ABSTRACT

1 INTRODUCTION

Alan Turing's extensive research into artificial intelligence (AI) laid the groundwork for empirical methods to evaluate the capabilities of early computers in the late 1940s. However, the term “artificial intelligence” was coined later, emerging as the subject of a university course at Dartmouth College in 1956.¹ Theorising, testing, implementing, optimising and regulating AI processes and applications attracts an increasing number of experts from various fields, including law. Turing aptly noted, “There are signs ... that it is possible to make a machine demonstrate intelligence, while at the risk of making serious mistakes from time to time ... The whole process of thinking is still rather mysterious to us, but I believe that the attempt to create a thinking machine will greatly help us in finding out how we think ourselves.”²

One of the priority areas of development of the Kazakh economy in the near future is the creation of an AI technology industry. President Kassym-Jomart Tokayev has stated, “We need to turn our country into a place of attraction for ‘digital nomads’ from all over the

world”. The President claims that, “Our success in all other areas depends on how quickly and effectively we develop new digital technologies.”³

In response, the Government of the Republic of Kazakhstan is currently developing a Strategy for the Development of Artificial Intelligence, a Digital Code and the Law “On Artificial Intelligence”. The Concept for the Development of AI for 2024–2029, approved by the Resolution of the Government of the Republic of Kazakhstan dated 24 July 2024, No. 592, outlines the current state of AI, assesses preliminary readiness, evaluates the research base, reviews international experience and establishes the basic principles and approaches for AI development.⁴

Kazakhstani legal research increasingly focuses on defining AI, its legal capacity, liability, and ethical standards amid insufficient regulation.⁵ Defining the key challenges associated with the implementation and operation of AI is intended to facilitate the development of a comprehensive legal model, unify approaches to problem-solving and, ultimately, increase the effectiveness of legal regulation.⁶

In his Address to the People of Kazakhstan, President Tokayev emphasised that, “to become part of the new technological paradigm, it will be necessary to restructure the entire system of public administration with a manifold increase in its transparency, efficiency, and human-centred orientation”.⁷ This underscores a critical issue: the legal regulation of AI integration into public administration and its interaction with the protection of citizens’ procedural rights. This challenge is both ethical and regulatory, representing a fundamental aspect of the relationship between society and the state in the era of digital development.

2 METHODOLOGY

This study examines the legal regulation of AI in Kazakhstan is reviewed in this study using a comprehensive approach that integrates both theoretical analysis and practical insights into existing developments and practical recommendations.

The study's basis is the comparative legal method, which enables a comparative analysis of legal practices and regulations across countries. This method was applied to analyse relevant texts and policies from the European Union, the United States of America, China, and the Republic of Kazakhstan.⁸ While the EU, US, and Chinese frameworks have already been in use for quite some time, Kazakhstan has only recently adopted the Law "Оn Artificial Intelligence".⁹ The comparative legal method allows for the identification of global trends and country-specific features, guiding the adaptation of these developments to the Republic of Kazakhstan’s context. For instance, the EU’s AI Act illustrates how to balance AI-driven economic innovation with risk reduction,¹⁰ while the White Paper on AI Development, developed in China, provides a wealth of information on the introduction of AI across all areas of society.¹¹

To understand the nature of AI itself, the study employs a systems analysis, conceptualising AI as a full-fledged system in which each component is responsible for the functioning of the others; that is, it is not an isolated system but a well-coordinated one. In this regard, it is possible to identify economic, social, technological, cultural and other aspects of its existence. Conducting such an analysis is extremely necessary for adapting AI tools to traditional sectors of Kazakhstan's economy, using new tools to improve efficiency without destroying these industries.¹²

Given widespread public concerns about AI's impact, ethical considerations are a key aspect of AI deployment, and the ethical dimension is an essential component of this

study. AI has generated numerous discussions on ethical issues such as legal capacity, who should be held responsible for the damage caused by AI, and how appropriate it is to use it in those spheres of society where direct human participation has traditionally been required—such as education (e.g., writing qualification papers) and medicine (e.g., diagnostics and postoperative care recommendations). This method was used to analyse recommendations from the OECD¹³ and the UN Global Digital Compact.¹⁴ Based on this analysis, proposals were formulated to integrate AI into Kazakhstan's legislation, while accounting for potential ethical issues.

Using the method of critical analysis of regulatory documents, the Law "On Artificial Intelligence" and the Concept of AI Development for 2024-2029 were examined. The results revealed gaps in the legislation, particularly regarding the definition of AI, its legal status, and potential liability in the event of damage.¹⁵

The three proposed regulatory models were derived from a comparative analysis of international legal frameworks and adapted to Kazakhstan’s institutional and socioeconomic context, as further detailed in the Results and Discussion section (Table 4).

In assessing AI, particular attention was paid to the potential risks associated with its practical application. A meaningful discussion of these risks requires the modelling method. Based on the study of international experience and current trends in Kazakhstan, three models of legal regulation of AI regulation were formulated: (1) copying international experience, (2) a symbiosis of international and national approaches, and (3) minimal regulation to gain a technological advantage.¹⁶

Thus, the chosen methodological framework enabled comprehensive coverage of the identified problem, identification of existing shortcomings in the legislation, and determination of the key directions for its improvement through specific paths and measures tailored to Kazakhstan’s context.

The selection of normative and policy sources was based on official legislative databases and international repositories, including Adilet (Kazakhstan), ISO/IEC standards archives, the UN Global Digital Compact, and the EU AI Act documentation. Only publicly accessible and officially adopted acts, standards, and policy papers were included in the analysis.

This study is limited to the analysis of normative and policy documents and does not include empirical data on enforcement or judicial practice. Future research could extend the analysis to case law and administrative decisions to assess how AI-related norms are applied in practice.

3 RESULTS AND DISCUSSION

The legal issues surrounding AI are extensive and warrant thorough theoretical research. The focus of this article will be on some of the legal issues of theorising and practical implementation of legislation on AI in light of the adoption of the Law "On Artificial Intelligence" (hereinafter: the Law "On Artificial Intelligence") by the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan.¹⁷ Developing coherent AI legislation is crucial for Kazakhstan’s theory, law-making, and practice.¹⁸

3.1. Ethical and Copyright Challenges

3.1.1. Problems of Legal Regulation of Artificial Intelligence

The Concept of AI Development in Kazakhstan for 2024-2029 (hereinafter: the Concept) is a significant step towards the introduction of AI into the economy and society of Kazakhstan.¹⁹ Based on the Concept data, Kazakhstan's readiness for AI is reflected in the 45.78 indicator. The country ranks 72nd out of 181 countries on this list. The most "prepared" categories for working with AI are "digital potential" (75.67), "adaptability" (63.76), and "data availability" (74.11). At the same time, there are serious problems associated with society's unpreparedness for these changes. Thus, in particular, the category "infrastructure" is estimated at only 30.80, and "human capital" at 38.55.²⁰ This indicates that the country has few qualified personnel ready to work with artificial intelligence, and a

sufficient material and technical base for this has not been created. The indicator "vision (strategy)" is 0, and "maturity", that is, readiness for AI, is 15.48. As a result, the introduction of AI poses a major problem across all areas of Kazakhstani society.

Based on the above, the Concept emphasises the need to create conditions for working with AI and for sustainable growth in this area, which will require major changes and additions in the legislative sphere. One of the main problems is the uncertainty of existing definitions, as well as legal mechanisms regulating AI and responsibility for its use.²¹ The Concept appropriately notes that the existing trends in informatisation and cybersecurity development in Kazakhstan do not meet the requirements for addressing problems related to the use of artificial intelligence.

The developers of the Law “On Artificial Intelligence” understand AI as “the functional ability to imitate cognitive functions characteristic of humans, providing results comparable to or superior to those of human intellectual activity”.²² The difficulties of applying the concept of "artificial intelligence" will most likely ‘haunt’ the Kazakh legislator, as it is currently quite difficult to determine with a high degree of accuracy the range of issues associated with the development of such a broad phenomenon. It is characteristic that the recently adopted EU AI Act provides an operational definition of AI (Article 3), focusing on the system’s functionality and associated risks rather than a single conceptual definition. This cautious approach reflects the EU’s intent to regulate AI based on risk categories.²³

tasks that would normally require human intelligence.”²⁴ The OECD deliberately uses such a broad formulation to encompass various AI technologies, including both machine learning and rule-based systems. However, the OECD also defines an AI system as “a computer system that, in order to achieve explicit or implicit goals, determines from the inputs it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence a physical or virtual environment”.²⁵

In the broader context of developing international standards for the legal regulation of AI, most researchers consider it necessary to be guided by the requirements of AI system security and transparency. Thus, the ISO/IEC 38507:2022 and ISO/IEC 23894:2023 standards note that, first, a basis is needed to ensure cybersecurity and prevent AI-related fraud and crime.²⁶

Different AI systems vary in their level of autonomy and adaptability after deployment. In this sense, the developers of the Laws "On Artificial Intelligence" plan to distinguish AI from AI systems. They propose the following definition: “AI technologies (systems) - technologies based on the use of artificial intelligence, including speech and visual image recognition, analytical decision-making, complex logical operations, and intelligent decision support.”²⁷

If the technological aspect of defining the concept of artificial intelligence is not considered at this stage, it is proposed that the Kazakh legislator should refrain from distinguishing between AI and AI systems (including rule-based systems, as understood by the OECD). Given the complexity of the phenomenon and the lack of clear criteria for determining the "intelligence" of emerging systems, such an approach may lead to further difficulties in classifying particular technologies as AI systems. At present, legal science in the field of AI faces three main problems of defining the concept, nature and limits of regulation:

1. Semi-autonomy: A certain degree of autonomy may lead to unexpected results, and therefore, the creation of systems that adapt to the changing nature of AI will be difficult due to the over-regulation of developments in this area.²⁸ Researchers note that, in the case of increasing the autonomy of AI, it is important to correctly balance between the freedom of algorithms and the need for legislative control.²⁹
2. Predictability: The increasing complexity of AI systems reduces the predictability of their behaviour, which, to a certain extent, levels out the possibilities of management and regulation at the regulatory level.³⁰ In this context, the importance of creating flexible legal systems that can adapt to rapid technological changes is discussed.³¹
3. Unlimited application: The variability of the application of AI in various areas of human activity complicates the possible regulatory structure, and the construction of a system of norms regulating various areas of application of AI may be a massive undertaking that does not keep pace with the development of relevant technologies.³² Thus, it is necessary to develop mechanisms that enable rapid, effective regulation of new AI uses across sectors.³³

The abovementioned problems, in a broad sense, prevent the determination of the legal capacity of artificial intelligence and preclude its recognition as a full-fledged subject of law. In this regard, Suleimenov and Karagusov reasonably argue that “Neither robots nor AI should be recognised as subjects of law. At the level of the Civil Code, their legal regime should be enshrined as a separate category of objects of civil rights, excluding human interaction with them, allowing only human influence on them.”³⁴

The lack of a clear legal status for AI underscores the need to define appropriate regulatory frameworks for its use. To address this issue, three alternative regulatory models were developed based on comparative legal analysis, as summarised below.

The comparative analysis demonstrates that each regulatory model offers distinct advantages and challenges for the legal governance of AI in Kazakhstan. The first model, direct adoption of international norms, provides the most predictable and harmonised

approach. By aligning national legislation with the EU AI Act and OECD standards, this model would ensure compliance with global norms, facilitate international cooperation, and simplify cross-border data and technology exchange. However, its primary drawback lies in the limited adaptability of international standards to Kazakhstan’s socio-economic and legal environment. Excessive reliance on external regulatory templates could lead to overregulation and hinder local innovation.

The hybrid model, combining international standards with national regulatory mechanisms, is the most balanced and contextually suitable option. It allows Kazakhstan to maintain consistency with international best practices while tailoring specific provisions to national realities. Such an approach supports flexibility, promotes institutional learning, and enables gradual adaptation of legal norms as technologies evolve. Nevertheless, its effective implementation requires a high degree of institutional coordination, capacity building, and sustained policy coherence—areas that currently remain underdeveloped.

The third model—minimal regulation—represents a liberal framework aimed at stimulating innovation and rapid technological development. It provides significant room for experimentation and entrepreneurship in the AI sector. Yet, the absence of clear legal safeguards increases the risks of legal uncertainty, ethical violations, and insufficient protection of human rights. Consequently, this model can be applied only selectively, for instance, in pilot projects or regulatory sandboxes.

Overall, the analysis suggests that the hybrid model offers the most practical pathway for Kazakhstan, as it balances innovation incentives with the need for legal certainty and social accountability, aligning technological progress with national institutional capacity.

3.1.2. Problems of Normative and Technical Regulation of Artificial Intelligence

Unclear legal definitions complicate the technical regulation of AI. Kazakhstan has yet to develop a set of national standards for the technical regulation of artificial intelligence. Still, the legislator should already be considering building a coherent legal framework to minimise potential risks in the creation and use of artificial intelligence, its systems, and robotics based on it. At the same time, the base of international standards for technical regulation of AI is developing very quickly, where the main risks are the following (Table 5):

1. Reputational costs to the owner of AI in the event of harm caused to others due to a lack of control over artificial intelligence;
2. Complete or partial loss of control over the exploited artificial intelligence;
3. Disenfranchisement of workers whose functions are replaced by the work of artificial intelligence;
4. Univariance in the judgments of AI when processing data due to the limitations of the data provided to it;
5. Increased complexity of competition between market participants using AI and those who do not; Difficulty in predicting the performance of AI due to limited historical data and rapidly changing future expectations.³⁵ forecasting behavior systems Currently, the difficulties associated with the legal regulation of AI, as well as the predicted risks, are only increasing. The White Paper on the Development of AI in China (April 2024), among the technical risks, points to possible delusions of artificial intelligence, in which systems produce answers or judgments that do not correspond to reality, such as when processing images or language structures.³⁶ When such systems are used in areas like healthcare or transport, these errors may pose risks to citizens' lives and health. To solve these problems, the document proposes implementing AI learning systems with creator feedback (RLHF) or "Fence technology" (NeMo Guardrails). However, the deployment of these solutions remains challenging. This is why the risks of using AI in medicine and healthcare require primary attention and legal regulation. B. Murdoch, a scientist who described cases of using AI in hospitals in his work, agrees with this. The author states that the lack of legal regulation leads to a violation of confidentiality and unauthorised "replication of medical information."³⁷

A risk-oriented approach to national standardisation and regulation of AI in the Republic of Kazakhstan appears justified under current conditions. Building a system of standards should be based on the following categories of risk:

1. Comparable risk: The introduction of AI systems such as AI-enabled video games, spam filtering systems, and other similar technologies should not, for the most part, create obligations and liabilities for developers. However, it is necessary to create conditions in which developers voluntarily follow codes of ethics and conduct, thereby minimising potential risks. To this end, it is important to develop mechanisms that encourage companies to self-regulate and implement best practices that help protect users.³⁸
2. Transparency risk: AI-based systems must clearly inform consumers when interactions involve a machine, especially in areas such as chatbots and contentgenerating systems. This will help increase user trust and ensure transparency in interactions with AI systems. At the same time, measures in this area must be balanced with the need to protect personal data and comply with privacy standards.³⁹
3. Contact risk: AI systems operating in sensitive areas—such as medicine, military technology, and selection or screening processes—must be subject to strict restrictions that reflect potential risks to human health and safety. Human oversight remains essential to ensure that AI use does not lead to potentially dangerous consequences. Strict regulations aimed at managing these risks must take into account both technical and ethical aspects.⁴⁰
4. Manipulative risk: It is important to embed moral and ethical principles into the foundation of AI technologies to avoid manipulative abuses. For example, aggressive sales, social scoring, big data processing and other types of manipulation can lead to serious consequences for human rights. AI developers must take these risks into account and develop systems that ensure the rights and freedoms of citizens are respected, preventing the misuse of AI to manipulate personal data.⁴¹

Based on the content of the Law "On Artificial Intelligence",⁴² it appears that the Kazakh legislator is taking the path of excessive regulation, in which the authorised body in the field of AI will maintain a classifier of AI systems, which will prohibit the creation, development and operation of systems with capabilities other than those defined by the classifier. The introduction of such a classifier contradicts the principles enshrined in the Concept of AI Development for 2024-2029,⁴³ which holds that a low level of regulation can provide a technological advantage. In this sense, the quality of the classifier leaves questions, and AI systems, especially dual-use ones, may not be developed.

3.1.3. Problems of Ethical Regulation of Artificial Intelligence

Many people are concerned about the ethical issues arising from the use of AI. According to researcher L. Floridi, these issues should be addressed not only through theoretical development but also through implementation in current and/or developing legislation. This will minimise ethical risks, prevent a possible decline in the reputations of those who use AI in their activities, and prevent potential human rights violations associated with these systems.⁴⁴ T. Hagendorf agrees with this opinion, according to whom universal principles of ethical regulation of the use of AI should be developed initially, after which all countries will be guided by them when developing legislative norms and using AI in practice.⁴⁵

While these international frameworks provide valuable guidance, their practical application in Kazakhstan requires adaptation to national constitutional principles and legal traditions. Ethical principles such as transparency, fairness, and accountability resonate with Kazakhstan’s constitutional provisions, including the right to privacy (Article 18) and the prohibition of discrimination (Article 14).⁴⁶ Ethical self-regulation by developers can complement formal legal regulation, ensuring flexibility and innovation within the boundaries of legal accountability. Together, these mechanisms form a balanced framework that aligns ethical responsibility with the rule of law in Kazakhstan.

AI ethics challenges arise from the difficulty of defining ethical principles for its creation and operation. The complete absence of regulatory decisions in this area in Kazakhstan at the initial stage allows reliance on existing international legal developments. Nevertheless, even international practice lacks a unified approach to the formation of a basket of ethical principles for AI and a strict hierarchy for them, which complicates the development of a general ethical basis. Significant progress in AI development and regulatory developments in several countries further complicate the harmonisation of international norms with national legislation, both due to differing levels of technology penetration and the number of ethical and legal documents adopted at the national level.

At the same time, the scientific community mainly concentrates on the study of the ethical principles of the functioning of AI either in relation to the abstract definition of a “good” or “bad” algorithm (rather than “well-designed” and “poorly designed”),⁴⁷

through the lens of specific regulatory domains,⁴⁸ or in broader discussions of human rights and public benefit.⁴⁹

Ethical issues are also inextricably linked with copyright concerns. The rapid development of AI has led many individuals to use such tools to create authorial texts and visual materials. A number of AI-created texts have already become bestsellers. Within academic contexts, both students and teachers increasingly turn to AI for help in writing qualification papers and scientific publications. At first glance, AI assistance, when used wisely, does not seem ethically problematic, since, for example, the use of algorithmic skills, information search, and calculations is quite reasonable and adequate. At the same time, many people use it to minimise their own participation in solving intellectual problems, which, in fact, is an ethical problem.

Moreover, AI-developed materials often lack a specific author but are actively sold on freelance platforms, which cannot currently refer to specific laws for detailed regulation of such cases. Traditional legal concepts of copyright do not apply to examples of artificial intelligence, since no specific legislative sanctions have been developed for it. As a result, it is unclear who should be punished in such a case. Lucci argues that traditional copyright concepts are outdated and require not just revision, but the creation of entirely new ones in the era of digitalisation and AI.⁵⁰

A rather curious approach is proposed by Morley and her colleagues, who argue that it is necessary to develop legal norms that allow the creation of a copyright object without direct human participation. However, such a model raises additional questions regarding liability if an AI-generated work causes damage to someone. For example, a generated scene depicting violence may harm minors or extremely impressionable individuals.⁵¹ Although such cases are currently rare—and AI platforms typically do not allow the creation of prompts that contain violence, or generate safe text/images—precedents may emerge.

If such a precedent arises, it seems logical to us to impose liability primarily on the platform owner where this situation occurred. This position is justified: when a platform acquires or deploys an AI mode, it enters into an agreement that sets out the rules for regulating relations with users. Accordingly, the AI developer should not be held liable, as responsibility is shifted to those who directly use the AI. In this case, it is necessary to develop a legal basis for regulating the conclusion of contracts when purchasing the right to place an AI model.

Researchers Moroz and Muzaparov proposed an interesting point on the ethical regulation of AI use.⁵² According to these authors, the law on AI should take into account the specifics

of a specific AI platform, since many of the results of generations cannot be attributed to the concepts of "creativity" and "authorship". In view of this, it is necessary to develop and introduce new terminology in the context of AI to allow for a more understandable interpretation of the results of user interaction with artificial intelligence and, therefore, to regulate potential problems associated with authorship.

At this time, it is not possible to determine whether the Kazakh legislator will follow the path of harmonising national legislation with international standards or develop its own concept of ethical principles in the field of AI ethics. Still, international experience is nevertheless likely to facilitate the implementation of such technologies. Among the recommended postulates in the field of AI regulation, in general and its ethical foundations in particular, the norms and recommendations of the Global Digital Compact, planned for adoption at the UN level, would be significant for Kazakhstan and could provide the necessary guidelines for national regulation. However, even the implementation of international ethical standards in national AI legislation will be associated with a greater declaratory nature, and their voluntary compliance will often conflict with economic feasibility, since AI developers will often be guided by considerations of monetisation and applied usefulness first and foremost. However, it is hoped that national legislation will supplement AI's ethical postulates with normative regulation, balancing positive ethical guidelines with restrictive regulatory measures.

3.2. Institutional and Procedural Safeguards

The trend toward digitalising a significant portion of the public administration sector in the Republic of Kazakhstan is gaining momentum each year. The President of the country has articulated ambitious goals for transforming the state into a fully-fledged “digital nation,” characterised by comprehensive digitalisation and the implementation of AI. In this context, there are stated intentions to introduce AI into various spheres of public administration, including geological exploration, monitoring of agricultural lands, transport and transit regulation, implementation of a multifunctional digital platform for transportation management, building information modeling using AI technologies, a digital platform for water resources, tax administration, the introduction of AI-based distance learning for rural regions, a system for monitoring the quality and volume of medical services using AI technologies, as well as the development of culture and the arts in the era of artificial intelligence, among others.⁵³

The accelerated pace of digitalisation necessitates legal and regulatory measures in this field to ensure oversight, transparency in the functioning of digital systems, and the protection of citizens’ rights, including procedural rights.

As previously noted, the Law of the Republic of Kazakhstan "On Artificial Intelligence"⁵⁴ is characterised by excessive overregulation, the establishment of numerous administrative functions, and restrictions and prohibitions.

In particular, the Law "On Artificial Intelligence" establishes a classification of autonomous artificial intelligence systems (decision-making processes that are independent of predetermined parameters and are not subject to control by the system owner), as well as artificial intelligence systems with a specific set of functional capabilities (paragraph 2, Article 17). These include, in particular, the use of subconscious, manipulative, or other methods that significantly distort human behaviour; exploitation of human moral and/or physical vulnerability; determination of human emotions without consent; and similar practices.

These grounds largely mirror the provisions of the EU AI Act (Article 5),⁵⁵ albeit with certain distinctions.

In accordance with subparagraph 3 of paragraph 3 of Article 17 of the Law "On Artificial Intelligence", the use of AI systems that evaluate and classify natural persons or groups of persons over a certain period of time based on their social behavior or known, presumed, or predicted personal characteristics is prohibited, except in cases provided for by the laws of the Republic of Kazakhstan.

By contrast, under the EU AI Act, “social scoring” is prohibited only where it results in discrimination or disproportionate sanctions. The EU regulation sets out unambiguous conditions under which evaluations or classifications may be carried out. Accordingly, any normative acts of competent authorities aimed at creating an online platform/application using AI would be required to comply with the principle established in Article 5 of the EU AI Act.

The corresponding provision in the domestic legislation establishes an absolute prohibition, thereby creating a barrier to digital development. The introduction of any AIbased technologies designed to evaluate or classify individuals or groups (e.g., credit or social scoring) based on their social behaviour would require the adoption of a law, either through amendments to existing legislation or the enactment of a new law. This would create significant administrative hurdles, as the legislative process entails a specific sequence of steps, requirements, and timelines.

At the same time, the formulation “except in cases provided for by the laws of the Republic of Kazakhstan” may enable state bodies to be granted very broad powers. For instance, legislation may confer competence upon an authorised body to adopt corresponding subordinate normative legal acts. In such a case, there is a significant likelihood that the rights and legitimate interests of citizens could be infringed by the state’s imperative

administrative will. In this regard, it appears necessary to establish, at the legislative level, a condition requiring that any evaluation or classification of individuals or groups not lead to adverse or discriminatory treatment of particular persons or groups.

In addition, it seems necessary to introduce a requirement to protect citizens' fundamental rights. Any ratings or classifications based on social indicators must not restrict fundamental rights and freedoms, which include, inter alia, those enshrined in the Constitution of the Republic of Kazakhstan, including the right to life, personal liberty, the inviolability of private life, the right to recognition of legal personality, and judicial protection.

A different approach is applied to the classification of natural persons based on their biometric data. Under subparagraph 5 of paragraph 3 of Article 18, classifications aimed at drawing conclusions about race, political views, religious affiliation, or other circumstances are prohibited in the Republic of Kazakhstan if they are to be used for discriminatory purposes. By comparison, the EU AI Act permits the placing on the market, putting into service, or use of biometric categorisation systems that determine race, political opinions, trade union membership, religious or philosophical beliefs, sexual life or orientation, in cases of lawful labelling or filtering of biometric data, for instance, in the field of law enforcement.

In this regard, the formulation “and on any other grounds” makes it possible to encompass all potential bases of discrimination, including those not explicitly specified in current legislation. In the context of rapid technological development and the emergence of new forms of discriminatory practices, such openness ensures regulatory flexibility. The focus on the ultimate effect—“for the purpose of any discriminatory use”—allows the state not to block the very process of developing and testing technologies, but rather to concentrate on preventing unlawful consequences. This reduces the risk of excessive interference in scientific research or the neutral use of biometric data, for example, in medical or educational contexts.

Thus, the regulatory challenges under the Law "On Artificial Intelligence" manifest in excessive regulatory density, the creation of administrative barriers to technological deployment, and the risks of broad discretion by state authorities—factors that may slow digital development and threaten citizens’ procedural rights.

3.3. Liability and Protection of Citizens’ Rights

Continuing the discussion on the use of biometric data, it is impossible not to address the relationship between state regulation and the safeguarding of citizens’ rights, including the establishment of appropriate liability for violations of their protection. The current Law of the Republic of Kazakhstan “On Personal Data and Its Protection” (hereinafter: the Law on Personal Data) classifies biometric data as personal data that characterises the

physiological and biological features of the subject of personal data, based on which his or her identity can be established.⁵⁶

The protection of such data is, first and foremost, established through the recognition of its confidentiality. Thus, pursuant to Article 11 of the Law on Personal Data, owners and/or operators, as well as third parties obtaining access to personal data of restricted access, are required to ensure their confidentiality by adhering to the obligation not to disclose such data without the consent of the data subject or his/her legal representative, or in the absence of another lawful basis. Persons who have become aware of personal data of restricted access in connection with professional or official necessity, as well as through employment relations, are likewise obliged to ensure their confidentiality.

At the same time, the high-profile case involving Kaspi Bank regarding the breach of the confidentiality of digital data reveals gaps in the legislation, which, in turn, lead to violations of citizens’ rights.⁵⁷

In 2021, a citizen of Kazakhstan reported a privacy violation while applying for a loan through the Kaspi Bank mobile application, which required biometric identification. According to publicly available media sources, the user alleged that her personal data were processed and subsequently shared among debt collection agencies without her consent. Over several years, she appealed to the bank and relevant state authorities, requesting the deletion of the biometric data and clarification of responsibility. The bank, in its official response, stated that the data breach occurred on the side of third-party collectors and was not caused by its employees. It should be noted that no official court proceedings or other procedural documents are available for this case; however, certain elements of this precedent may still be analysed as an illustrative example.

Under paragraph 3 of Article 11 of the Law on Personal Data, the confidentiality of biometric data is established by the legislation of the Republic of Kazakhstan. The procedure for biometric identification carried out by banks is determined by the relevant Rules (hereinafter: the Rules).⁵⁸ These Rules clearly provide that biometric identification is to be conducted using the person's face (paragraph 5). Accordingly, obtaining images of any other body, apart from the individual’s face, is unlawful and such data must neither be stored in the bank’s database nor transferred to collection agencies.

At the same time, the Rules contain an important limitation. Pursuant to paragraph 1, they do not apply to biometric identification processes carried out by banks using their own hardware devices. In other words, the Rules are inapplicable when banks use their own devices—such as ATMs, terminals, in-branch systems, or mobile applications—as was the case in the aforementioned incident.

Pursuant to paragraph 5-5 of Article 34 of the Law of the Republic of Kazakhstan “On Banks and Banking Activities”, banks are prohibited from concluding a bank loan agreement with an individual via the Internet without conducting biometric identification, the procedure for which must be determined by the authorised body.⁵⁹

According to Kazakhstan’s legislation, subordinate regulatory legal acts—such as rules, regulations, instructions, methodologies—do not establish norms of law but are adopted only to implement legislative acts and other higher-level normative legal acts. In the case of the Rules, it is evident that the provision granting banks the competence, in accordance with their internal regulations, to independently determine the procedure and requirements for biometric identification and the subsequent handling of digital data constitutes a norm of law and should be regulated at the statutory level. Otherwise, as illustrated by the abovementioned case, banks may rely on internal regulations, commercial secrecy, or other legally protected information to violate citizens’ rights and freedoms while evading responsibility for breaches of personal data legislation.

At present, the draft Digital Code of the Republic of Kazakhstan (hereinafter: the Code) is under consideration by the Mazhilis of the Parliament of the Republic of Kazakhstan.⁶⁰

According to the Code, the following biometric data of citizens of the Republic of Kazakhstan will be subject to processing for authentication purposes:

1. digital facial image;
2. dactyloscopic (fingerprint) information.

Thus, the adoption of the Code is expected to eliminate the existing legal gap. Nevertheless, it remains necessary to review current legislation to establish more effective mechanisms for protecting individuals' personal data and safeguarding related civil rights and freedoms.

4 CONCLUSIONS

The list of problems outlined above will not be complete now or in the future, which reflects the evolving nature and inherent complexity of artificial intelligence. Given the current absence of AI-specific regulation in Kazakhstan, the country will need to develop its regulatory toolkit both through foreign experience and local regulation, taking into account domestic achievements and failures in the context of the underdevelopment of AI technologies and the lack of basic experience in its use.

An analysis of foreign experience enables the identification of three models of legal regulation of AI in Kazakhstan. The first model involves copying international experience by transferring advanced international norms to Kazakhstani legislation. The second model can be based on the symbiosis of international legal norms and national characteristics of the creation and use of AI technologies. The third approach is based on minimal legal regulation to obtain a technological advantage through soft regulation.

At the same time, comprehensive regulation of AI by norms of direct action, combining normative, technical, and ethical regulation, is difficult to implement and, most likely, even harmful to national legislation due to the multidimensionality of the phenomenon and the insufficiency of research and empirical data on artificial intelligence.

It appears likely that, upon adopting the Law "On Artificial Intelligence", the Kazakh legislator will also enact a number of related regulatory legal acts. These may address issues such as liability for violations of citizens' rights arising from the use of AI technologies, procedures for compensating for damage caused by AI or robots based on such technologies, copyright protection when creating products generated by AI technologies, and the ethical foundations of AI technologies. In this context, legal regulation will shift in favour of AI's well-known characteristics and the risks associated with it. Given the scope of regulation required, Kazakhstan’s lawmakers cannot realistically anticipate all potential AI-related risks.

Any approach to forming an AI regulatory framework in Kazakhstan must, on the one hand, seek to balance the practical utility of AI technologies with the potential risks associated with their deployment and use, and on the other hand, select appropriate regulatory tools not only based on our own experience, but also a preventive analysis of existing technologies in other countries.

Thus, an analysis of the current situation regarding AI regulation in Kazakhstan yields several general conclusions. The creation of a legal framework for regulating AI should be accompanied by flexible legislative approaches when adopting foreign experience, especially from countries that lack a strong regulatory framework in the field of artificial intelligence but are actively implementing such technologies. The development of national standards for AI from an ideal perspective should be carried out by state research institutions, but in close cooperation with private developers of AI technologies, with additional verification with

developers of similar technologies abroad. The axiological approach to the development of ethical principles for the functioning of AI should be dominant, but intuitively accepted at the level of technology developers with the ability to revise the list of principles themselves without breaking away from the developing practice.

In the context of the differentiation of national legislations regulating artificial intelligence, the globalisation of uniform approaches to AI regulation is the most productive instrument of unification. At the same time, in the foreseeable future, full harmonisation of international norms with national ones across all countries is practically impossible, since the technological component of the economic development of interested countries is competitive and does not support conscious limitation of gains. REFERENCES

FOOTNOTES

REFERENCES

AUTHORS INFORMATION

RIGHTS AND PERMISSIONS

EDITORS

ABOUT THIS ARTICLE

DETAILS FOR PUBLICATION

AI DISCLOSURE STATEMENT

АНОТАЦІЯ