Decree No. 832 and the AI Law: a buyer's checklist for an AI system

When a state body, a quasi-state company or a financial organisation procures an AI system, the terms of reference usually contain a line: “compliance with the legislation of the Republic of Kazakhstan”. What exactly stands behind it is often unclear to both buyer and vendor. This checklist breaks the requirements into verifiable items. It is based on our practice of preparing conformity matrices for enterprise deployments.

Two acts that apply together

The Unified Requirements for information and communication technologies and information security (approved by Government Decree No. 832) regulate the information asset as such: where it is hosted, how access is organised, how logs are kept, how data is protected. The Law on Artificial Intelligence (No. 230-VIII) adds an AI-specific layer: risk classification, duties of the owner and the user, informing people that they interact with AI, prohibition of certain functions.

The first act answers “is the system secure”; the second — “does it apply AI responsibly”. Both must be checked.

Block 1. Security organisation (Unified Requirements, organisational clauses)

• The class of the information asset is assigned. The class determines whether multi-factor authentication is mandatory and the level of cryptographic protection — so the buyer must assign it before deployment, not after.
• A documented security policy, roles and responsible persons exist for the system.
• Event logs are retained locally for at least the required period and protected from modification.
• Cryptographic protection is applied. If the buyer requires certified cryptographic tools under ST RK 1073, this must be stated in the terms of reference: standard AES-256 and TLS without certification may fail acceptance.

Block 2. Application software (Unified Requirements, software clauses)

• User identification and authentication through the corporate directory; password policy; lockout after failed attempts; session timeouts.
• Role-based access with the least-privilege principle.
• Logging of user and administrator actions with export capability.
• Source-code handover or escrow at acceptance — a condition often missed in the contract and remembered at acceptance.

Block 3. Information system (Unified Requirements, IS clauses)

• Hosting in the buyer's data centre or on infrastructure that meets the hosting requirements.
• Backup and recovery with defined RTO and RPO.
• Information-security testing before commissioning, where applicable to the asset class.
• No uncontrolled external connections: for an AI system this means the model does not call external APIs.

Block 4. The AI Law: what is added

• Classification of the system by risk level and autonomy level, documented in an AI-system passport.
• Informing users that they interact with an AI system, and a user agreement before use.
• Human intervention: mandatory human involvement for decisions with legal effect; operator hand-off for conversational systems.
• No prohibited functions (manipulation, covert scoring of people on protected attributes, etc.).
• Labelling of AI-generated results where required.
• Periodic review of the risk passport and retention of information about model training.

How to use the checklist

1. Assign the asset class and decide the cryptography question before announcing the procurement — these two decisions define half of the requirements.
2. Put every checklist item into the terms of reference as a verifiable requirement with expected evidence (document, demonstration, test protocol).
3. Request from the vendor a conformity matrix for both acts with the status of each requirement: met, in progress, not applicable with justification.
4. Run acceptance with the security team and the legal department, not only the functional owner.

We attach conformity matrices for Decree No. 832 and the AI Law to every enterprise deployment. If you are preparing terms of reference for an AI system, we can show what such a matrix looks like on a real project.

This article is general information, not legal advice. Check the current edition of each act before relying on it.