Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Kazakhstan AI Law

In force Kazakhstan · In force Jan 18, 2026 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectTentativeJan 18 · 9 months ago · Source
AI Law takes effectThe Law takes effect after 60 calendar days from first official publication on 18 Nov 2025 (art. 31). The day is computed, not stated.

Summaries for reference, not legal advice. Check the official text.

What it does

Kazakhstan's first AI statute. Owners sort their AI systems into minimal, medium or high risk and must run yearly risk management, keep documentation and inform users when AI is used. Some AI functions are banned outright, including manipulation, exploiting vulnerable people, social scoring, biometric categorisation for discrimination and emotion recognition without consent. AI-generated synthetic content must carry machine-readable marking and a visible warning.

Who it applies to
Owners, holders and users of AI systems in Kazakhstan, owners of data libraries used for training, and the national AI platform operator.
Penalties
The Law defers to liability set in other Kazakh laws (art. 30). No fines are set in the Law itself.
Enforced by
Authorised central executive body for AI, with the Government of Kazakhstan
Official name
Law of the Republic of Kazakhstan on Artificial Intelligence (No. 230-VIII)
Citation
Law No. 230-VIII ZRK of 17 Nov 2025
Topics
AI, Privacy, Biometrics
Verified 2026-09-25 adilet.zan.kz
Research notes

Published in Egemen Kazakhstan and Kazakhstanskaya Pravda No. 222 on 18 Nov 2025. Amended by Law No. 326-VIII of 24 Jun 2026. Copyright applies to AI-assisted works only with human creative input, and training on works is allowed unless the author opts out in machine-readable form.

Related

AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022
In forceChina
China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026
Questions about Kazakhstan AI Law
What are the Kazakhstan AI Law compliance deadlines?
Jan 18, 2026: AI Law takes effect (tentative).
When does Kazakhstan AI Law take effect?
Kazakhstan AI Law took effect on Jan 18, 2026.
Who does Kazakhstan AI Law apply to?
Owners, holders and users of AI systems in Kazakhstan, owners of data libraries used for training, and the national AI platform operator.
What are the penalties under Kazakhstan AI Law?
The Law defers to liability set in other Kazakh laws (art. 30). No fines are set in the Law itself.