2.4. Overview of the regulatory environment

Kazakhtelecom JSC is the national communications operator of the Republic of Kazakhstan and carries out the functions of the operator of the public telecommunications network (including long-distance and international communications) with the right of carrying out settlements with the communications Administrations of other states, companies, users, international organizations in accordance with the Regulations of the International Telecommunication Union and the legislation of the Republic of Kazakhstan.

In 2025, the activities of the Company took place in conditions of substantial changes in the legislative and regulatory base. The main regulatory acts of the Republic of Kazakhstan regulating the activities of the Company are the Entrepreneurial Code of the RK, the Laws of the RK “On communications”, “On informatization”, “On artificial intelligence”, “On natural monopolies”, “On joint-stock companies”, “On limited liability partnerships”, “On personal data”.

Below an analytical overview of the key innovations of 2025 is presented, including amendments to the Entrepreneurial Code of the RK, the Law of the RK “On communications”, changes in licensing and tariff regulation, and also policies in the area of cybersecurity (for example, traffic certification and the application of the security certificate). Particular attention is paid to changes coming into force in 2025–2026 and their impact on the activities of Kazakhtelecom, including the management of IP traffic, antifraud control, the access of competitors to infrastructure and the Rules of connection and interaction of telecommunications networks of operators of long-distance and (or) international communications and the regulation of the passage of traffic.

Entrepreneurial Code of the Republic of Kazakhstan

The Entrepreneurial Code of the Republic of Kazakhstan (hereinafter — the EC of the RK) determines the legal, economic and social conditions and guarantees ensuring freedom of entrepreneurship in the Republic of Kazakhstan, regulates social relations arising in connection with the interaction of subjects of entrepreneurship and the state, including state regulation and support of entrepreneurship.

The amendments of 2025 to the Entrepreneurial Code of the RK introduce new types of investment contracts and in detail prescribe what benefits and on what conditions investors receive. Thus, by the Law of the Republic of Kazakhstan dated 18 July 2025 No. 215-VIII “On the introduction of changes and additions to certain legislative acts of the Republic of Kazakhstan on the issues of taxation” (not put into effect), changes and additions were introduced, thanks to which for entrepreneurs themselves a clearer system of investment preferences appears, but together with this requirements and control are strengthened. At the same time, by investments is understood any property (other than personal consumption) and rights to it, which is invested into the authorised capital, into long-term assets or into projects of public-private partnership (PPP). Instead of “fixed” assets the unified term “long-term assets” is now used as fixed assets, real estate, intangible and biological assets for business. The list of state support measures is approved: support on the “one window” principle, the assistance of central and local bodies, investment preferences. The assistance of state bodies (other than “one window” and preferences) is now given only if there are counter-obligations of the investor (on the volume of investments, the type of activity, etc.). The authorised body establishes the procedure under which a project is recognised as an “investment project” for the purpose of obtaining state-owned land.

Investment preferences are given only under one of three types of contracts, namely an agreement on investments, an agreement on investment obligations or a simplified investment contract. Tax preferences are granted by the authorised body for investments based on the results of the consideration of the application and materials on the project; there cannot be full exemption from taxes.

For the agreement on investments, a 100% reduction of CIT, a zero rate on land tax and property tax, fixed rates and coefficients for the period of preferences are envisaged. For the agreement on investment obligations the main advantage is the stability of tax legislation on the conditions of the agreement. Under the simplified contract –exemption from customs duties on equipment, components, spare parts, raw materials and materials for the period of the contract, but not more than 5 years from the introduction of the assets into operation. The investor under the simplified contract is obliged to submit semi-annual reports, to confirm the introduction of the assets and the use of preferential equipment and raw materials, and after the completion of the project to provide an auditor’s report. In case of violations the authorised body gives 3 months for correction; if the equipment and raw materials are not used, preferential duties must be paid additionally with penalties. It is prohibited to change the designation of the in-kind grant received and to sell/lease it during the period of validity of the simplified contract.

In addition, a separate article on the assessment of the effectiveness of investment preferences for the analysis of their impact on socio-economic development is introduced. This assessment is carried out by the authorised body for the policy of attraction of investments by its own order.

Item 2 (on the agreement on investment obligations and related norms) comes into force on 1 July 2026, that is, part of the new rules will start to work later.

Law of the Republic of Kazakhstan “On communications”

The Law of the Republic of Kazakhstan “On communications” (hereinafter — the Law on communications) determines the legal foundations of activities in the area of telecommunications, establishes the order of licensing of communications services, the distribution of frequencies, the rights and duties of operators and users, as well as the powers of the state authorised body (ministry) in the industry.

By the Laws of the Republic of Kazakhstan of 30.06.2025 No. 205-VIII, of 18.07.2025 No. 215-VIII and of 17.11.2025 No. 231-VIII, a number of changes and additions were introduced into the Law of the Republic of Kazakhstan “On communications” of 5 July 2004 No. 567-II, which came into force on 31 August 2025, and also partially — on 2 January 2026, 1 January 2026 and 18 January 2026:

a new concept of unauthorized traffic (fraud) was introduced — traffic passed in violation of the established rules of connection and interaction of telecommunications networks, including the passage of traffic and the order of mutual settlements, including traffic with substitution of the number of the calling subscriber;
the obligation of communications operators to have internal antifraud systems and to carry out the blocking of unauthorized traffic (fraud) was established;
the integration of the antifraud centre of the National Bank of the Republic of Kazakhstan with the database of identification codes of cellular communication subscriber devices and (or) databases of cellular communications operators was envisaged for obtaining information about the subscriber, including the surname, name, patronymic (if any), individual identification number and subscriber numbers issued in the name of the subscriber;
the obligation of cellular communications operators, upon identification of the subscriber number from which a call with signs of fraud was made, and also upon identification of fraudulent actions on communications networks, to notify the antifraud centre of the National Bank of the Republic of Kazakhstan with the provision of information about the subscriber, including the surname, name, patronymic (if any), individual identification number and subscriber numbers issued in the name of the subscriber, was fixed;
it is established that the procedure for the identification of the subscriber number from which a call with signs of fraud was made, and also of fraudulent actions on communications networks, is determined by the rules of provision of communications services;
the obligation of cellular communications operators in special cases, and also upon receipt of information from the antifraud centre of the National Bank of the Republic of Kazakhstan, to suspend the provision of communications services to the corresponding subscriber number, including the GSM gateway (sim box), in the order and within the periods established by the rules of provision of communications services, is envisaged;
a prohibition is established for communications operators and owners of telecommunications networks on the passage of unauthorized traffic (fraud) in local, long-distance, international and cellular communications networks;

the obligation of the cellular communications operator to issue, upon the application of the subscriber, not more than ten subscriber numbers, sufficient for personal, family and other use, is fixed;
a prohibition is established on the conclusion of an agreement on the provision of cellular communications services without the carrying out of biometric identification of the subscriber by means of the comparison of the current image of the identified person and the reference image from the database of biometric data;
obligatory biometric identification of employees of individual entrepreneurs and legal entities to whom subscriber numbers are transferred for use is envisaged, within a period of not more than ten working days from the moment of submission of the application for the issuance of the subscriber number;
the order of restriction of the access of a foreign company to an internet resource and (or) an internet platform in the cases determined by item 2 of article 89 of the Tax Code of the Republic of Kazakhstan is established, including the obligation of communications operators and (or) the state technical service immediately to execute the corresponding prescription;
the order of the removal of the restriction of access to an internet resource and (or) an internet platform on the grounds envisaged by the Tax Code of the Republic of Kazakhstan, on the basis of the decision of the head of the tax body or his deputy, is envisaged;
the obligation of communications operators and (or) owners of communications networks to submit to the authorised body in the area of state statistics depersonalised data on subscribers without transfer to third parties in the order determined by the authorised body in coordination with the National Security Committee of the Republic of Kazakhstan is fixed;
it is determined that one of the priorities of 2025 became the suppression of telephone and internet fraud, in connection with which on the initiative of the MDDIAI new Rules of provision of communications services aimed at combating fraudsters were developed and by the end of 2025 introduced;
the obligation of all mobile operators to deploy automated systems of detection and prevention of fraudulent actions was established;
the procedure of temporary blocking of a SIM card suspected of being used for fraud, including the periods of verification, the order of blocking and notification of the antifraud centre of the National Bank of the Republic of Kazakhstan, and also the order of unblocking in the absence of confirmation of violations, is regulated;
obligatory introduction of biometric identification upon the sale of SIM cards, including the preparation by communications operators of the necessary infrastructure and integration with state databases, is envisaged;
the obligation of communications operators to organise channels for the reception of subscriber requests on fraudulent SMS messages and calls and to ensure their processing jointly with the antifraud centre of the National Bank of the Republic of Kazakhstan is established.

Law of the Republic of Kazakhstan “On Artificial Intelligence”

The Law of the Republic of Kazakhstan “On artificial intelligence” (hereinafter — the Law) was adopted on 19 November 2025. The aim of the Law is the state regulation of social relations in the area of artificial intelligence (hereinafter — AI), ensuring the development of artificial intelligence and stimulating its introduction in various areas to improve the quality of human life and enhance the efficiency of the economy.

The main tasks of state regulation in the area of AI:

determination of the legal and organizational basis of regulation of social relations in the area of artificial intelligence;
ensuring transparency and security in the use of AI systems, as well as the results of activities of AI systems;
the creation of favourable conditions for the attraction of investments into the development of the AI area;
state support of research and innovations in the area of AI.

Key provisions of the Law

The Law introduces basic concepts, such as “artificial intelligence”, “AI system”, “AI model” and “synthetic results”, and fixes the main principles of their use. The Law regulates the powers of state bodies and the operator of the national AI platform, determines the rights and obligations of owners, holders and users of AI systems, introduces the classification of AI systems by the level of risk and autonomy, and also establishes prohibitions on individual types of application. In addition, the issues of data libraries and copyrights, including the training of AI models on others’ works, are regulated. The basics of risk management, transparency of the use of AI and responsibility are determined.

In accordance with the Law, by AI is understood the functional ability to imitate the cognitive functions of a human and to produce results comparable with or surpassing human ones (sub-item 3) of article 1).

An AI system is determined as an object of informatization, operating on one or several AI models (sub-item 5) of article 1). Thus, any service that independently processes data, constructs forecasts or makes decisions on the basis of machine learning models falls under the concept of an AI system.

Applicability of the Law to the activities of the Company

Taking into account the introduction of AI into operational activities and the participation of the Company in the development of the national AI infrastructure, Kazakhtelecom can simultaneously act as:

an owner and (or) user of AI systems introduced for internal processes;
a developer of individual AI models when creating its own algorithms and analytical tools;
a supplier of AI solutions for state bodies and industry partners.

Principles of the use of AI

The Law fixes requirements by means of a system of principles. The principle of legality means that AI systems are created and used exclusively within the framework of legislation (article 5). The principle of justice and equality establishes the impermissibility of discrimination on social, ethnic, religious and other grounds (article 6). For the Company this means the necessity of a legal assessment of the goals of data processing and decisions made for compliance with the Law, the Law on informatization, the Law on personal data and other regulatory acts, and also the non-admission of the application of algorithms and models capable of unjustifiably discriminating against subscribers.

The principle of transparency and explainability assumes the provision to the user of information on the characteristics and limitations of the AI system (article 7). In practice this requires the provision of the minimum necessary level of explainability of key decisions (including refusal of a service or antifraud blockings), allowing the subscriber to understand the grounds of the situation that has arisen and the ways of protecting his rights. The principle of responsibility and controllability provides for the obligation of the owner, holder and (or) user to ensure constant control over the AI system. The Law also fixes the priority of the well-being of a human, free will in decision-making (article 9) and requirements on the protection of data and confidentiality (article 10). Accordingly, AI decisions substantially affecting a subscriber (restriction of a service, tariff decisions, blockings) shall provide for the possibility of their challenge and verification. The Company is obliged to observe the regime of personal data and confidentiality of information, including upon the use of external AI services and cloud infrastructure.

Data libraries and synthetic results

The Law introduces the concept of “manufacturer of a data library”, by which is understood a person who has organized the collection, processing and structuring of data suitable for the training of AI models (sub-item 2) of article 1). For the Company such persons may be both internal IT subdivisions and external contractors.

By “synthetic results” are understood images, videos, audio, texts and other materials, created or modified by an AI system and imitating the appearance, voice, behaviour of a person or events that did not take place. In case of the introduction of such solutions into client services, separate control over marking, obtaining consent and the prevention of abuses is required (article 21).

Rights and obligations of owners and users of AI systems

Owners and holders of AI systems have the right to determine the conditions and limitations of the use of AI systems and to protect their rights to them. At the same time, they are charged with obligations on the management of risks, ensuring safety and reliability, the keeping of documentation, the support of users and the provision of user agreements (article 15).

In projects where the Kazakhtelecom group of companies develops or acquires AI systems, the Company acts as the owner and holder of such systems, which assumes an expanded complex of obligations on their safe operation, monitoring and prevention of impermissible risks. In relation to external AI platforms the Company may act as a user, which requires the analysis of user agreements and control over the volume and grounds of data transfer. In this connection it is necessary to establish limitations on use in internal policies.

Classification of AI systems and prohibitions

AI systems are classified by the degree of risk (minimum, medium, high), at the same time the attribution to a risk category is carried out by the owner. The systems are also subdivided by the level of autonomy into low, medium and high. Upon the introduction of AI services the Company shall consciously select and document the level of autonomy.

The Law prohibits the creation and operation of AI systems that manipulate the subconscious of a person, restrict the ability to make conscious decisions, exploit human vulnerabilities, violate the legislation on personal data, carry out discrimination, determine emotions without consent or create and disseminate prohibited results. Upon the assessment of AI projects such features shall be identified and blocked at the stage of design or procurement.

Informing of users and copyrights

The Law requires informing users that goods, works and services are produced or are being rendered with the use of AI systems. For the Company this means obligatory indication of the use of AI in client services. Any texts, audio or video created by AI shall be marked as synthetic. At the same time, works created by AI without the creative contribution of a human are not protected by copyright, whereas text requests of users (prompts) may be the object of copyright.

Control and responsibility

The authorised body forms lists of trusted AI systems of a high degree of risk. For inclusion in such lists an audit of information systems is carried out, including the assessment of the quality and lawfulness of the use of data libraries.

Special norms establishing responsibility for violations of legislation in the area of AI (coming into force from 2026) are introduced into the Code of the Republic of Kazakhstan on administrative offences. Such violations include, in particular:

non-fulfilment of the obligation to inform users of the synthetic results of the activity of the AI system;
improper management of the risks of AI systems of a high degree of risk, which entailed negative consequences.

For the indicated violations differentiated responsibility in the form of fines is established, and in case of repeated violations — additional sanctions, including the suspension or prohibition of the activity of the corresponding AI systems. The consideration of cases is attributed to the competence of the authorised body in the area of artificial intelligence.

In case of repeated violations there arises the risk of suspension or prohibition of the activity of key AI systems, which may lead to the disruption of business processes, the breakdown of the periods of fulfilment of obligations and the necessity of transition to backup or manual processes.

Law of the Republic of Kazakhstan “On natural monopolies”

The Law of the Republic of Kazakhstan “On natural monopolies” extends to services provided by subjects of natural monopolies and is applied to individual segments of the telecommunications market (in particular, fixed communications and access to infrastructure). The Law establishes state regulation of tariffs for socially significant services and control over the investment programmes of monopolist operators. Kazakhtelecom JSC as the dominant operator is subject to supervision under this Law in respect of tariffs for public communications services.

In 2025, large-scale changes were introduced into the Law of the Republic of Kazakhstan of 27 December 2018 “On natural monopolies”, aimed at the modernization of the system of state regulation, the enhancement of the investment attractiveness of branches of natural monopolies and the ensuring of the balance of interests of consumers and subjects of natural monopolies.

The main amendments are adopted by the Law of the Republic of Kazakhstan of 15 March 2025 No. 172-VIII, oriented to the development of the mechanisms of public-private partnership and the clarification of tariff regulation, including:

article 1 of the Law was substantially reworked, in which in a systemic form the goals of regulation (the balance of interests of consumers and subjects of natural monopolies, the legal foundations of state regulation), tasks (accessibility of services, protection of the interests of the parties, stimulation of the quality of services), as well as the basic principles of regulation, including the justifiability of the tariff, openness and transparency, are fixed;
integrated regulation of tariff formation under projects of public-private partnership (PPP) was introduced, including the clarification of the powers of the authorised body on coordinating tender documentation and PPP contracts in respect of the formation of the tariff;
article 19 of the Law, which in detail regulates the order of determination of the tariff on the basis of the PPP contract, is set forth in a new version;

a requirement is fixed that the tariff shall ensure the coverage of economically justified costs, the return of investments of the state and private partners, as well as the level of profitability in accordance with the feasibility study of the project;
the functions and order of interaction of the authorised body for regulation of natural monopolies, sectoral state bodies and local executive bodies are clarified.

In addition, in 2025 changes of a general nature were introduced into individual legislative acts of the Republic of Kazakhstan applied in the activities of Kazakhtelecom JSC, including the Tax Code of the Republic of Kazakhstan, the Code of the Republic of Kazakhstan on administrative offences, as well as subordinate regulatory legal acts in the area of provision of communications services and other regulatory legal acts.

In 2025, the authorised body in the person of the Ministry of Digital Development was reorganized into the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan. The Ministry through the Committee of Telecommunications carries out licensing, the distribution of radio frequencies and technical supervision in the area of communications. The Committee of Information Security at the ministry is responsible for the issues of cyber and information security.

Tariffs for services in monopoly segments are coordinated with the authorised body for the regulation of natural monopolies (formerly — the Committee for Regulation of Natural Monopolies, at present the functions are carried out by the Agency for Protection and Development of Competition of the Republic of Kazakhstan).

For the industry, sectoral rules and standards approved by the relevant ministry are also applied, including the rules of provision of communications services, the connection of networks and access to infrastructure.

Law of the Republic of Kazakhstan “On informatization”

Into the Law of the Republic of Kazakhstan of 24 November 2015 “On informatization” changes were introduced affecting the issues of licensing, information security, data processing and the use of artificial intelligence systems, including:

it is established that activities in the area of ensuring information security are subject to licensing in the order established by the legislation of the Republic of Kazakhstan on permits and notifications; at the same time, licensees in the area of ensuring information security are obliged to submit to the licensor reports, notifications, and also other information, the list, forms and frequency of which are determined by the licensor within the framework of qualification requirements;

the order of access of the operator of the national artificial intelligence platform to electronic information resources that are confidential is determined, with the obligatory ensuring of their depersonalisation; the transfer of data is carried out in accordance with the requirements on data management;
a requirement is fixed that the automated processing of personal data is carried out in accordance with the legislation of the Republic of Kazakhstan on personal data and their protection;
it is established that the creation and development of artificial intelligence systems classified as objects of informatization of “electronic government” is carried out with account for the specifics envisaged by the legislation of the Republic of Kazakhstan in the area of artificial intelligence.

Digital Code of the Republic of Kazakhstan

The Digital Code of the Republic of Kazakhstan was adopted by the Mazhilis of the Parliament of the Republic of Kazakhstan and sent to the Senate of the Parliament of the Republic of Kazakhstan by the resolution of the Mazhilis of the Parliament of the Republic of Kazakhstan of 3 December 2025 No. 882-VIII. The Digital Code is an integrated document regulating legal relations in the area of the digital environment.

The Code fixes the foundations of the functioning of “digital state”, the principles of provision of electronic services and treatment of data, the rights of citizens in the digital environment, and also introduces uniform rules for the implementation of experimental digital projects.

Draft law on the issues of information security of children

In 2026, the adoption of the Law of the Republic of Kazakhstan “On the introduction of changes and additions to certain legislative acts of the Republic of Kazakhstan on the issues of information security of children” (hereinafter — the draft law) is expected. The draft law is aimed at the creation of an integrated system of protection of children in the digital environment in the conditions of the growth of online content, the spread of social networks, online platforms and digital services exerting significant influence on the mental health and development of minors.

The current legislation does not fully cover modern digital risks, including the absence of mechanisms of age verification, insufficient control over the observance of age restrictions, the absence of obligatory requirements for online platforms on the ensuring of privacy and a safe algorithmic profile for children, as well as the low effectiveness of parental control tools. The draft law is aimed at the elimination of the indicated gaps.

Key provisions of the draft law provide for:

the introduction of the obligation of parents to ensure the information security of children and to use parental control tools;
the fixing of the concepts of “parental control” and “age verification” with the aim of ensuring legal certainty and uniform application of norms;
the creation of the National system of age verification as a state tool for the verification of age without the transfer of personal data to online platforms;
the establishment of the obligations of online platforms on the application of privacy settings by default, the reduction of algorithmic risks and the ensuring of the transparency of recommendation systems;
the introduction of the requirement of obligatory application of the sign of the age category on all information products and the blocking of content without marking;
the fixing of the competence of authorised bodies on control over integration with the age verification system.

Draft law on the development of the telecommunications market and data centres

Also in 2026, the adoption of the Law of the Republic of Kazakhstan “On the introduction of changes and additions to certain legislative acts of the Republic of Kazakhstan on the issues of development of the telecommunications market and data centres” is expected.