The Law of the Republic of Kazakhstan dated November 17, 2025, No. 230-VIII "On Artificial Intelligence" (the "Law") establishes the legal framework for regulating artificial intelligence ("AI") in the Republic of Kazakhstan ("Kazakhstan"), based on the principles of legality, fairness, transparency, accountability, data protection, and the priority of human well-being. The Law defines the following:

The Law defines the terms “AI”, “AI System”, “AI Model”, “Data Library”, “Synthetic Outputs of AI Systems”, “Output of AI System”, “National AI Platform”, “Machine-Readable Form”, etc. According to the Law:

AI is the functional ability to imitate cognitive functions which are characteristic of humans, providing results comparable to or superior to the results of human intellectual activity;

AI System is an information technology object which functions on the basis of one or several AI models;

AI Model is a software product developed to perform specialized tasks and capable of adapting to changing conditions, learning from accumulated experience, and optimizing the processes and results of its activities;

Output of AI System is information or a decision, regardless of the form in which they are provided, or actions, including work and/or services, produced and/or provided by the AI ​​System.

The Government of Kazakhstan, the authorized body in the field of AI (the Ministry of AI and Digital Development of Kazakhstan), and industry-specific government agencies are vested with powers in the field of AI.

In particular, the Government of Kazakhstan approves a list of priority economic sectors for AI implementation. The Ministry of AI and Digital Development of Kazakhstan exercises oversight and regulatory functions in the field of AI. Industry-specific government agencies create industry Data Libraries in accordance with data management requirements.

The Operator of the National AI Platform, National Information Technologies JSC, is designated as responsible for the creation, development, and operation of the National AI platform, as well as for the performance of other functions in the field of AI.

Works created using AI are protected only if they contain a human creative contribution. Using works to train AI models is not automatically considered free use; the absence of a prohibition from the author, expressed in machine-readable form, is required.

According to the Law of Kazakhstan dated June 10, 1996, No. 6-I "On Copyright and Related Rights," copyright is the personal non-property and property rights of the author, and the author is an individual whose creative work creates a work of science, literature, or art. Accordingly, copyright is vested in the individual.

The Law defines the rights and obligations of owners/holders of AI Systems and users.

Thus, owners/holders of AI Systems, among other things, have the right to determine the terms of use of AI Systems and protect their rights to AI Systems and are obliged to manage risks, ensure the security and reliability of AI Systems, maintain documentation, support users, and provide terms of use in advance.

Users have the right, among other things, to review the terms of use, protect their personal data and intellectual property rights, receive explanations regarding the Outputs of AI System, which affects their rights, freedoms, and legitimate interests, request information about the data on which the AI ​​System based its decisions, and refuse the use of AI (unless required by law). Users are also obligated to use AI within the limits of their granted access rights and comply with security measures and rules.

Any distributed synthetic images/text/videos and other Synthetic Outputs of AI Systems must be machine-readable and marked with a visual or other warning.

Users must be notified about the use of AI Systems in the production of goods, performance of work, and provision of services.

The responsibility for informing users about the Synthetic Outputs of AI Systems rests with the owners or holders of these systems.

According to the Law, Synthetic Output of AI System is an image, video, audio, text, or combination thereof, created or modified by an AI System, simulating the appearance, voice, behavior of an individual, or events which have not actually occurred.

AI Systems are classified by risk, autonomy, and mode of use, and are subject to appropriate risk management measures, documentation, and controls.

Owners and holders of AI Systems are required to manage the risks of AI Systems and maintain documentation for the AI ​​System, depending on the degree of its impact on the security, rights, freedoms, and legitimate interests of individuals and public order in accordance with the list of documentation for AI Systems, which is approved by the authorized body in the field of AI (the Ministry of AI and Digital Development of Kazakhstan).

Lists of trusted high-risk AI Systems are compiled by industry-specific government agencies to ensure trust and promote best practices for the use of AI Systems in the relevant industry. These lists are regularly published on government agency websites in the manner determined by the authorized body (the Ministry of AI and Digital Development of Kazakhstan). Owners and/or holders of AI Systems applying for inclusion on the trusted list must conduct an audit of their AI Systems.

AI System audits are conducted by qualified persons/entities in accordance with the Rules for Conducting Information System Audits and the agreement between the client and the auditor.

The Law establishes requirements for the quality and transparency of the origin of Data Libraries. Data Library is a collection of structured and/or grouped data suitable for training AI Models.

Information about the creator of the Data Library must be provided in machine-readable form when creating the Data Library and when sharing it, regardless of any subsequent transfer of ownership or possession.

AI Models are trained using Data Libraries provided by data owners or holders for pre-defined and legitimate purposes.

The Law prohibits the implementation of functions which use subconscious, manipulative, or other methods to distort an individual's behavior and limit their ability to make informed decisions or force them to make decisions which could cause harm or create a threat of harm, classify people based on sensitive characteristics for the purpose of discrimination, determine emotions without consent, etc.

Users in relation to whom decisions are made using AI Systems have the right to be informed about the automated processing procedure and its consequences, the possibility of objecting to automated processing, as well as the procedure for protecting their rights, freedoms, and legitimate interests.

Provisions have been introduced according to which the National AI Platform provides a controlled environment for the development, training, and trial operation of platform-based software products and AI Models for a limited period of time. Access to computing resources is provided by the Operator of the National AI Platform (National Information Technologies JSC) in accordance with the rules approved by the authorized body (the Ministry of AI and Digital Development of Kazakhstan).

Compensation for damage caused by AI Systems is provided in accordance with the procedure established by the Civil Code of Kazakhstan. Liability insurance for damage caused by AI Systems and risks associated with the use of AI Systems is provided in accordance with the laws of Kazakhstan.

The Law enters into force 60 calendar days after its first official publication, which took place on November 18, 2025, i.e., on January 18, 2026.

The Law of Kazakhstan No. 231-VIII of November 17, 2025, “On Amendments and Supplements to Certain Legislative Acts of the Republic of Kazakhstan on Artificial Intelligence and Digitalization” was adopted

The Law of Kazakhstan dated November 17, 2025 No. 231-VIII "On Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Artificial Intelligence and Digitalization" (the "Law No. 231-VIII") amends the following legislative acts:

Key changes include the following:

Law of Kazakhstan dated April 12, 2004 "On Regulation of Trade Activities"

Introduction of a provision that domestic trade entities when retailing goods marked with identification means in the manner established by the legislation of Kazakhstan on the regulation of trade activities are obliged to record transactions through cash register machines with the function of recording and/or transmitting data by reading identification means.

Law of Kazakhstan of May 4, 2010 "On Protection of Consumer Rights"

Introduction of a requirement that the seller (manufacturer, contractor) is obliged to inform the consumer about the possible risks and conditions for the safe use of goods (work, service) containing AI components (produced, performed and/or provided by AI System), by indicating the necessary information in the documentation attached to the goods (work, service), on consumer packaging, labels or in another manner approved for certain types of goods (works, services).

Law of Kazakhstan dated May 21, 2013 "On Personal Data and Their Protection"

Law of Kazakhstan dated February 6, 2023 "On Digital Assets in the Republic of Kazakhstan"

Law of Kazakhstan dated June 19, 2024 "On Mass Media"

Introduction of a rule stating that the distribution of mass media products created using an AI system shall be permitted only if information about these products is provided in accordance with the Law of Kazakhstan "On Artificial Intelligence."

The Law No. 231-VIII shall enter into force 60 calendar days after the date of its first official publication. The Law No. 231-VIII was published on November 18, 2025, i.e. it shall enter into force on January 18, 2026.

Amendments were introduced to the Rules for the Implementation of Measures for Protection of PD by the Owner and/or Operator, as well as by a Third Party

Amendments to the Rules for the Implementation of Measures for Protection of PD by the Owner and/or Operator, as well as a Third Party, approved by Order No. 179/НҚ of the Minister of Digital Development, Innovation and Aerospace Industry of Kazakhstan dated June 12, 2023 were made by the Order No. 672/НҚ of the Deputy Prime Minister – Minister of AI and Digital Development of Kazakhstan dated December 22, 2025 (the “Order”).

Specifically, a rule was introduced to the effect that when working with limited-access PD biometric authentication tools shall be used for a database containing more than 100,000 PD records.

The Order shall come into effect 10 calendar days after the date of its first official publication. The Order was published on December 26, 2025, i.e. it shall come into effect on January 6, 2025.