AI Regulation Tracker / New law

Kazakhstan's Digital Code Gives People a Right to Human Review of Automated Decisions From July 2026

Regulatory summary: Kazakhstan's Digital Code, Code No. 255-VIII of January 9, 2026, is a consolidated "digital constitution" that governs digital data and digital objects, and treats artificial intelligence systems as digital objects and digital systems within that environment.

Kazakhstan's new Digital Code (No. 255-VIII) treats artificial intelligence as a digital object inside a single national framework and, in Article 43, gives anyone subject to a fully automated decision the right to be told, to an explanation, and to human review. It takes effect six months after first publication, reported as July 11, 2026.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Kazakhstan's Digital Code Gives People a Right to Human Review of Automated Decisions From July 2026 regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

Kazakhstan consolidated fragmented digital laws into one code and, for the first time at code level, wrote a general right against fully automated decisions. Article 43 sets non-discrimination, a right to notice, a right to a plain explanation of the decision criteria, and a right to human review where the decision has legal effect. Article 100 ties AI-system quality audits to the separate Law on Artificial Intelligence, including a check for prohibited AI functions. The Code does not itself set the low, medium, and high AI risk tiers or the deepfake-labeling rules that some trackers describe; those sit in the companion AI Law.
Operators of automated decision systems in banking, insurance, government services, HR, and platforms serving Kazakh users; compliance and data-protection officers at multinationals active in Kazakhstan; govtech and AI vendors selling into Kazakh public bodies; and counsel advising on automated decisions, redress, and digital sovereignty.
Status: Enacted and published.
Inventory every automated or AI-assisted decision that touches a person in Kazakhstan, flag the ones that produce legal consequences, and stand up the notice, explanation, and human-review artifacts now, then reconcile them against the separate AI Law's risk tiers.

Regulatory Briefing

Bindingness: Binding code (statute-level). The Digital Code is an enacted code of the Republic of Kazakhstan, No. 255-VIII, adopted January 9, 2026. It is primary legislation, not a policy or a draft. Its operative provisions take legal effect on the date set by its own transitional article.
Scope: Public relations arising in the digital environment around the creation, circulation, storage, transmission, and use of digital data and digital objects in Kazakhstan. AI systems are brought in as digital objects and digital systems. Article 43 reaches any operator, public or private, that uses algorithmic systems or fully automated decisions affecting a person's rights and legitimate interests.
What Changed: Kazakhstan consolidated fragmented digital laws into one code and, for the first time at code level, wrote a general right against fully automated decisions. Article 43 sets non-discrimination, a right to notice, a right to a plain explanation of the decision criteria, and a right to human review where the decision has legal effect. Article 100 ties AI-system quality audits to the separate Law on Artificial Intelligence, including a check for prohibited AI functions. The Code does not itself set the low, medium, and high AI risk tiers or the deepfake-labeling rules that some trackers describe; those sit in the companion AI Law.
Who This Affects: Operators of automated decision systems in banking, insurance, government services, HR, and platforms serving Kazakh users; compliance and data-protection officers at multinationals active in Kazakhstan; govtech and AI vendors selling into Kazakh public bodies; and counsel advising on automated decisions, redress, and digital sovereignty.
Current Status: Enacted and published. Not yet in force at the time of writing. The Code enters into force on the date fixed by Article 106.
Effective Date: Six months after first official publication, per Article 106. Legal trackers report this as July 11, 2026. A small number of secondary sources cite a date a few days earlier in July; the load-bearing rule is the six-month trigger in the Code itself.
Primary Source: https://adilet.zan.kz/rus/docs/K2600000255
Secondary Analysis: Kinstellar, "The year of digitalisation and AI in Kazakhstan: New regulations"; White & Case, Global regulatory tracker - Kazakhstan (also on JD Supra); Grata International, "Digital Compliance 2026: Conflicts Among the Digital Code, Artificial Intelligence, and Personal Data Laws in Kazakhstan."
Workflow Impact: Operators of automated decisions will need a notice mechanism, a written explanation of the decision criteria that stops short of exposing source code or protected secrets, and a defined route for an authorized human to review decisions that carry legal consequences. AI operators will also need audit-ready records of training-data provenance and a check against prohibited AI functions under the AI Law.
Operational Next Step: Inventory every automated or AI-assisted decision that touches a person in Kazakhstan, flag the ones that produce legal consequences, and stand up the notice, explanation, and human-review artifacts now, then reconcile them against the separate AI Law's risk tiers.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Kazakhstan	Kazakhstan consolidated fragmented digital laws into one code and, for the first time at code level, wrote a general right against fully automated decisions. Article 43 sets non-discrimination, a right to notice, a right to a plain explanation of the decision criteria, and a right to human review where the decision has legal effect. Article 100 ties AI-system quality audits to the separate Law on Artificial Intelligence, including a check for prohibited AI functions. The Code does not itself set the low, medium, and high AI risk tiers or the deepfake-labeling rules that some trackers describe; those sit in the companion AI Law.	Operators of automated decision systems in banking, insurance, government services, HR, and platforms serving Kazakh users; compliance and data-protection officers at multinationals active in Kazakhstan; govtech and AI vendors selling into Kazakh public bodies; and counsel advising on automated decisions, redress, and digital sovereignty.	Enacted and published. Not yet in force at the time of writing. The Code enters into force on the date fixed by Article 106.

Source File

Instrument: Digital Code of the Republic of Kazakhstan (Цифровой кодекс Республики Казахстан), Code No. 255-VIII
Authority: Republic of Kazakhstan (adopted January 9, 2026)
Date: Adopted January 9, 2026; enters into force six months after first official publication (Article 106), reported as July 11, 2026
Citation: Digital Code of the Republic of Kazakhstan, Code No. 255-VIII of January 9, 2026, Articles 43, 100, and 106
Primary Source: https://adilet.zan.kz/rus/docs/K2600000255
Corroboration: Kinstellar, "The year of digitalisation and AI in Kazakhstan: New regulations"; White & Case, Global regulatory tracker - Kazakhstan (JD Supra); Grata International, "Digital Compliance 2026: Conflicts Among the Digital Code, Artificial Intelligence, and Personal Data Laws in Kazakhstan." Verification note: Articles 43, 100, and 106 were confirmed directly in the official adilet.zan.kz Russian text. The low/medium/high AI risk tiers, deepfake-labeling, and subliminal-manipulation and social-scoring prohibitions could not be located in the Digital Code text and are attributed by secondary trackers and the Grata analysis to Kazakhstan's separate Law on Artificial Intelligence.

Frequently Asked Questions

Is the Kazakhstan Digital Code in force now?

Not yet at the time of writing. It was adopted as Code No. 255-VIII on January 9, 2026, and under Article 106 it enters into force six months after first official publication, which legal trackers report as July 11, 2026.

Does the Digital Code give people a right to challenge AI decisions?

Yes, through Article 43. A person subject to a fully automated decision can obtain confirmation that an algorithmic system was used, receive an explanation of the key factors and criteria, and demand review by an authorized human specialist where the decision carries legal consequences or affects their rights.

Does the Digital Code set the low, medium, and high AI risk tiers?

No. The Code's text does not contain the AI risk classification. Article 100 cross-references the separate Law on Artificial Intelligence, which is where the risk tiers and AI-specific prohibitions sit. The two instruments should be read together.

How much does an operator have to reveal about an automated decision?

Article 43 requires an explanation of the key factors and criteria that influenced the decision, but it expressly does not require disclosure of the algorithm, the source code, or information protected as a legally guarded secret.

How is the Digital Code different from Kazakhstan's AI Law?

The Digital Code is the broad framework that treats AI as a digital object and sets automated-decision rights and an AI-audit hook. The AI Law is the dedicated instrument that classifies AI by risk and lists prohibited practices. Compliance requires mapping systems against both.