Kazakhstan's Digital Code (Law No. 255-VIII, signed 9 January 2026) entered into force in July 2026, establishing a comprehensive legal framework for digital data, digital identity, online platforms and artificial intelligence. The Code applies broadly to entities operating digital services, processing data or deploying AI systems within Kazakhstan's jurisdiction, including international companies active in the country or serving its market. Together with the concurrently operative Law on Artificial Intelligence (No. 230-VIII), it represents the most significant overhaul of Kazakhstan's digital regulatory landscape to date.
What Changed and When
The Digital Code was signed on 9 January 2026 and took effect in July 2026. Its entry into force was not a single administrative moment but a phased transition spanning the first weeks of that month. International legal sources note the effective date as falling between 10 and 12 July 2026; companies should treat the entire month of July 2026 as the operative trigger for compliance obligations.
The Code consolidates and supersedes a range of earlier sector-specific digital regulations. It introduces unified rules on digital data governance, the legal status of digital identity, obligations for platform operators and a tiered framework for AI regulation. The Law on Artificial Intelligence (No. 230-VIII) complements the Code with dedicated provisions on AI systems, their classification and the responsibilities of developers and deployers.
For international companies already familiar with broad-scope frameworks such as CSRD or CSDDD in the European context, the structure of the Digital Code will feel recognisable: it imposes disclosure, documentation and accountability obligations that sit alongside existing corporate governance requirements rather than replacing them.
Who Is Affected
The Code's scope is intentionally wide. The following categories of entities should assess their exposure without delay:
- Platform operators providing digital services to users located in Kazakhstan, regardless of where the operator is incorporated.
- Data controllers and processors handling personal or non-personal digital data of Kazakhstani residents or generated within Kazakhstani infrastructure.
- AI system developers and deployers whose products are used commercially in Kazakhstan, including systems embedded in fintech, logistics, HR or customer-service applications.
- Holding companies and groups that channel digital services into Kazakhstan through subsidiaries, including structures domiciled in the Astana International Financial Centre (AIFC).
- Foreign investors using Kazakhstan as a regional hub, whose operational entities process data or run platforms locally.
Entities structured through the AIFC – which operates under English-law principles and has its own dispute-resolution infrastructure through the AIFC Court and the Astana International Arbitration Centre (IAC) – should note that the Digital Code is a national-law instrument and applies across the territory of Kazakhstan, including to AIFC-registered companies to the extent they conduct regulated digital activities locally. The interplay between AIFC regulatory perimeter rules and the Digital Code's obligations is an area requiring careful legal analysis.
Key Regulatory Areas
Digital Data and Data Governance
The Code establishes categories of digital data and assigns specific handling, storage and transfer obligations to each. Localisation requirements, cross-border transfer conditions and retention periods are addressed, though certain implementing rules are subject to subordinate legislation that may still be pending or subject to national-level specification. Companies should map their data flows against the Code's data classification schema as a priority step.
Digital Identity
The Code grants legal status to digital identity instruments and sets rules for their use in commercial and administrative transactions. For companies operating e-signature, e-KYC or digital-onboarding processes, a review of existing workflows against the new digital identity provisions is necessary to ensure continued legal validity of executed documents and agreements.
Platform Obligations
Platform operators face transparency, content-moderation and interoperability obligations. Thresholds triggering enhanced duties – for example, based on user volumes or transaction values – are defined in the Code, but certain procedural details remain subject to implementing regulations. Where precise thresholds are not yet confirmed by published subordinate rules, companies should document their current user and transaction metrics to enable a rapid compliance assessment once those rules are finalised.
Artificial Intelligence
The Law on Artificial Intelligence (No. 230-VIII) introduces a classification of AI systems and imposes obligations on developers, deployers and users depending on the risk profile of the system in question. Beneficial ownership and corporate governance transparency requirements may also interact with AI-related reporting where an AI system is operated by a group structure. Companies deploying AI in Kazakhstan – whether in financial services, manufacturing or professional services – should undertake an inventory of AI tools and map them against the statutory risk categories.
If your organisation operates in Kazakhstan and you are assessing exposure under the Digital Code, our team is available to assist. Please write to info@ferrazwhitmore.com or visit our contacts page to arrange a preliminary discussion.
Immediate Action Items for International Companies
Given the Code's broad territorial reach, we recommend that international companies prioritise the following steps:
- Conduct a digital asset and data-flow audit. Identify all data categories processed within Kazakhstan or relating to Kazakhstani users and map them to the Code's classification framework.
- Review platform and AI product portfolios. Determine which services and tools meet the statutory definitions of "platform" or "AI system" and assess the applicable obligation tier.
- Assess corporate structure implications. Groups considering company re-domiciliation or restructuring into or through Kazakhstan – including AIFC holding company arrangements – should factor Digital Code compliance into their governance planning.
- Update contracts and data-processing agreements. Commercial contracts, data-processing agreements and terms of service may require amendment to reflect new data governance and digital identity rules.
- Monitor implementing legislation. Several provisions of the Code refer to subordinate rules that are pending or subject to national-level adoption. A monitoring mechanism should be in place to capture these developments as they are published.
Companies that already maintain compliance programmes under frameworks such as CSRD or CSDDD will find that many of the Code's documentation and accountability expectations are structurally analogous, though the substantive obligations differ. A gap analysis against your existing compliance architecture is a practical starting point.
Dispute Resolution and Enforcement Context
Enforcement of the Digital Code sits with Kazakhstani state authorities. However, commercial disputes arising from digital service agreements or data-processing relationships may be referred to arbitration. For AIFC-connected entities, the AIFC Court and the IAC offer established forums, and the AFSA (Astana Financial Services Authority) exercises regulatory oversight within the AIFC perimeter. Companies should also be aware that enforcement of foreign arbitral awards against Kazakhstani counterparties remains a procedurally distinct matter; our recent analysis of that topic is available at Enforcing Foreign Arbitral Awards in Kazakhstan (July 2026).
For matters involving corporate structure, digital operations and regulatory exposure in Kazakhstan, our corporate law practice in Kazakhstan and our tax law team can provide coordinated advice across the relevant regulatory and transactional dimensions.
How Ferraz & Whitmore Can Assist
Our lawyers advise international clients on regulatory compliance, corporate structuring and dispute risk in Kazakhstan. We work with companies entering the market, groups reviewing their existing operational footprint and investors assessing exposure under new legislation. Advice is tailored to your specific structure and industry, and we do not offer standardised off-the-shelf assessments where the facts require bespoke analysis.
To discuss your organisation's position under Kazakhstan's Digital Code or the Law on Artificial Intelligence, please contact us at info@ferrazwhitmore.com or through our contacts page. We are available for an initial scoping conversation without obligation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.