Detailed overview
Kazakhstan has adopted a dedicated national AI law. The Law "On Artificial Intelligence" was adopted as part of a package of laws concerning AI and digitalisation, making Kazakhstan one of the first Central Asian jurisdictions with a specific AI statute. Official government materials state that Kazakhstan became the first country in Central Asia to adopt a Law "On Artificial Intelligence."
Kazakhstan's AI law establishes key legal concepts, principles and mechanisms for AI regulation. It provides for classification of AI systems, requirements for safe application of AI, and the legal basis for the national AI platform. This means that AI is treated not only as a technology-policy issue, but also as a regulated digital activity requiring safety, governance and accountability controls.
A central requirement is AI output labelling. The law provides for mandatory labelling of the results of AI activity in a machine-readable form. This is intended to reduce the spread of false information and make AI-generated or AI-supported outputs identifiable in digital environments.
Kazakhstan's framework also includes restrictions and prohibitions. The law provides for a list of prohibited functional capabilities in the creation and operation of AI systems in Kazakhstan. It also strengthens protection of personal data and information security: non-targeted collection of data from publicly available sources is prohibited, use of biometric data without the consent of the data subject is restricted, and mandatory anonymisation is required to protect rights and freedoms of individuals.
Kazakhstan also addresses copyright. Official parliamentary materials state that works created using AI systems are protected by copyright only if there is a creative contribution of a person in their creation. This is important for businesses using generative AI to produce text, images, designs, software, marketing materials or other outputs.
The AI law is accompanied by amendments to the Code of Administrative Offences, introducing liability for violations of legislation in the AI sphere. The exact sanction depends on the type of breach and the relevant administrative-offence provision. AI systems may also trigger liability under personal-data, cybersecurity, consumer, financial, healthcare, employment or criminal law.
Practical requirements & details
Sourced from the Law of the Republic of Kazakhstan "On Artificial Intelligence" and the Code of Administrative Offences as amended, together with official parliamentary materials on the AI law package.
Scope of the AI law
- Establishes key legal concepts, principles and mechanisms for AI regulation, including classification of AI systems, requirements for safe application of AI and the legal basis for the national AI platform.
- AI is treated as a regulated digital activity requiring safety, governance and accountability controls — not only a technology-policy issue.
AI output labelling
- Mandatory labelling of the results of AI activity in a machine-readable form.
- Purpose: reduce the spread of false information and make AI-generated or AI-supported outputs identifiable in digital environments.
Prohibitions & data protections
- The law provides for a list of prohibited functional capabilities in the creation and operation of AI systems in Kazakhstan.
- Non-targeted collection of data from publicly available sources is prohibited.
- Use of biometric data without the consent of the data subject is restricted.
- Mandatory anonymisation is required to protect rights and freedoms of individuals.
Copyright in AI-generated works
- Works created using AI systems are protected by copyright only if there is a creative contribution of a person in their creation.
- Relevant to generative AI used for text, images, designs, software and marketing materials — purely machine-generated output without human creative input is not protected.
Penalties
- Liability for violations of AI legislation is introduced by accompanying amendments to the Code of Administrative Offences.
- The exact sanction depends on the type of breach and the relevant administrative-offence provision.
- AI systems may also trigger liability under personal-data, cybersecurity, consumer, financial, healthcare, employment or criminal law.