Part of the AI Regulation News hub.
Correction, October 1, 2026. An earlier version included unconfirmed publication dates, register and ministry details, and claims of verification. This article now clarifies when the law and order take effect, application and review deadlines, platform access, the operator's role, data requirements and the consequences of refusal. The summary of the AI law has also been clarified.
Kazakhstan approves rules for developing and hosting AI models on its National AI Platform
The order governs requests to develop or host platform software products or AI models on the National AI Platform. Kazakhstan has adopted a national AI statute, and the order implements its delegation on platform services.
Legal status: A ministerial order approving rules for requests to develop or host platform software products or AI models on the National AI Platform. It was registered with the Ministry of Justice on 14 August 2026 under No. 39591. The order takes effect ten calendar days after its first official publication.
Who this affects: State bodies, legal entities and individuals seeking to develop or host platform software products or AI models on the National AI Platform.
Issue date: Signed 13 August 2026. Registered with the Ministry of Justice 14 August 2026, No. 39591. The order takes effect ten calendar days after its first official publication. There is no general application deadline. Applicants have three working days after receiving an incompleteness notice to submit revised documents.
What changed: Article 25(2) of the AI Law told the authorised body to determine the interaction procedure. It has now done so. There is a prescribed request form, a prescribed technical passport, four review criteria, four refusal grounds and fixed day counts.
Analysis: Clause 5 requires review of the declared data-use arrangements by the platform operator, defined as a legal entity responsible for its development and operation. The review tests compliance with Kazakh legislation on digitalisation, personal data and their protection, and cybersecurity.
Primary sources: Order No. 482/NQ, Adilet, Russian text · Order No. 482/NQ, Adilet, Kazakh text · Law No. 230-VIII on Artificial Intelligence, 17 November 2025 · Registration card for the order (Adilet info tab)
- Instrument (EN)
- Order approving the rules of interaction between the operator of the national artificial intelligence platform and natural and legal persons in the framework of the provision of services on the national artificial intelligence platform for the development and hosting of platform software products and artificial intelligence models (our translation of the Russian title)
- Authority
- The order was issued by the Deputy Prime Minister and Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, Zh. Madiev.
- Jurisdiction
- Republic of Kazakhstan
- Status
- Registered with the Ministry of Justice on 14 August 2026 under No. 39591.
- Bindingness
- The order takes effect ten calendar days after its first official publication. A ministerial order with approved rules, made under an express delegation in article 25(2) of Law No. 230-VIII.
- Parent statute
- Law of the Republic of Kazakhstan No. 230-VIII ZRK On Artificial Intelligence. The law is dated 17 November 2025 and takes effect sixty calendar days after its first official publication.
- Issue date / next deadline
- Signed 13 August 2026. The order takes effect ten calendar days after its first official publication. Applicants have three working days after receiving an incompleteness notice to submit revised documents.
- Sanction
- None stated in the order. The rules provide for refusal to consider an incomplete request and refusal to provide platform resources.
- Primary source
- https://www.adilet.zan.kz/rus/docs/V2600039591
The application procedure
An initiator, defined to include a state body, a legal entity or an individual, sends the platform operator two documents: a request on the form at Annex 1, and a passport of the platform software product or AI model on the form at Annex 2. Both go through the platform itself or to the operator email address published on the platform.
The operator then has 5 working days to check that the two filings are complete. Where something is missing it sends a notice inside that same window, and the initiator has 3 working days to supply the gap. Miss that and the operator decides to refuse consideration of the request, with reasons.
Once completeness is confirmed, a second 5-working-day clock runs for the substantive review. The outcome is one of two decisions: grant platform resources, or refuse them. The decision goes out as a notice within 2 working days of being taken, through the platform or to the email address given in the request. A refusal notice states the ground and the information it rested on.
The order does not say how long the operator has to make its decision after completing the substantive review.
If the decision is a grant, the operator concludes a contract with the initiator under Kazakh law, creates user accounts, and gives access to platform resources in the volume the contract fixes. Development, testing and hosting then proceed under the contract and under Kazakh law generally.
The parent AI statute
Kazakhstan has adopted a standalone national AI statute, Law No. 230-VIII ZRK On Artificial Intelligence. The law is dated 17 November 2025 and takes effect sixty calendar days after its first official publication. The official text notes amendments under Law No. 326-VIII of 24 June 2026, which take effect sixty calendar days after its first official publication.
Article 17(3) prohibits creating or operating AI systems with any of seven listed capabilities, including subliminal or manipulative techniques that distort behaviour and limit informed decision-making or compel potentially harmful decisions, exploitation of vulnerability due to age or disability with the aim of causing harm or creating a threat of harm, social scoring outside cases set by law, biometric classification aimed at discrimination, and emotion recognition without consent, except in cases provided by Kazakhstan's laws. Article 21(2) permits distribution of covered synthetic outputs only with machine-readable marking and a visual or other warning. The law's definition covers content imitating a person's appearance, voice or behaviour, or events that did not occur. Article 23(5) allows use of works to train AI models only where the author or rightholder has not objected in machine-readable form.
Order 482/NQ implements the delegation in article 25(2). Article 25(1) describes the platform as providing a controlled environment for development, training and trial operation of platform software products and AI models for a limited period. Article 25(2) says the interaction procedure is to be determined by the authorised body.
We have not confirmed when the platform began operating, whether it is currently operational, whether computing resources are available or whether any request has been filed.
What applicants must submit
The request form at Annex 1 is administrative: status of the initiator, name or full name, business identification number or individual identification number, legal address or place of residence, phone, email, project name, type of work, and planned start and finish dates.
The passport at Annex 2 has fifteen numbered fields, including a description of the current process in AS-IS terms, the project purpose and the processes for which AI is to be applied, a description of the proposed solution, the expected economic or social effect, and a compute request broken out into CPU cores, number and type of GPUs, RAM in gigabytes, disk space in gigabytes, and the period of use.
Field 9 asks for data sources and the legal grounds for using them. Field 10 asks for the categories of data used, with open data, personal data, restricted-access data and other data given as the examples. Field 11 asks for data protection and cybersecurity requirements. Field 12 asks whether integration with digital systems is needed and lists the expected integrations. Fields 13 to 15 name the planned number of authorised users, the list of users cleared to develop, test and host on the platform, and the persons responsible.
An applicant declares its data sources and the legal grounds for using them.
Review criteria and refusal grounds
Clause 5 lists what the operator reviews: whether the declared purposes of development or hosting comply with the requirements of Kazakh legislation; whether free compute resources exist in the volume and for the period stated in the passport; whether the proposed solution is compatible with the platform's software and technical architecture; and whether the declared data-use arrangements comply with Kazakh legislation on digitalisation, personal data and their protection, and cybersecurity.
Clause 7 mirrors those four as the exhaustive refusal grounds. Two are legal tests, one is a technical compatibility test, and one is simple capacity. A vendor can be turned away because the machines are busy.
Clause 9 allows applicants to resubmit after resolving the reasons for refusal. It refers repeat requests to the procedure and deadlines in clauses 4 and 8. It omits clauses 5 to 7, which contain the substantive review criteria and refusal grounds. Clause 9, on repeat requests, does not expressly cross-reference the substantive review criteria in clauses 5 to 7.
The order provides no appeal, review body or complaint channel. It allows applicants to resolve the reasons for refusal and reapply. We have not confirmed whether general Kazakh administrative procedure provides other remedies.
The limits of the order
There is no registration regime. There is no accreditation or licensing of AI developers. There is no conformity assessment, no certification, no notified body. Nothing in the order requires anyone to come to the platform in the first place, and nothing extends the rules to AI developed or deployed off the platform.
The order does not set a data localisation requirement. Clause 5 point 4 requires the declared data-use arrangements to comply with Kazakh legislation on digitalisation, personal data and their protection, and cybersecurity. We have not confirmed whether those statutes impose data localisation requirements.
The order sets no fine, suspension or enforcement mechanism. Article 30 of the AI Law states that breaches of Kazakh AI legislation entail liability under the laws of Kazakhstan. It refers to those laws for liability.
Law 230-VIII includes risk tiers, prohibited practices and synthetic content marking. Order 482/NQ governs access to the National AI Platform for development and hosting of platform software products and AI models.
The definition of initiator
The Russian text defines an initiator as a person or body that has submitted a request. We have not confirmed the Kazakh wording or any differences between the language versions.
The Russian definition at clause 2 point 1 covers a state body, legal person or natural person that has sent the operator a request for development or hosting of a platform software product or AI model.
Clause 3 of the Russian text requires the initiator to submit a request and passport. We have not confirmed the legal authenticity of the language versions or which version takes precedence.
The platform operator and commencement dates
The order defines the operator as a legal entity responsible for the platform's development and operation. Article 12(2) of the AI Law assigns its designation to the Government. We have not confirmed which entity has been designated.
We have not confirmed the first official publication dates of the order, the AI law or Law No. 326-VIII. These dates determine when each takes effect.
The order has a ten-calendar-day commencement period. The AI law and the amendments under Law No. 326-VIII each have a sixty-calendar-day commencement period, measured from their respective first official publications.
The order governs requests to develop or host platform software products or AI models on the National AI Platform. The passport requires data sources, their legal basis and the categories of data involved. The declared data-use arrangements are assessed against legislation on digitalisation, personal data and their protection, and cybersecurity by the platform operator, defined as a legal entity responsible for its development and operation. Kazakhstan has adopted a national AI statute.
Official sources
https://www.adilet.zan.kz/rus/docs/V2600039591
The official Russian text records Order No. 482/NQ dated 13 August 2026 and Ministry of Justice registration No. 39591 dated 14 August 2026. Clause 4 of the order sets its commencement rule. Clauses 4 to 9 of the approved rules cover review periods, refusal grounds and resubmission. Article 25 of the AI law authorises the platform rules, and article 31 sets the law's commencement rule.
In accordance with paragraph 2 of article 25 of the Law of the Republic of Kazakhstan On Artificial Intelligence, I ORDER (our translation of the Russian enacting formula). ยท Order No. 482/NQ, signed by Deputy Prime Minister and Minister Zh. Madiev, 13 August 2026
FAQ
Does Kazakhstan have a national law on artificial intelligence?
Yes. Kazakhstan has adopted Law No. 230-VIII ZRK On Artificial Intelligence. The law is dated 17 November 2025 and takes effect sixty calendar days after its first official publication. The official text notes amendments under Law No. 326-VIII of 24 June 2026, which take effect sixty calendar days after its first official publication. We have not confirmed the first official publication dates of the law or Law No. 326-VIII.
Does this order require me to register my AI model with the Kazakh state?
The order requires a request for platform resources to develop or host a platform software product or AI model on the National AI Platform. It does not require model registration, accreditation or certification.
Is there a data localisation requirement?
The order does not set a data localisation requirement. Clause 5 point 4 tests whether your declared arrangements for using data comply with Kazakh legislation on digitalisation, personal data and their protection, and cybersecurity. We have not confirmed whether those statutes impose data localisation requirements.
What happens if the operator refuses my request?
The refusal notice states the ground and the information it rested on, and goes out within 2 working days of the decision. Under clause 9 you may resubmit once the reasons for refusal are removed. The order provides no appeal, review body or complaint channel. We have not confirmed whether general Kazakh administrative procedure provides other remedies.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.