Kazakhstan’s Law on Artificial Intelligence: a new regulatory era

The AI Law applies to all entities involved in the creation, ownership, and use of AI systems on the territory of Kazakhstan. It defines artificial intelligence as the functional capacity to simulate cognitive functions characteristic of humans, producing results comparable to or exceeding those of human intellectual activity (Article 1). This broad definition captures not only generative AI tools but also predictive analytics, automated decision-making platforms, and machine learning systems used in manufacturing, logistics, finance, and other sectors.

The AI Law enshrines several guiding principles: legality, fairness and equality, transparency and explainability, the primacy of human wellbeing, freedom of will in decision-making, data protection, and safety (Articles 4–11). Notably, AI is treated as an instrument for achieving human objectives, not as an autonomous agent. This principle runs through every substantive provision of the law and has direct implications for questions of liability and authorship.

Following the approach of the EU AI Act, the AI Law introduces a risk-based classification system. AI systems are categorised as minimal, medium, or high risk based on their potential impact on safety, fundamental rights, and critical infrastructure (Article 17). High-risk systems that form part of Kazakhstan’s critical digital infrastructure are subject to enhanced regulatory oversight, including mandatory audits and potential inclusion on government-maintained “trusted system” lists (Articles 19–20).

For foreign companies, this classification matters: an AI tool used in-house for document management will face lighter requirements than a system deployed in healthcare diagnostics, financial risk assessment, or energy infrastructure. Companies should assess which category their AI applications fall into and prepare for the corresponding compliance obligations.

Article 21 imposes an obligation to inform users when goods, works, or services are produced or provided with the use of AI systems. Furthermore, synthetic content — defined as images, video, audio, text, or combinations thereof created or modified by AI systems that simulate the appearance, voice, or behaviour of a natural person or events that did not in fact occur (Article 1) — must be labelled in both a machine-readable format and with a visual indication.

For companies generating marketing materials, product descriptions, customer communications, or any content with AI assistance, this requirement necessitates the implementation of internal labelling protocols. Failure to inform users about the synthetic nature of content, or failure to manage risks of high-risk AI systems resulting in harm, carries administrative fines of up to 100 MCI (Monthly Calculation Index) for large enterprises.

Article 23 addresses the copyright status of AI-assisted works. The core principle is straightforward: protection is available only where there is a genuine human creative contribution. AI is not recognised as an author or a legal subject. For businesses generating content with AI tools, this means that the extent of human involvement — concept development, editorial decisions, selection and refinement — will determine whether the output enjoys any protection at all.

Article 24 provides that damage caused by AI systems is subject to compensation in accordance with the Civil Code of the Republic of Kazakhstan. The responsibility falls on the owners and/or operators of AI systems, based on their respective roles at each stage of the AI system’s lifecycle (Article 8). This means that for foreign-invested entities operating in Kazakhstan, it is important to establish clear contractual allocation of liability between the AI system provider, the local operator, and the end user.

Companies operating in Kazakhstan through subsidiaries, branches, or representative offices should consider the following steps: