Kazakhstan's Digital Code (2026): New AI, Data Rules

Kazakhstan's Digital Code (2026): New AI, Data Rules are now in effect, establishing a comprehensive legal framework for the nation's digital economy. Effective July 12, 2026, the Code mandates human oversight for significant AI decisions, requires data localization, and expands digital rights for citizens. This legislation underpins the government's strategy to position Kazakhstan as a leading digital country.

What is Kazakhstan's Digital Code and how does it impact AI and data governance?

Effective July 2026, Kazakhstan's Digital Code establishes a comprehensive legal framework for technology. It regulates artificial intelligence (AI) by creating predictable legal protections for AI development, requires data to be stored within the country, mandates human review of automated decisions, and creates unified rules for digital rights.

A New Legal Architecture for the Digital Economy

The Digital Code of the Republic of Kazakhstan (No. 255-VIII) creates a new legal architecture for technology engagement by businesses and government agencies. The Code regulates data, algorithms, and automated systems to make AI development predictable and legally protected, establishing a unified national framework for algorithmic governance and digital sovereignty.

The Digital Code treats AI systems within a comprehensive regulatory framework that ensures rules apply regardless of whether a vendor labels the product as "AI."

This framework complements separate AI legislation that has been developed in Kazakhstan. While dedicated AI laws define risk tiers and ban practices like social scoring, the Digital Code imposes operational duties related to automated decisions, data sovereignty, and cybersecurity.

Three Critical Requirements for AI Development

Businesses developing or deploying AI in Kazakhstan must adapt to three transformative operational requirements:

Requirement	Business Impact
Data Provenance Audits	AI quality audits are now tied to the lawfulness and quality of training data, making data provenance a compliance issue rather than purely an engineering concern
Human Review Rights	The Code mandates that any person subject to fully automated decisions receive confirmation of algorithm use, a plain explanation of key criteria, and the right to human review for legally significant decisions
Critical Object Risk Regime	AI systems classified as critically important digital objects face mandatory cybersecurity compliance and audits, with high-risk AI under the AI Law frequently meeting this definition

The human review requirement introduces significant operational challenges. Organizations must implement systems for citizens to contest algorithmic decisions and secure a review by an authorized specialist. This impacts a wide range of applications, including credit scoring and automated hiring processes.

Data Governance Under Stricter Sovereignty Rules

The Code establishes strict data governance rules that have immediate operational impacts:

• Data Localization: Businesses must ensure data storage and processing occur within Kazakhstan when required by sovereignty provisions, shaping architectural decisions for cloud infrastructure.
• Cybersecurity & Integrity: Owners of digital objects must ensure the reliability, integrity, protection, and cybersecurity of their systems, including full compliance with personal data protection laws.
• Transparency Obligations: Users subject to fully automated decisions are entitled to: (1) confirmation that an algorithmic system was used, (2) an explanation of the key factors and criteria influencing the decision, and (3) a human review if the decision has legal consequences or affects their rights.

Crucially, while the Code requires organizations to explain the criteria behind automated decisions, it does not compel the disclosure of source code, algorithms, or other trade secrets. This approach balances accountability with the protection of intellectual property.

Digital Rights as a Competitive Factor

Right	Practical Implication
Right to Identity	Citizens can choose how their identity is confirmed digitally (e.g., e-signatures, biometrics, digital IDs) and must be offered opt-out alternatives.
Data Management	Individuals have rights to delete, anonymize, or restrict the processing of their personal data, including suspending its use when no longer needed.
Algorithmic Accountability	Citizens can challenge AI or automated decisions, requiring a formal review by an authorized specialist.

Regulation of biometric data is now stricter, with its use limited to specific cases defined by law - a significant change for financial and security sectors.

The Code moves Kazakhstan's digital environment from a "gray area of legal uncertainty" into a structured market system, increasing trust in AI and supporting market growth.

Government Digital Transformation as Market Driver

The Code's mandate for government-wide digital transformation creates significant market opportunities for technology firms. President Kassym-Jomart Tokayev signed the executive order officially declaring 2026 the "Year of Digitalization and Artificial Intelligence". Prime Minister Olzhas Bektenov is implementing sector-wide initiatives under the President's direction.

The National Strategy "Digital Qazaqstan" (2024-2029), signed by President Tokayev, aims to deliver proactive public services and requires digital tools for key industries, including agro-industry, construction, finance, and energy.

Key infrastructure developments include:

Initiative	Status
National AI Platform (NAIP)	Launched with sovereign LLMs (KazLLM, AlemLLM) supporting 100+ AI agents
Supercomputing Capacity	2 EFlops supercomputer with 512 NVIDIA H200 GPUs operational
5G Deployment	Nationwide completion targeted, with 2,500+ base stations deployed
IT Workforce Development	100,000 IT professionals training program; AI Qyzmet program for civil servants
Rural Connectivity	2,600 rural settlements connected; 1,900 additional planned

The Ministry of Artificial Intelligence and Digital Development spearheads these efforts, with the "Government for Citizens" State Corporation executing e-government services.

Practical Implications for Technology Implementation

For organizations operating in Kazakhstan, several key compliance areas demand immediate attention:

• Cross-Border Data Transfers: Companies must adhere to strict controls on international data flows and implement robust cybersecurity measures to prevent unauthorized access.
• Platform Obligations: Owners of digital platforms are subject to new requirements for cybersecurity, data leak prevention, and data transfer protocols. The Code introduces legal concepts such as "digital space" and "digital data products" that will impact service and contract models.
• Foreign Entity Treatment: Foreign legal entities operating in Kazakhstan's digital market are granted the same rights and responsibilities as local entities, imposing identical compliance burdens unless international treaties specify otherwise.

The regulations apply to any organization deploying algorithmic systems that affect people or process data in Kazakhstan, irrespective of where the company is based. For global technology providers, this framework imposes binding legal obligations, requiring immediate action to classify AI systems by risk, maintain complete lifecycle documentation, and establish human-in-the-loop review processes.

Integration with Broader Digital Strategy

The Digital Code is integral to Kazakhstan's strategy to become Central Asia's digital powerhouse. Major infrastructure projects, including the Data Center Valley in Ekibastuz and the Alatau City tech hub, underscore this commitment.

For technology companies, this presents a dual opportunity: complying with the Code provides access to lucrative government contracts, while sovereign AI infrastructure (e.g., KazLLM, AlemLLM on the National AI Platform) offers localized solutions that bypass data residency challenges.

The Code's emphasis on annual digital transformation programs with integrated KPIs, while primarily targeting government bodies, establishes benchmarks that private sector partners will increasingly need to align with to remain competitive.

Consequently, organizations with proven expertise in regulated environments - particularly in CRM implementation, AI governance, and data localization - are uniquely positioned to succeed as Kazakhstan advances its digital transformation under this new legal framework.