Kazakhstan’s Law on Artificial Intelligence: What Institutions Implementing AI Need to Know
Contents
Kazakhstan's Law on Artificial Intelligence has been in effect since January 18, 2026. For research institutes, government institutions, and companies implementing AI assistants and analytics, this is more than an abstract news item: the law sets requirements for data protection and accountability for the operation of AI systems.
This article is not legal advice. It helps you understand which questions to discuss with your lawyer and contractor before launching an AI project.
Key provisions for implementation
Data protection and confidentiality
The law requires data protection, prevention of unauthorized access, and compliance with personal data laws when operating AI systems.
Types of AI systems
The law distinguishes between open, closed, and local AI systems. The type of system determines how it should be used and protected. For institutions handling sensitive data, this is an argument for closed and local solutions.
Personal data
Personal data legislation requires this data to be stored in a database located in Kazakhstan. Transferring and processing it requires a legal basis or the data subject's consent. This directly affects AI systems that process inquiries from citizens, medical records, personnel data, or student data.
High-risk systems
AI systems in critical areas are subject to heightened information security requirements comparable to those for government systems, and their owners must oversee their operation and manage risks.
Questions to ask before launching an AI project
- What data will the system process, and does it include personal data?
- Where are the processing servers physically located?
- Is data transferred to foreign AI providers?
- Is the system classified as high-risk?
- How will users know they are interacting with AI?
- Who makes decisions based on AI results?
- Is a log of the system's operation maintained?
- How is data deleted upon request?
What this means for different organizations
- Research institutes and universities: intellectual property and personal data of students and employees.
- Government institutions: internal information, citizen inquiries, and information security requirements.
- Medical organizations: medical data, with a closed or local environment preferred.
- Companies: customers' personal data in chatbots and CRM.
Frequently asked questions
Can you use foreign AI services?
Usually, yes for anonymized and public data. For personal and confidential data, assess the risks and localization requirements with a lawyer.
Do you need to tell users they are interacting with AI?
This is good practice and a question worth checking with a lawyer in light of the law's requirements.
What should you do with systems already in operation?
Take inventory of what data is processed, where, and on what legal basis.
