Kazakhstan Wi-Fi rules: what changed in 2025 and 2026

Kazakhstan's Communication Services Rules changed twice in a year. The order of 17 September 2025 (in force from 4 October 2025) listed for the first time the ways a guest may be let onto public Wi-Fi — there were three. Order No. 322/НҚ of 17 June 2026 (in force from 12 July 2026) rewrote those clauses, and two methods remain.

What applies now

Under clauses 110–112 of the current wording, the owner of a public internet access point, or the operator, connects a user in one of two ways:

1. A subscriber number and a one-time password by SMS. The guest types a phone number into the "Login" field, presses "Get password" and receives it by text. The most common method in venues
2. Sign-in on the eGov portal with a digital signature. Identification relies on government data and does not depend on SMS delivery

The password is valid until the device disconnects, and on reconnection the procedure is repeated (clauses 113–114). A separate case is clause 115: where a settlement has no mobile coverage, access is granted against an identity document and the owner keeps an electronic log with the user's full name, start and end time, and the computer number.

What was removed in 2026

The 2025 wording listed a third method: an automatic operator system that recognises the subscriber without manual entry. It is absent from clauses 110–112 after 12 July 2026. If a vendor sold you sign-in "with no code, via the operator's system", ask which clause of the rules they now rely on.

Other popular options are not named in the rules either: third-party digital IDs such as Aitu Passport, reception vouchers, room number, social login. They remain useful as conveniences. But if every session needs to meet the rules on paper, the main method should be the SMS code or eGov, with everything else as extra buttons.

What the changes do not do

It is worth stating the opposite too, because the topic attracts a lot of guesswork.

• The orders introduce no new fines: they change secondary rules, not the Administrative Offences Code
• Venues have no new duty to connect to any particular government system
• A digital signature has not become mandatory: it is the second method alongside SMS, not a replacement

One common error in write-ups deserves a note. The "up to 100 MCI" figure is still quoted with reference to subclause 9-1 of clause 1 of Article 637 of the Administrative Offences Code, although that subclause was repealed by Law No. 128-VI back in December 2017. What follows from that is covered on the law page.

What a venue owner should do

If guests sign in with an SMS code, nothing needs to change. If your main sign-in works differently, add SMS as the base method. A few other things are worth checking.

• Is there a connection log and can it be exported for any period? Authorization without a session record does not settle the question — details in the article on guest Wi-Fi log retention
• Is the guest network separated from the working one? The communications rules do not require it, but a shared segment is exactly how a guest incident becomes a till incident — see guest network isolation
• Does the hardware support a captive portal? Usually no router replacement is needed: what the hardware must do is covered in the Wi-Fi authorization hardware overview

If there is still no authorization

The steps have not changed: put an authorization portal between the guest and the internet, switch on SMS-code sign-in and start recording a session log. In practice it is one evening of setup if the hardware supports a captive portal. There are separate scenario guides for cafes and restaurants and hotels, and the article on choosing an authorization provider covers what to ask a vendor.

This material is for reference and is not legal advice. Check the current wording of the Communication Services Rules on adilet.zan.kz.