Makes credit decisions, in Kyrgyzstan

Law of the Kyrgyz Republic No. 58, 14 April 2008, 'On Personal Information' (Kyrgyz: 'Жеке мүнөздөгү маалымат жөнүндө'); as amended by Laws of 20 July 2017, 29 November 2021, and 12 July 2022

• Register as a personal data holder in the national register.
• Complete a mandatory impact assessment for high-risk processing, including profiling and automated decisions.
• Obtain consent or another lawful basis before scraping personal data held in Kyrgyz-hosted systems for AI training.

Digital Code, Law No. 178 (31 July 2025), in force 6 February 2026, Chapter 23, Arts. 191-196 · Read the law's page

• An app that designs, develops or applies an AI system in Kyrgyzstan may do so without restriction beyond what the Digital Code sets, and should follow the Code's principles of risk reduction, openness, explainability, human oversight, accuracy, reliability and security.
• An app whose AI system a hazard assessment finds poses increased danger to life, health, rights, the environment, defense, national security or public order must have its owner reassess that hazard at each design, development, deployment and material-change stage, and publish the assessment and its methodology on the owner's own website as open data.
• An owner of such a heightened-risk system must meet the Cabinet of Ministers' risk-management, transparency, accuracy, reliability, data-quality and technical-documentation requirements, keep operating logs, and declare conformity in a signed digital document published on the owner's site before the system is deployed.
• A user of such a heightened-risk system must operate it per its instructions, keep the data it processes relevant, maintain effective human oversight and resourcing, immediately suspend use and notify the owner once it has grounds to believe use as instructed could cause harm to a protected interest, keep operating logs, and comply with a regulator's suspension order or a final court order to stop using the system.
• Where such a system's output feeds a decision that could affect a person's rights, the user must publish or otherwise supply plain-language information about the system and, on request from an affected person, explain free of charge how that person's result was reached.

Digital Code, Law No. 178, Art. 126 (read with Art. 1, definition 61), in force 6 February 2026 · Read the law's page

• A provider of a digital well-being service that uses an AI system within the service must treat that system as an AI system of increased danger and meet the requirements the Digital Code sets for such systems.

Digital Code, Law No. 178, Art. 63 · Read the law's page

• Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
• If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
• In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
• This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.

Digital Code, Law No. 178, Art. 63(1)-(4) · Read the law's page

• This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
• Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.
• If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
• Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.

Model Law of the Commonwealth of Independent States (CIS) on Artificial Intelligence Technologies, adopted at the CIS Inter-Parliamentary Assembly, 2024; non-binding model legislation for CIS member states

Resolution of the Cabinet of Ministers of the Kyrgyz Republic (2025–2026, implementing Digital Code Chapter 23); establishing methodology for AI safety assessment, risk management rules for high-risk AI, and criteria for transparency, explainability, controllability, accuracy, reliability, and digital resilience

• This law is recorded as enacted, but the record carries no commencement date, so whether it is yet in force has to be established before relying on what follows.
• Implement the required safety and quality measures for AI systems throughout their lifecycle.
• Conduct lifecycle safety assessments for AI systems.