🇵🇰Pakistan

Overview

Pakistan’s approach to the regulation of artificial intelligence and digital technologies has undergone a significant transformation between 2018 and 2026. Initially guided by the high-level strategic vision of the Digital Pakistan Policy (2018), the country has moved toward a more robust, institutionalized, and statutory governance model. This evolution is characterized by the establishment of powerful federal bodies designed to centralize digital transformation, such as the Pakistan Digital Authority (PDA) and the National Digital Commission (NDC), both created under the Digital Nation Pakistan Act, 2025. These institutions are tasked with operationalizing a "Pakistan Stack"—a suite of digital public infrastructure intended to integrate identity, payments, and data exchange layers, which provides the foundational data environment necessary for large-scale AI deployment. The government views AI not merely as a technological tool but as a critical driver for socio-economic development, aiming to leapfrog traditional industrial stages through automated efficiency in public services and the private sector. The current regulatory philosophy in Pakistan balances aggressive economic growth and human capital development with increasing state oversight of digital content and data flows. The National Artificial Intelligence Policy 2025, approved in mid-2025, sets ambitious targets for upskilling one million professionals and fostering a local AI ecosystem, while simultaneously introducing requirements for "Secure and Trustworthy AI." However, the landscape remains in a state of transition; while the governance architecture is largely in place, specific horizontal AI legislation (the Regulation of Artificial Intelligence Bill) and the comprehensive Personal Data Protection Bill are still pending. Consequently, AI systems are currently governed through a patchwork of sectoral guidelines, cybersecurity policies, and the stringent content regulations found in the Prevention of Electronic Crimes (Amendment) Act, 2025. This multifaceted approach ensures that while the legislative process for AI-specific laws continues, the state maintains the necessary tools to manage the immediate risks associated with rapid digital adoption.

Regulatory approach

Pakistan’s regulatory approach is currently hybrid, blending "soft law" policy frameworks with "hard law" statutory mandates. The National AI Policy 2025 serves as the primary administrative guide, emphasizing an innovation-first ecosystem supported by regulatory sandboxes for supervised testing. This policy-led approach is designed to be flexible, allowing the government to issue sectoral roadmaps for health, education, and agriculture without the immediate rigidity of a primary statute. By utilizing the Ministry of Information Technology & Telecommunication (MoITT) as a central steward, Pakistan aims to align AI development with national socio-economic goals while building the technical capacity required for future enforcement. The use of sandboxes is particularly notable, as it allows startups to experiment with AI applications in a controlled environment where regulatory requirements can be adjusted in real-time based on observed outcomes and risks. Conversely, the pending Regulation of Artificial Intelligence Bill (2024) signals a move toward a risk-based, prescriptive model similar to international frameworks like the EU AI Act. This proposed legislation seeks to categorize AI systems by risk level, mandating algorithmic impact assessments and human-in-the-loop controls for high-risk applications. Furthermore, the 2025 amendments to the Prevention of Electronic Crimes Act (PECA) demonstrate a prescriptive approach to content generated or disseminated via AI, particularly regarding misinformation and "fake news." This suggests that while the government promotes AI as an economic catalyst, it is simultaneously building a robust enforcement apparatus to manage the perceived social and security risks associated with automated content and data processing. The regulatory stance is therefore one of "managed openness," where innovation is encouraged within clearly defined boundaries of national security and public order. The governance of AI in Pakistan is currently centralized under the Ministry of Information Technology & Telecommunication (MoITT), but operational power is shifting to specialized statutory bodies. The Pakistan Digital Authority (PDA), established in 2025, is the lead agency for digital transformation, tasked with setting technical standards for data interoperability and reviewing major public-sector digital projects. It operates under the strategic direction of the National Digital Commission (NDC), which is chaired by the Prime Minister and ensures inter-governmental alignment across federal and provincial lines. This structure is intended to prevent the fragmentation that previously hindered Pakistan's digital initiatives, creating a single point of accountability for the nation's digital roadmap. In addition to the PDA, the Social Media Protection and Regulatory Authority and the National Cyber Crime Investigation Agency (NCCIA), both formalized or created in 2025, hold significant enforcement mandates over the outputs of AI systems. These bodies focus on content moderation and the investigation of digital harms, including the dissemination of AI-generated misinformation or deepfakes. If enacted, the Artificial Intelligence Commission (AIC) proposed in the 2024 Bill would become the dedicated horizontal regulator for AI, responsible for system registration, conformity assessments, and the management of an AI Regulation Fund. Until then, MoITT and the Pakistan Telecommunication Authority (PTA) continue to exercise de facto oversight through policy directives, licensing regimes, and the management of the national internet gateway, ensuring that AI deployments remain compliant with existing telecommunications and cybersecurity laws.

Enforcement & penalties

Enforcement mechanisms in Pakistan’s digital landscape are increasingly punitive, particularly concerning content and cybersecurity. Under the Prevention of Electronic Crimes (Amendment) Act, 2025, the dissemination of information deemed "false" or "fake"—which encompasses AI-generated deepfakes or misinformation—can result in imprisonment for up to three years and fines of up to Rs. 2 million. The Act also empowers the Social Media Protection and Regulatory Authority to order the "forthwith" removal or blocking of content, typically within a 24-hour window, with failure to comply leading to significant administrative sanctions against platforms and service providers. This rapid-response mechanism is designed to mitigate the viral spread of harmful AI-generated content before it can cause widespread social or political disruption. The proposed Regulation of Artificial Intelligence Bill, 2024, contemplates a sophisticated administrative penalty regime for non-compliance with AI safety and transparency standards. This includes heavy fines for failing to register high-risk AI systems or for neglecting mandatory algorithmic impact assessments. The Bill also suggests that entities failing to adhere to ethical guidelines could be barred from participating in government procurement or accessing the National AI Fund. Appeals against the decisions of these regulatory bodies are generally directed to specialized tribunals, such as the Social Media Protection Tribunal, or the High Courts. The government has also established an Information Security Assurance Framework under the 2021 Cyber Security Policy, which allows for audits and the revocation of accreditations for entities that fail to meet national security standards, providing a multi-layered enforcement strategy that combines criminal, administrative, and economic sanctions.

Data protection

As of early 2026, Pakistan’s primary data protection instrument remains the Personal Data Protection Bill (PDPB), which is in the final stages of parliamentary consideration. The Bill is heavily influenced by the EU’s GDPR, introducing concepts such as data controllers, data processors, and data subject rights (access, erasure, and portability). A critical and debated feature of the Pakistani framework is the requirement for data localization; "critical personal data" must be processed and stored on servers located within Pakistan, a measure intended to ensure national sovereignty over sensitive citizen information. This localization requirement is seen as a cornerstone of the government's strategy to protect national interests and ensure that the data of Pakistani citizens is not subject to foreign jurisdictions without adequate safeguards. The Bill also proposes the creation of the National Commission for Personal Data Protection (NCPDP) as the central enforcement authority. In the absence of the finalized PDPB, data governance is managed through a combination of the Pakistan Cloud First Policy (2022) and the Digital Nation Pakistan Act (2025). The Cloud First Policy introduces a five-tier data classification system (Open, Public, Restricted, Sensitive, and Secret), which dictates the security controls and deployment models required for government data. For instance, 'Secret' data must be stored on government-owned private clouds, while 'Open' data can reside on public cloud infrastructure. Furthermore, the Digital Nation Pakistan Act provides the legal framework for the "Pakistan Stack," allowing the Pakistan Digital Authority to set rules for data sharing and interoperability between public and private entities. These measures ensure that while a comprehensive privacy law is pending, there are established protocols for data security, classification, and inter-agency data flows that AI developers must adhere to when working with public sector data.

Sector-specific rules

Sectoral AI regulation in Pakistan is primarily driven by the National AI Policy 2025, which identifies health, education, agriculture, and governance as priority areas for transformation. In the healthcare sector, the policy promotes AI-driven tele-diagnostics and decision support systems, while requiring these applications to undergo rigorous safety assessments and align with emerging digital health standards. The MoITT, in coordination with health regulators, is tasked with developing specific guidelines for the ethical use of patient data in AI models, ensuring that automated diagnostics do not infringe on patient rights or safety. There is a particular focus on ensuring that AI tools used in rural areas are validated against local demographic data to prevent diagnostic biases. In the financial sector, the State Bank of Pakistan (SBP) and the Securities and Exchange Commission of Pakistan (SECP) have issued circulars and frameworks that intersect with AI, particularly regarding FinTech and automated trading. These regulators emphasize risk management, requiring financial institutions to ensure that AI-driven credit scoring and fraud detection models are explainable and free from bias. The SBP’s Framework for Digital Banks also mandates that AI-driven customer onboarding processes include robust anti-money laundering (AML) and know-your-customer (KYC) checks. Similarly, the agriculture sector is seeing the introduction of AI for yield forecasting and supply chain optimization, governed by guidelines that focus on data sovereignty for farmers and the interoperability of agricultural data sets within the national digital infrastructure. These sectoral rules ensure that AI adoption is tailored to the specific risks and opportunities of each industry.

International alignment

Pakistan has actively sought to align its AI regulatory framework with international norms to facilitate global trade and investment. The National AI Policy 2025 explicitly references the need to participate in global AI standard-setting forums and to align with the OECD Principles on Artificial Intelligence. The government has also engaged in multi-stakeholder dialogues supported by UNESCO to ensure that its ethical guidelines for AI—particularly regarding transparency and human rights—are consistent with international best practices. This alignment is viewed as essential for attracting foreign hyperscalers and AI developers to the Pakistani market, as it provides a predictable regulatory environment that mirrors global standards for safety and accountability. Despite this global outlook, Pakistan maintains a "sovereign-first" approach in certain areas, particularly regarding data localization and cultural relevance. The government’s ambition to develop a National Large Language Model (LLM) reflects a desire to ensure that AI systems are linguistically and culturally attuned to the Pakistani context, rather than relying solely on Western-centric models. This involves training models on Urdu and regional languages to ensure inclusivity. This dual strategy involves adopting international technical standards (such as ISO/IEC standards for AI) while retaining domestic control over data governance and content regulation, creating a unique regulatory environment that seeks to be both globally compatible and nationally secure. Pakistan also participates in regional digital cooperation initiatives within the South Asian Association for Regional Cooperation (SAARC) and the Shanghai Cooperation Organisation (SCO) to harmonize digital trade rules.

What's next

The most significant upcoming development in Pakistan’s AI landscape is the expected enactment of the Regulation of Artificial Intelligence Bill and the Personal Data Protection Bill. Once passed, these laws will complete the transition from a policy-led environment to a fully statutory one, providing the legal certainty required for large-scale private investment. The establishment of the Artificial Intelligence Commission (AIC) and the National Commission for Personal Data Protection (NCPDP) will be the next critical milestones, as these bodies will begin the task of drafting detailed subordinate regulations, registration procedures, and audit protocols. These commissions are expected to be staffed by technical experts to ensure that enforcement is grounded in a deep understanding of AI technologies. Furthermore, the Pakistan Digital Authority (PDA) is expected to release the first National Digital Masterplan in late 2026, which will provide a multi-year roadmap for the integration of AI into the country’s digital public infrastructure. This will likely include the rollout of specialized AI regulatory sandboxes and the launch of the National AI Fund (NAIF) to support commercialization and the scaling of local AI startups. The government also plans to establish a "National AI Ethics Committee" to provide ongoing guidance on the societal impacts of automation. As these institutions become operational, the focus will shift from legislative drafting to enforcement and monitoring, with a particular emphasis on ensuring that AI deployments in critical sectors like finance and healthcare meet the newly established national safety and privacy standards, ultimately aiming to position Pakistan as a regional hub for ethical and innovative AI.