The foundational principles can be summarized as follows:
- AI systems (‘AISs’) must be developed and operated in a way that ensures fairness and equality. This includes respect for human dignity, equal worth, rights, freedoms, and legitimate interests, and must be free from any form of discrimination.
- In addition to ‘justice by design’, AISs must follow a ‘safety by design’ approach. They must be developed and operated in compliance with safety and reliability requirements.
- Transparency must also be guaranteed. Users must be informed about how the AI system (‘AIS’) works, as well as about its limitations, so that it can be used appropriately for its intended purpose.
- The protection of personal data and privacy must be respected at all times.
- Finally, the development and operation of AISs must take energy efficiency into account and aim to reduce negative environmental impacts.
Below is an overview of some key provisions:
(1) Establishment of a national platform for AI
The creation of a national platform for AI that provides AI related services, as well as the collection, processing, and storage of data libraries (i.e. training data for AI models) that can be used for the training of AI models.
(2) Rights and obligations of owners, operators, and users of AI systems
- Owners and operators are responsible for the risk management of AISs. They must identify, analyse, and assess known and foreseeable risks associated with their AIS. Appropriate and targeted risk management measures must be taken to prevent or mitigate the identified risks. Risk assessments must be regularly updated, at least once per year.
- Owners and operators are also required to maintain technical documentation relating to their AISs.
- In addition, owners and operators must assist users by providing support and information regarding the functioning of the AIS when questions arise.
- Users are granted rights to take measures to protect intellectual property created with the assistance of an AIS.
- Users also have the right to obtain information about the data used by the AIS to reach a specific decision.
- Finally, users may only use AISs within the scope of the access rights granted to them.
(3) Classification of AI systems by risk level and degree of autonomy
AISs are classified both according to their level of risk and their degree of autonomy.
Classification based on the level of risk
- Minimal risk: Disruption or shutdown of the AIS has a minimal impact on users.
- Medium risk: Disruption or shutdown leads to reduced efficiency or effectiveness of users’ activities and may cause moral or material harm.
- High risk: Disruption or shutdown of the AIS may result in a social and/or technological emergency and/or have significant consequences for defence, security, international relations, the economy, users, infrastructure of the Republic of Kazakhstan, or the functioning of individuals.
Classification based on the degree of autonomy
- Low autonomy: The AIS performs automated data processing and generates recommendations, forecasts, or solution options, but final decisions and actions are taken by a human.
- Medium autonomy: The AIS carries out autonomous processing and decision making, while retaining the possibility for humans to correct or cancel those decisions.
- High autonomy: The AIS operates with autonomous processing and decision making, where human correction or cancellation of decisions is fully excluded or technically impossible.
AISs classified as high risk and/or highly autonomous are subject to additional regulatory requirements.
(4) Prohibited AI systems
As is also the case under the EU AI Act, this law includes a list of prohibited AISs.
- AISs that are designed to manipulate individuals and thereby limit or impair their ability to make independent decisions are prohibited.
- AISs that exploit vulnerabilities related to age, disability, or other personal characteristics in order to cause harm are prohibited.
- AISs that incorporate mechanisms of social scoring – defined as the assessment or classification of individuals based on their social behaviour or personal characteristics – are not permitted, unless explicitly authorised by law.
- AISs that determine or infer a person’s emotions without the consent of the individual are prohibited, except where such use is expressly permitted by law.
- AISs that classify individuals based on biometric data for discriminatory purposes, such as race, political views, or similar attributes, are prohibited.
(5) Trusted high-risk AI systems
Sector specific lists of trusted high-risk AISs are established and published on the relevant government websites. To qualify for inclusion on these lists, a high-risk AIS must successfully undergo an audit conducted by an independent private auditing body.
(6) Mandatory marking of synthetic outputs
The marking of synthetic outputs is now mandatory. AI generated images, videos, audio, and text must be clearly labelled in order to protect the public from deepfakes, disinformation, and reputational harm. Such labelling must be provided in a machine-readable format and be accompanied by a visible or otherwise clear warning to users.
(7) Copyrights and AI
The law also contains specific provisions on copyright and AI. First, it establishes that works created with the assistance of an AIS are protected by copyright only where they are based on a human’s creative contribution. Text prompts submitted to AISs are eligible for copyright protection insofar as they constitute the result of human intellectual and creative activity.
In addition, the law clarifies that the use of works for the purpose of training AI models does not fall under the exception for free use of works for educational or scientific purposes. The law also states that using protected works for AI training purposes is outside the scope of traditional copyright protection (such as reproduction, distribution and adaptation), which is why it introduces a distinct use of copyrighted works. The use of works for AI training is only legally permitted when the author or rights holder has not expressly prohibited it, establishing an opt-out mechanism.
