Kazakhstan's Digital Code 2026: New E-Signature Rules for Cross-Border Contracts

On 11 July 2026, the Digital Code of the Republic of Kazakhstan (No. 255-VIII, signed 9 January 2026) entered into force, replacing the 2003 Law "On Electronic Document and Electronic Digital Signature". For foreign investors and companies signing contracts involving Kazakhstan, the change is not cosmetic: the Code restates what makes an electronic digital signature (EDS) valid, prohibits the sharing of signing keys, and confirms that a foreign e-signature is not automatically recognised.

This article summarises the practical points that matter for cross-border contracting, based on the text of the Digital Code and publicly available legal analysis.

What the Digital Code replaces

The Digital Code is a single framework for Kazakhstan's digital environment — electronic documents, electronic digital signatures, digital identification, and related matters. Its Article 106 repeals the 2003 Law that most compliance pages and templates still cite. Any clause, checklist, or vendor document that refers to the 2003 Law "On Electronic Document and Electronic Digital Signature" is now out of date.

An EDS equals a handwritten signature — but only if four conditions are met

Under Article 49(2) of the Digital Code, an electronic digital signature is equivalent to the handwritten signature of the signatory and has equal legal effect. That equivalence is not automatic. Article 49(4) requires all of the following at the same time:

• the authenticity of the EDS is verified using the public key;
• the signatory lawfully possesses the private key;
• the signature is used in accordance with the information in the certificate;
• the certificate was issued by a certification authority accredited in Kazakhstan, or by a foreign certification authority registered with the Trusted Third Party of Kazakhstan.

Failing even one of these conditions can undermine the legal validity of the signature and the effect of the document. This matters most for corporate approvals, filings to government systems, formalisation of authority, and other legally significant documents signed locally.

Who issues an EDS

The Code does not reserve issuance to a single body. Any certification authority that meets the statutory accreditation requirements may issue an EDS; Chapter 11 (Articles 52–60) governs certification authorities, signature certificates and EDS keys, and the refusal and revocation of certificates. In practice, the overwhelming majority of EDS used by businesses is issued through the National Certification Authority via the pki.gov.kz portal, which is the standard route for electronic document management and access to government digital services.

One signatory, one key: sharing is prohibited

Article 51(3) states that EDS private keys are the property of the persons who lawfully possess them, and that transferring private keys to other persons — or using such keys by other persons — is not permitted. Article 58(4)(3) further requires the certificate holder to protect the private key from unauthorised access and use.

The practical consequence is clear: a director or authorised signatory must not hand their EDS to an accountant, lawyer, or assistant "for convenience", even within the same company. A document formally signed by one person but in fact created by another using the former's key does not comply with the law. Where another employee needs to sign or submit documents, that employee should obtain a separate EDS and have their authority duly formalised.

Liability follows the key. Unlawful transfer of an EDS private key triggers administrative liability under Article 640(5) of the Code on Administrative Offences, and use of another person's private key under Article 640(6). The risk arises for both the person who transferred the key and the person who used it.

Foreign e-signatures are recognised through a special mechanism, not automatically

For international groups, the most consequential point is Article 49(4) read with Article 57. A document signed through a foreign platform such as DocuSign or Adobe Sign is not automatically recognised as equivalent to a handwritten signature in Kazakhstan. A foreign EDS has that effect only where its certificate was issued by a certification authority accredited in Kazakhstan or by a foreign certification authority registered with the Trusted Third Party (TTP) of Kazakhstan.

Article 57 provides the mechanism: a foreign EDS is recognised when the TTP of Kazakhstan verifies its authenticity within the cross-border interaction framework. The rules for registering and terminating interactions between foreign certification authorities and the TTP, and the rules for verifying EDS authenticity, are approved by the authorised state body and apply from 27 September 2026.

In short: validity in another jurisdiction is not enough. The foreign signature path runs through the TTP.

A practical checklist for cross-border teams

• Confirm which signature level each document needs: a certified EDS where Kazakhstan law or a counterparty requires the equivalent of a handwritten signature.
• Never share a private key. Issue a separate EDS to every individual who signs or submits documents, and document their authority.
• For foreign signers, plan for the TTP route rather than assuming a platform's signature will be accepted as-is.
• Update any internal template, checklist, or vendor page that still cites the 2003 Law.
• Keep evidence: certificate details, public-key verification, and the authority under which each signatory acted.

What to watch next

The Digital Code is being implemented through secondary legislation. Rules for the TTP recognition mechanism (Article 57) apply from 27 September 2026, and certification-authority practice continues to develop. Businesses operating in Kazakhstan should treat the Code as a living framework and revisit their signing workflows as the implementing rules settle.

Key takeaways

• Since 11 July 2026, the 2003 Law is replaced by the Digital Code (No. 255-VIII).
• An EDS equals a handwritten signature only if all four conditions of Article 49(4) are met.
• Private keys must not be shared; doing so triggers liability under Article 640.
• Foreign e-signatures are recognised only through the Trusted Third Party mechanism (Articles 49(4) and 57).