What the AI Law changes for businesses: 5 points

On January 18, 2026, the Law “On Artificial Intelligence” came into force in Kazakhstan, one of the first laws of its kind in Central Asia. For a company that simply adds a chatbot to WhatsApp, it does not mean a mountain of red tape, but there are five things worth knowing.

1. You classify your own system by risk

The law divides AI systems into minimal, medium and high risk levels. The category is determined by the owner or operator of the system: you, or your contractor on your behalf. For a typical AI customer support assistant, this is usually minimal or medium risk. High risk covers systems related to emergency response, defense, security or a direct threat to human life.

2. The client must know they are talking to AI

This is probably the most practical requirement for small and medium businesses: users must be informed that they are interacting with an AI system. In practice, one line at the start of the conversation is enough. Don’t try to pass the assistant off as a human employee: that is a direct violation of the law, not just a matter of ethics.

3. Synthetic content must be labeled

If you use AI-generated images, video or voice in advertising, such content may only be distributed if it is labeled in a machine-readable form. This applies not only to chatbots but also to generative content for marketing.

4. Risk management is a process, not a one-off document

System owners must implement a continuous risk management process throughout the entire life cycle of the system. This does not mean “wrote a policy once and forgot about it,” but regularly reviewing how the assistant behaves, what mistakes it makes and how they are corrected. For a small project, this fits into the regular monthly metrics report, which is worth keeping anyway.

5. Violations lead to real fines

A first violation carries a fine ranging from roughly 64,675 to 432,500 tenge, depending on the size of the organization. A repeat violation within a year doubles the amount. Separately, the law explicitly prohibits systems that manipulate human behavior, exploit vulnerabilities related to age or health, engage in social or biometric discrimination, detect emotions without consent or violate personal data legislation.

For a typical business assistant (customer support, bookings, order processing), the law comes down to three practical steps: tell the client it is AI; don’t try to manipulate or covertly analyze emotions; keep minimal documentation on how the system works and what to do if it fails. We build all of this into every project by default, not as a separate add-on for an extra fee.