KyrgyzstanDigital Code, Chapter 23: AI system design and risk-management obligations
Digital Code, Law No. 178 (), in force , Chapter 23, Arts. 191-196
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- DPIA, Governance
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- An app that designs, develops or applies an AI system in Kyrgyzstan may do so without restriction beyond what the Digital Code sets, and should follow the Code's principles of risk reduction, openness, explainability, human oversight, accuracy, reliability and security.
- An app whose AI system a hazard assessment finds poses increased danger to life, health, rights, the environment, defense, national security or public order must have its owner reassess that hazard at each design, development, deployment and material-change stage, and publish the assessment and its methodology on the owner's own website as open data.NIST AI RMFMAP 5.1NIST AI RMFGOVERN 4.2
- An owner of such a heightened-risk system must meet the Cabinet of Ministers' risk-management, transparency, accuracy, reliability, data-quality and technical-documentation requirements, keep operating logs, and declare conformity in a signed digital document published on the owner's site before the system is deployed.NIST AI RMFGOVERN 1.4NIST AI RMFMEASURE 2.4
- A user of such a heightened-risk system must operate it per its instructions, keep the data it processes relevant, maintain effective human oversight and resourcing, immediately suspend use and notify the owner once it has grounds to believe use as instructed could cause harm to a protected interest, keep operating logs, and comply with a regulator's suspension order or a final court order to stop using the system.NIST AI RMFMAP 3.5NIST AI RMFMANAGE 2.4
- Where such a system's output feeds a decision that could affect a person's rights, the user must publish or otherwise supply plain-language information about the system and, on request from an affected person, explain free of charge how that person's result was reached.NIST AI RMFMEASURE 2.8NIST AI RMFMEASURE 2.9
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
2 more
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST CSF 2.0
- PR.PS-04Log records are generated and made available for continuous monitoring
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Both the owner's duty list (Art. 194(5)) and the user's duty list (Art. 196(1)) name "журналов работы системы" (the system's operation logs) directly, item 4 and item 5 respectively: each must ensure the logs are preserved for the period the system is under their control. No fixed or purpose-bound period is stated, only that the logs must survive as long as the system remains under the owner's or user's control. Neither list, nor any other provision in Arts. 191-197, names who may demand these logs: item 7 of each list is a suspension/discontinuation power triggered by the authorized state body's demand or a final court act, not an access route into the logs themselves.
- Kind
- Explicit
- As of
- Provision
- Art. 194(5)(4); Art. 196(1)(5)
- Trigger
- high_risk_systems
What this law does
Arts. 191-196, read in full, establish Kyrgyzstan's AI governance framework: Art. 191 sets non-binding design principles (risk reduction, openness, explainability, human oversight, accuracy, reliability, security) that any later binding requirement must implement, and Arts. 192-196 attach binding duties once an owner's own hazard assessment finds a system poses increased danger to a protected interest.
An owner of such a system must reassess and republish the hazard assessment at each life-cycle stage, meet Cabinet of Ministers risk-management and documentation requirements, keep operating logs, and declare conformity by a published, digitally signed document before deployment.
A user of such a system must operate it per its instructions, maintain effective human oversight, immediately suspend use and notify the owner once it has grounds to believe use could cause harm, keep logs, comply with a suspension or final court order, and, where the system's output feeds a rights-affecting decision, explain that result to an affected person on request free of charge; a person using the system solely for personal or family needs is excused most of these duties.
Chapter 23 states no duty for an owner or a user to notify the authorized state body of a suspension or of grounds to believe a system may cause harm: that body's role under Arts. 194(5)(7) and 196(1)(7) is to demand a suspension the owner or user must then carry out, enforceable by a final court act ordering the system's use to stop.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .