Kazakhstan
◆Binding
Binds Собственники и владельцы систем искусственного интеллекта — the owners and holders of AI systems. The Law states no size, sector, turnover or nationality threshold, so enterprise, SME, sole trader and public body are all covered on the same terms; the administrative fines in KoAP art. 641-1 are the place where size enters, and they are graded across natural persons, small business and non-commercial organisations, medium business and large business.. Law of the Republic of Kazakhstan No. 230-VIII ЗРК of 17 November 2025 «Об искусственном интеллекте» is Kazakhstan's first standalone AI statute and the first in Central Asia, and art. 17 is its structural core. Art. 17(3) forbids, on the territory of Kazakhstan, the creation and operation of AI systems possessing any one of seven functional capabilities: (1) use of subconscious, manipulative or other methods that distort a natural person's behaviour and limit their capacity to take informed decisions, or that push them into decisions capable of causing or threatening harm; (2) exploitation of a person's moral or physical vulnerability arising from age, disability, social position or any other circumstance, with the aim of causing or threatening harm; (3) evaluation and classification of natural persons or groups over a period of time on the basis of their social behaviour or known, assumed or predicted personal characteristics — a social-scoring ban, subject to cases provided by law; (4) collection and processing of personal data in breach of the personal-data legislation; (5) classification of natural persons on the basis of biometric data to infer race, political views, religious affiliation or any other criterion for the purpose of discriminating against them; (6) determination of a person's emotions without their consent, save in cases provided by law; and (7) creation and dissemination of results of AI activity that the laws prohibit. The list is close enough to EU AI Act art. 5 to be read against it, but it is a prohibition on creation and operation rather than on placing on the market, it has no law-enforcement-carve-out architecture, and the emotion-recognition limb is a consent rule rather than a workplace-and-education ban. Art. 17(1) then sets the three risk tiers — minimal, medium and high — and, unlike the EU's annex-driven scheme, assigns the classification to the owner and (or) holder of the system itself, applying the rules on classification of informatisation objects. High-risk systems that are also critically important information-and-communication infrastructure, or that are intended to form state electronic information resources, are treated as state systems for information-security purposes. Art. 17(2) adds a second, orthogonal axis of autonomy — low (a human always makes the final choice), medium (human correction or reversal remains possible) and high (human correction or reversal is wholly excluded or technically impossible) — and defers the rules on creating and operating high-autonomy systems to other laws, which is a real gap rather than a filled slot.
In force since 18 January 2026. Art. 31 commences the Law «по истечении шестидесяти календарных дней после дня его первого официального опубликования», with no article carved out. The А́ділет record card gives first official publication as the newspapers «Егемен Қазақстан» No. 222 (31202) and «Казахстанская правда» No. 222 (30600), both of 18 November 2025, with the Reference Control Bank of NPA in electronic form following on 20 November 2025. The sixty days run from 19 November 2025 and expire at the end of 17 January 2026, so the Law entered into force on 18 January 2026. А́ділет serves the text as «Обновленный» (consolidated and current), database state 19 August 2026, and flags the only pending change — Law No. 326-VIII of 24 June 2026 — as a future «Примечание ИЗПИ» note rather than as applied text.
Stated maximum penalty — The Law itself sets no figure: art. 30 is a bare referral to responsibility «в соответствии с законами Республики Казахстан». The companion Law No. 232-VIII of 17 November 2025 inserted KoAP art. 641-1, but its part one reaches only two things — failure to inform users about misleading synthetic outputs, and failure to manage the risks of a high-risk system where that failure caused harm — so breach of the art. 17(3) prohibitions is NOT itself an enumerated administrative offence. In practice an art. 17(3) capability is reached indirectly: through art. 18(2), which obliges immediate suspension or termination once such a risk is identified and whose breach is penalised by art. 641-1, through art. 20(2)(2), which makes the presence of prohibited capabilities an express object of AI system audit, through the personal-data offences in KoAP art. 79-1 and following where limb (4) is engaged, and through the criminal law, since art. 641-1 applies only «если это действие (бездействие) не содержит признаков уголовно наказуемого деяния». This entry states no figure for art. 17(3) itself rather than importing the art. 641-1 band, which on its face does not cover it.
Kazakhstan
◆Binding
Binds Собственники и владельцы систем искусственного интеллекта — the owners and holders of AI systems. The Law states no size, sector, turnover or nationality threshold, so enterprise, SME, sole trader and public body are all covered on the same terms; the administrative fines in KoAP art. 641-1 are the place where size enters, and they are graded across natural persons, small business and non-commercial organisations, medium business and large business.. Art. 18 of Law No. 230-VIII is the obligation with teeth. It defines AI risk management as a continuous process, planned and carried out by the owner and (or) holder across the whole lifecycle of the system, comprising four elements: identification and analysis of known and foreseeable risks of the system when used according to its intended purpose; assessment of risks both against the intended purpose and under conditions of foreseeable misuse; adoption of appropriate and targeted risk-management measures designed to prevent and eliminate the risks identified; and — the one hard cadence in the statute — regular updating of the risks not less than once a year. Art. 18(2) adds a trigger duty: where a risk is identified that the circumstances in art. 17(3), the prohibited-capability list, may arise, the owner and holder must take immediate measures to prevent and minimise damage and to protect the rights, freedoms and legitimate interests of natural persons and of society, including by suspending or wholly terminating operation of the system. Two features are worth marking against the EU comparison. The duty as drafted is not confined to high-risk systems — art. 18(1) speaks of the owner and holder of an AI system without qualification — whereas the administrative offence that backs it in KoAP art. 641-1(1)(2) is limited to high-risk systems and additionally requires a consequence, so the duty is broader than its sanction. And the annual refresh is a floor stated in the statute itself, not in delegated rules, which makes it directly checkable in a way EU AI Act art. 9 is not. Art. 19 sits alongside as a voluntary quality route: sectoral state bodies compile and continuously publish lists of trusted high-risk AI systems, and an owner seeking inclusion must have the system audited under art. 20, whose art. 20(2) requires the audit additionally to assess the quality and lawfulness of the data libraries used to train the models and the presence of prohibited functional capabilities.
In force since 18 January 2026. Art. 31 commences the Law «по истечении шестидесяти календарных дней после дня его первого официального опубликования», with no article carved out. The А́ділет record card gives first official publication as the newspapers «Егемен Қазақстан» No. 222 (31202) and «Казахстанская правда» No. 222 (30600), both of 18 November 2025, with the Reference Control Bank of NPA in electronic form following on 20 November 2025. The sixty days run from 19 November 2025 and expire at the end of 17 January 2026, so the Law entered into force on 18 January 2026. А́ділет serves the text as «Обновленный» (consolidated and current), database state 19 August 2026, and flags the only pending change — Law No. 326-VIII of 24 June 2026 — as a future «Примечание ИЗПИ» note rather than as applied text.
Stated maximum penalty — KoAP art. 641-1(1)(2), inserted by Law No. 232-VIII of 17 November 2025 (published «Егемен Қазақстан» and «Казахстанская правда» No. 222, 18 November 2025, so in force on the same 18 January 2026 date), penalises the failure by owners or holders to carry out risk management of HIGH-risk AI systems where that failure caused negative impact on people's health or wellbeing, the creation or dissemination of prohibited or false information, discrimination or violation of human rights, or other harm, and provided the act or omission carries no indicia of a criminal offence. First offence: 15 MRP for natural persons, 20 MRP for small business entities and non-commercial organisations, 30 MRP for medium business entities, 100 MRP for large business entities. Repeat within one year of an administrative penalty being imposed, under art. 641-1(2): 30, 50, 70 and 200 MRP respectively, AND suspension or prohibition of the operation of the AI system — which is the sharpest consequence in the regime, since the monetary ceiling is modest. Jurisdiction sits with the authorised body in the field of artificial intelligence under new KoAP art. 692-3, and cases may be heard and penalties imposed by the head of that body and their deputies. Amounts are stated in the mесячный расчетный показатель (MRP, monthly calculation index), the statutory unit the Code uses; the tenge value of one MRP is reset every year by the republican budget law, so the MRP figures rather than a converted tenge sum are the stable statement of the penalty.
Kazakhstan
◆Binding
Binds Art. 21(1) is expressed impersonally and attaches to whoever produces or supplies goods, works or services using AI systems, so it reaches commercial and public suppliers alike with no size or sector threshold. Arts. 21(2), (3) and (5) place the marking, informing and output-conformity duties on собственники и (или) владельцы of the AI systems concerned — owners and holders — again without threshold. The administrative offence backing the synthetic-output limb is graded by business size, from natural person through small, medium and large business entities.. Art. 21 of Law No. 230-VIII carries Kazakhstan's transparency and synthetic-media rules, and unlike the labelling provisions in Russia's 243-FZ it is a genuine duty rather than an entitlement. Art. 21(1) requires that users be informed that goods, works and services are produced or supplied using AI systems — a broad, unthresholded disclosure obligation attached to the commercial offering itself, not merely to generated content. Art. 21(2) then provides that dissemination of synthetic results of AI activity is permitted only on condition that they are marked in machine-readable form AND accompanied by a visual or other form of warning that the user can actually perceive without methods that impede such perception — a dual-layer requirement, machine-readable plus human-perceptible, with an express anti-obfuscation limb. Art. 21(3) places responsibility for informing users about synthetic outputs on the owners or holders of the systems, and art. 21(5) makes the owner and (or) holder responsible for ensuring that the outputs of AI systems conform to the requirements of Kazakh legislation generally. Art. 21(4) is the signpost that matters for automated decision-making: requirements for taking decisions on the basis of exclusively automated processing of personal data are set by the personal-data legislation, i.e. art. 19-1 of Law No. 94-V, tracked separately at kz-pd-art19-1. Art. 22 supports art. 21 by mandating machine-readable forms that allow conditions to be recognised automatically and unambiguously by AI systems and other data-processing means, with the procedure for developing, applying and distributing them to be determined by the authorised body — so the technical standard for the art. 21(2) marking is delegated and not yet fixed on the face of the statute.
In force since 18 January 2026. Art. 31 commences the Law «по истечении шестидесяти календарных дней после дня его первого официального опубликования», with no article carved out. The А́ділет record card gives first official publication as the newspapers «Егемен Қазақстан» No. 222 (31202) and «Казахстанская правда» No. 222 (30600), both of 18 November 2025, with the Reference Control Bank of NPA in electronic form following on 20 November 2025. The sixty days run from 19 November 2025 and expire at the end of 17 January 2026, so the Law entered into force on 18 January 2026. А́ділет serves the text as «Обновленный» (consolidated and current), database state 19 August 2026, and flags the only pending change — Law No. 326-VIII of 24 June 2026 — as a future «Примечание ИЗПИ» note rather than as applied text. Note that the machine-readable marking standard contemplated by arts. 21(2) and 22(3) is to be determined by the authorised body and no such act has been identified as at 21 August 2026, so the form of compliant marking is not yet fixed even though the duty itself is in force.
Stated maximum penalty — KoAP art. 641-1(1)(1) penalises the failure by owners or holders of AI systems to inform users about synthetic results of the system's activity that are capable of misleading them, where the act or omission carries no indicia of a criminal offence. First offence: 15 MRP for natural persons, 20 MRP for small business entities and non-commercial organisations, 30 MRP for medium business entities, 100 MRP for large business entities. Repeat within a year of a penalty being imposed: 30, 50, 70 and 200 MRP respectively, together with suspension or prohibition of the operation of the AI system. Two limits are worth stating precisely. The offence is drafted around informing about synthetic outputs «которые могут ввести их в заблуждение» — capable of misleading — so it is narrower than art. 21(2), which conditions dissemination of ALL synthetic results on marking; and it does not reach the art. 21(1) duty to disclose that goods, works or services are produced using AI at all. Cases are decided by the authorised body in the field of artificial intelligence under KoAP art. 692-3. Amounts are stated in the mесячный расчетный показатель (MRP, monthly calculation index), the statutory unit the Code uses; the tenge value of one MRP is reset every year by the republican budget law, so the MRP figures rather than a converted tenge sum are the stable statement of the penalty.
Kazakhstan
◆Binding
Binds Собственник и (или) оператор, а также третье лицо — the owner and (or) operator of a personal-data database and any third party, with no size, sector or turnover threshold, so enterprise, SME and public body are covered alike. Note that the art. 19-1 duty runs to the third party as well as to the owner and operator, which is broader than the equivalent Russian and Uzbek provisions. The general exclusions in art. 19 for the exercise by state bodies of their statutory functions, for private notaries, private court enforcement agents and advocates, and for collection and processing for statistical, sociological or scientific purposes attach to art. 19 and not to art. 19-1.. Kazakhstan's automated-decision rule is new: art. 19-1 was added to the Law No. 94-V of 21 May 2013 «О персональных данных и их защите» by Law No. 231-VIII of 17 November 2025, the companion act to the AI Law, and it took effect on 18 January 2026. Art. 19-1(1) prohibits automated processing of personal data as a result of which the subject's rights or legitimate interests arise, change or cease, except where the subject's consent has been obtained or in cases provided by the laws of Kazakhstan. Three drafting choices distinguish it from the neighbouring regimes the tracker already carries. First, the trigger is the automated PROCESSING rather than a decision taken on its basis, and art. 1(2-3) of the Law defines automated processing as processing by an informatisation object that excludes the participation of the owner, operator or third party in the process — so the exclusivity test sits in the definition. Second, the consequence limb is drafted as rights or legitimate interests arising, changing or ceasing, which is narrower than Russia's art. 16 «иным образом затрагивающих» catch-all but avoids GDPR art. 22(1)'s significance threshold. Third, and unlike both Russia's art. 16(2) and Uzbekistan's art. 24, there is NO contract exception and NO written-form qualifier on the consent: ordinary consent under the Law suffices, which makes the exit both easier to reach and less formal than Russia's art. 9(4) written consent with identity-document particulars. Art. 19-1(2) is a standing, proactive duty on the owner, operator and third party to explain to the subject the procedure of the automated processing of their personal data and its possible consequences, to provide the opportunity to state an objection to that processing, and to explain how the subject may protect their rights, freedoms and legitimate interests. Art. 19-1(3) then gives THREE WORKING DAYS from receipt to consider the objection and notify the subject of the outcome — markedly tighter than Uzbekistan's ten days and Russia's thirty — and preserves the right to challenge the acts or omissions of the owner, operator or third party in the manner established by law. As in Russia and Uzbekistan, nothing obliges the controller to change the decision, and no right to human intervention or to an explanation of the LOGIC is expressed. Note for anyone working from the earlier research note: art. 20 of this Law is not the relevant provision — it is a general guarantee that personal data are protected by the state — and the automated-processing rule is art. 19-1.
In force since 18 January 2026. The Сноска to art. 19-1 records that Chapter 2 was supplemented with the article by Law No. 231-VIII of 17 November 2025 «по вопросам искусственного интеллекта и цифровизации», commencing on expiry of sixty calendar days after first official publication. The Әділет record card for 231-VIII gives that publication as «Егемен Қазақстан» No. 222 (31202) and «Казахстанская правда» No. 222 (30600), both 18 November 2025, so the period expired at the end of 17 January 2026 and the article took effect on 18 January 2026 — the same day as the AI Law. Art. 19-1 has not itself been amended since; the pending Law No. 326-VIII of 24 June 2026 is flagged by ИЗПИ against arts. 19(1), 22(2) and others but not against art. 19-1. Text checked in the consolidated redaction, database state 19 August 2026.
Stated maximum penalty — No penalty is addressed to art. 19-1 specifically. KoAP art. 641-1, the AI offence created alongside it by Law No. 232-VIII, covers only the synthetic-output information failure and the high-risk risk-management failure, and neither reaches automated processing under the Personal Data Law. Breach therefore falls back on the general personal-data offences in the Code — principally KoAP art. 79-1, unlawful collection and processing of personal data — whose bands are not specific to automated processing, and on the art. 27 remedies of the Law itself. This entry states no figure rather than importing an adjacent band, because the offence that would apply depends on which limb of art. 19-1 was breached and the Code contains no automated-processing article.