Legal regulation of artificial intelligence in Kazakhstan and abroad | Dentons

The development of artificial intelligence (AI) technologies and their widespread use in personal and business needs is growing every year. However, in the absence of adequate laws regulating its use significant risks can arise.

A number of countries are already carefully establishing laws to regulate AI technologies. For instance, AI-related initiatives / development plans and draft laws are already being considered in:

1. US – National Artificial Intelligence Initiative¹
2. China – New Generation of Artificial Intelligence Development Plan²
3. EU – Artificial Intelligence Act.³

Kazakhstan has announced the need to regulate AI with its Concept for a Legal Policy until 2030.⁴ In particular, it has identified two factors that necessitate the adoption of a regulation on AI and robotics:

1. Resolving issues of liability distribution for harm caused by AI and robots
2. Resolving issues of determining intellectual property rights ownership for works created with participation of AI

Thus, while no special regulation on AI yet exists in Kazakhstan, there are two main directions of legal work for developing rules to govern its functioning.

The issues of liability for harm caused by AI, and issues of intellectual property (namely, who should be considered the author of an AI created work) are being actively discussed all around the world. As of today, a universal approach toward AI regulation remains to be developed by the international community.

In this brief overview, we discuss various approaches on AI regulation in developed countries and point out the main legal issues that must be considered when implementing AI into business processes.

Definition of artificial intelligence

No consensus currently exists among countries on a universal legal definition of “artificial intelligence”.⁵ For instance, the United States adopted the following definition in 2020: “A machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments.” In the EU, the draft Artificial Intelligence Act suggests establishing a similar definition: “software that can, for a given set of human-defined objectives generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with.”

Artificial intelligence uses computers and machines, to collect and analyze data to imitate the capabilities of the human mind, make predictions and recommendations, resolve issues and make decisions.

Take social media as an example. You may have noticed that social media networks automatically insert a link to COVID-related information whenever you mention any word associated with COVID-19 in your posts, comments or messages. Moreover, social media uses AI to analyze our web behavior and offer us content it has determined would be interesting for us. This includes displaying ads for certain products/services.

All those examples, in our opinion, are connected by the following characteristics common for AI:

1. Using (collecting, analyzing) data
2. Imitating the human mind
3. Aimed at making decisions that are usually made by humans.

Artificial intelligence and intellectual property

Now, we will focus on the regulatory approaches of the United States and the European Union with respect to AI and intellectual property, in comparison with Kazakhstan law. We note that the majority of this section’s conclusions are based on the practice of intellectual property (patent) offices of one or the other country, along with court precedents.

Before beginning our analysis, we draw your attention to Dentons’ Artificial Intelligence Survey. Carried out in 2021, the survey provides a view on the perceptions of businesses on the key opportunities and risks related to AI.

US. In 2020, the US Patent and Trademark Office (USPTO) noted⁶ that existing US law does not consider inventions created with or by AI as patentable. Their rationale is that the patent law and the USPTO regulations unambiguously recognize only individuals to be inventors. The Court supported⁷ that decision in 2021 and ruled that inventions cannot be registered in the name of AI in the US.

Similarly, Kazakhstan laws indicate that an author of industrial property can only be a natural person whose creative labor created the industrial property.⁸ Considering the current norms of patent legislation, we presume that the Kazakhstan patent office would also refuse to register any industrial property that had an AI listed as the author.

Regarding copyrighted objects, the USPTO also rejects AI as authors of works, because as it follows from US copyright legislation, “fruits of intellectual labor are found in the creative powers of the human mind;” therefore, works can only be produced by a human. In 2022, the USPTO refused to recognize AI as an author and noted that it would not register works produced by a machine or by a mere mechanical process that operates without any creative input or intervention from a human author.⁹ Interestingly, US legislation does allow legal entities to be recognized as authors of works-for-hire.¹⁰

Thus, the US currently does not recognize AI as an author of works. Kazakhstan also considers only individuals to be authors of works, and the works themselves must be created by the creative labor of a human.¹¹

EU. In respect of intellectual property rights, the EU legislation also considers the human factor as the dominating one when resolving rights ownership. As such, the EU Parliament ruled¹² that AI does not have legal capacity or a human mind. In this regard, AI that creates works or inventions independently, would not be recognized as the author of intellectual property. At the same time, it is noted that the current IP framework remains applicable if AI is used only as a tool to assist an author in the process of creation.¹³

Thus, the EU has tried to differentiate the approach for AI-assisted and AI-generated works. In the first case, as we understand, ownership of intellectual property rights would be undoubtedly recognized by the person who uses AI as an instrument for creation. It remains unclear what approach will be taken for AI-generated works.

Despite the above, the Federal Patent Court of Germany¹⁴ ruled in 2021 that an invention created by AI is not excluded from patent protection if a human inventor were indicated in the application. As such, the German court noted that AI can be indicated as an inventor, but only as an additional one. The primary inventor must always be a natural person.

Based on the above we can conclude that the US and European approaches for AI’s intellectual property rights ownership have much in common—both approaches focus on the human factor and on the absence of AI legal capacity per se. However, the EU strives to adopt initiatives on further AI regulation from a more AI-favorable position.

Below you can find a summary of the main points of this review:

In our understanding, the question of who owns intellectual property rights on AI-related works is also important when determining who is liable for AI-caused harm. For that reason, further development of legislation in that direction is expected.

Artificial intelligence and personal data

As we mentioned before, one of the main characteristics of AI is the use (collection, analysis) of data. Personal data is included in this.

Some experts have opined that AI systems can develop more quickly in jurisdictions where there is less regulation on the use and protection of personal data—or where it is not regulated at all. This is related to the fact that AI needs to use data to achieve the established tasks.

The EU is the realm of the General Data Protection Regulation (GDPR), which aims to protect personal data against illegal use. The EU, in light of the GDPR, has already prepared a list of prohibited practices of AI. Thus, according to the draft Artificial Intelligence Act, AI is banned from being used for the following:

1. Any type of social scoring (social credit systems)
2. Remote biometric identification of individuals in public places (automated identification of human characteristics (faces, eyes, fingerprints, DNA, voices), button pressing, rhythms, etc.
3. Identification of human emotions
4. Classification of natural persons based on their biometric data by ethnic, political, sexual background or other peculiarities that may lead to discrimination

It is clear that this list will significantly limit how AI can be used in the European Union. We note, however, that the Artificial Intelligence Act has not entered into legal force yet, and its draft form may yet see changes.

While a specific law on AI has yet to be enacted, current EU legislation, the GDPR, has already been applied to sanction companies for unlawful AI use. For instance, in 2022, a country-record breaking GDPR fine of €670,000¹⁵ was imposed on a bank in Hungary for using AI systems for an automated analysis of audio recordings of customer calls. Based on key words, AI analyzed clients’ voices and emotional state during their call with the bank. As a result, AI determined the priority of clients that need to be called back by automatically ranking them.

In this case, the bank considered improving customer service as the key goal for using AI. The Hungarian authorities claimed that this basis was insufficient to allow for automated data processing by AI and highlighted that the only possible basis for such use of personal data is if it were freely given with the informed consent of the data subjects.

Based on recent court cases, Kazakhstan’s Law on Personal Data¹⁶ is working properly¹⁷. However, so far, there have been no attempts to directly regulate AI in respect of data protection. But considering certain requirements of the current law, we understand that businesses are significantly restricted in using AI. For example, if for AI functioning, biometric data are needed, then all requirements on personal data protection must be met (e.g. consent), as the law considers biometric data to be personal data.

Taking into account the main points of this review, we understand there is a strong need for legislative regulation of AI in Kazakhstan. Kazakhstan laws must define, at least, the following main directions for further AI development:

1. What is AI and what are its main characteristics?
2. Who can be recognized as an author or an owner of AI?
3. Who is accountable for harm caused by using AI?
4. What data and under which conditions can AI collect and use this data?

When incorporating any AI system, we believe that businesses must resolve these issues based on the current legislation.

1. “H.R.6216 – National Artificial Intelligence Initiative Act of 2020,” congress.gov
2. “Notice of the State Council Issuing the New Generation of Artificial Intelligence Development Plan,” State Council Document [2017] No. 35
3. EUR-Lex – 52021PC0206 – EN – EUR-Lex, europa.eu
4. Paragraph 4.13 of the RK’s President’s Decree No. 674 dated October 15, 2021 “On Approval of the Concept for a Legal Policy of RK until 2030”
5. WIPO Conversation on Intellectual Property and Artificial Intelligence, November 4, 2020
6. https://www.uspto.gov/sites/default/files/documents/16524350_22apr2020.pdf
7. United States District Court for the Eastern District of Virginia in Thaler v Hirshfeld, Case No. 1:20-cv-903, September 2, 2021
8. Article 9.1 of the Patent Law of RK dated July 16, 1999
9. https://www.copyright.gov/rulings-filings/review-board/docs/a-recent-entrance-to-paradise.pdf
10. U.S. Code, Chapter 17, § 201 (b)
11. Article 2(1) of the RK Law on Copyright and Related Rights dated June 10, 1996
12. Resolution of the European Parliament dated October 20, 2020 on a Civil liability regime for Artificial Intelligence, Paragraph B(6)
13. Resolution of the European Parliament dated October 20, 2020, on Intellectual Property Rights for the Development of Artificial Intelligence Technologies
14. Order of the German Federal Patent Court No. 11 W (pat) 5/21 dated 11 November 2021
15. Decision of the Hungarian DPA (Nemzeti Adatvédelmi és Információszabadság Hatóság) No. NAIH-85-3/2022 dated 8 February 2022
16. The RK Law on Personal Data and its Protection dated 21 May 2013
17. “Kazakhstan adopts real protections of personal data,” Dentons client alert, April 13, 2022