/НҚ of the Minister of Digital Development, Innovation and Aerospace Industry of Kazakhstan dated June 12, 2023 were made by the Order No. 672/НҚ of the Deputy Prime Minister – Minister of AI and Digital Development of Kazakhstan dated December 22, 2025 (the “Order”).

Specifically, a rule was introduced to the effect that when working with limited-access PD biometric authentication tools shall be used for a database containing more than 100,000 PD records.

The Order shall come into effect 10 calendar days after the date of its first official publication. The Order was published on December 26, 2025, i.e. it shall come into effect on January 6, 2025.

More from Vakhidov & Partners