Legal Framework and Purpose of Kazakhstan’s AI Law
Kazakhstan’s Law No. 230-VIII On Artificial Intelligence, signed on 17 November 2025 and effective from 18 January 2026, establishes the first comprehensive legal framework for AI in Central Asia. The law aims to create a structured environment for the safe, transparent, and responsible use of AI systems while fostering innovation and protecting the rights of participants in the digital economy. Prior to this legislation, the absence of specific regulations created legal uncertainty for businesses and rights holders, particularly concerning liability, data protection, and the ethical deployment of AI technologies.
The law explicitly defines AI systems as objects of informatisation, aligning them with the broader digital infrastructure of the country. This classification ensures that AI systems are subject to regulatory oversight, risk management, and accountability mechanisms similar to those applied to other critical digital assets.
Key Principles and Responsibilities Under the Law
The law outlines five core principles governing the development and use of AI systems: legality, transparency, fairness, human well-being, and data protection. For instance, transparency requires that AI-generated decisions—such as those in automated hiring or loan approval systems—must be explainable to users, reducing the risk of arbitrary or discriminatory outcomes.
Responsibility for AI systems is allocated among three key entities: owners, operators, and users. Owners, typically developers or companies deploying AI systems, are required to manage risks associated with their technologies, including potential biases, security vulnerabilities, or unintended consequences. Operators, who deploy or maintain AI systems, must ensure their security, reliability, and compliance with regulatory requirements. Users, including individuals or organizations interacting with AI systems, are also subject to obligations, such as adhering to ethical guidelines and avoiding misuse of AI-generated content.
AI systems are explicitly banned from manipulating human consciousness or processing personal data unlawfully. This includes restrictions on deepfake technologies that imitate natural persons or fabricate events, ensuring that synthetic outputs—such as AI-generated text, images, audio, or video—are clearly distinguishable from authentic content. Machine-readable labelling is mandated for all AI-generated materials to facilitate detection and accountability.
Copyright, Synthetic Content, and the National AI Platform
One of the law’s notable provisions addresses copyright in AI-generated works, clarifying that creations produced solely by AI systems without human creative input are not protected. However, creatively formulated AI prompts—such as those used to generate unique outputs—are recognized as objects of copyright under Kazakh legislation.
Additionally, the Digital Code of the Republic of Kazakhstan, signed on 9 January 2026 and effective from 11 July 2026, consolidates existing digital legislation and introduces a unified framework for digital rights.
Compliance and Risk Management for Businesses
- Internal Policies and Contractual Provisions: Companies deploying AI systems must implement internal policies to mitigate legal risks, including risk assessments, audit trails, and compliance monitoring. Contractual agreements with third parties—such as data providers or AI service users—should explicitly define responsibilities, liability limits, and dispute resolution mechanisms to align with the law’s requirements.
- Machine-Readable Labelling and Synthetic Content: Businesses generating or distributing AI-produced content must affix machine-readable labels to indicate its synthetic nature. This requirement extends to text, images, audio, and video, ensuring transparency for consumers and reducing the potential for misinformation or fraud.
- Copyright and Creative Contributions: Organizations using AI for content creation must document the creative contributions of employees or external collaborators to establish ownership and enforce copyright protections. The law permits the use of AI-generated works for scientific or educational purposes, provided no explicit prohibition is marked in a machine-readable format. Unauthorized adaptation or distribution of copyrighted AI-assisted works may lead to infringement claims.
- Liability and Risk Mitigation: The law assigns liability to developers, owners, and operators based on their roles in the AI lifecycle. To minimize exposure, companies should conduct regular security audits, train employees on ethical AI practices, and maintain records of system performance and decision-making processes. Proactive risk management is essential, particularly for high-stakes applications like autonomous vehicles or financial AI, where errors could have severe consequences.
Key dates
- 2026-01-18 in force | 2026-07-11 Digital Code takes effect