Makes education decisions, in Kazakhstan

Law No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1 · Read the law's page

• An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked, anonymized, destroyed or deleted where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.

Law No. 230-VIII (17 November 2025), Art. 17(3) · Read the law's page

• Do not build or operate an AI system that uses subconscious or manipulative methods to distort a person's behaviour or coerce a harmful decision.
• Do not build or operate an AI system that exploits a person's age, disability, social position or other vulnerability to cause or threaten harm.
• Do not evaluate or classify people over time by their social behaviour or predicted personal traits, unless a Kazakhstani law provides for it.
• Do not classify people by biometric data to infer race, political views, religion or similar traits for the purpose of discrimination.
• Do not determine a person's emotions without their consent, unless a Kazakhstani law provides for it.
• Do not create or distribute an AI-generated output that Kazakhstani law bans.

Law No. 230-VIII (17 November 2025), Arts. 7, 21 · Read the law's page

• Give users full information about an AI system's operational characteristics and limitations, and inform a user subject to an AI-assisted decision of the automated processing, its consequences, and how to object.
• Inform users that goods, works or services are produced or provided using an AI system.
• Label synthetic audio, video, image or text output in machine-readable form and accompany it with a visual or other warning a user can perceive without impediment before distributing it.

Law No. 232-VIII (17 November 2025), Administrative Offences Code Art. 641-1 · Read the law's page

• An AI system's owner or holder who fails to ensure users are informed of misleading synthetic output, or fails to manage the risks of a high-risk system with harmful results, is liable to an administrative fine of fifteen to one hundred monthly calculation indices for a first violation and thirty to two hundred for a repeat violation within a year, depending on the violator's size, with suspension or prohibition of the system's operation on a repeat violation.

Digital Code No. 255-VIII (9 January 2026), Art. 43 · Read the law's page

• Tell a person, on request, that a fully automated algorithmic system, an AI system included, was used to make a decision affecting them.
• Give the person an explanation of the key factors and criteria that influenced the decision, without disclosing the algorithm, source code or a legally protected secret.
• Allow the person to demand review of the decision by an authorised specialist where it carries legal consequences or can affect their rights and legitimate interests.
• Do not let a decision made using an algorithmic system result in discrimination on a ground Kazakhstani law sets out.

Digital Code No. 255-VIII (9 January 2026), Arts. 20, 97-98 · Read the law's page

• Protect the confidentiality, integrity and availability of every digital object you own or hold in Kazakhstan, a category that expressly includes software you make available to others.
• Implement technical measures, including cryptographic protection where applicable, together with organizational and legal measures, aimed at preventing, detecting and eliminating cyber threats to that digital object.
• Also follow the specific requirements set by the Law of the Republic of Kazakhstan "On Cybersecurity" and the unified digitalization and cybersecurity requirements adopted under it; their own specific duties are not further detailed here.