🇧🇩Bangladesh

Overview

Bangladesh’s approach to artificial intelligence (AI) regulation is intrinsically linked to its national development agenda, specifically the 'Smart Bangladesh 2041' vision. This vision seeks to transform the nation into a high-income, digitally-driven economy by leveraging emerging technologies across four key pillars: Smart Citizen, Smart Government, Smart Economy, and Smart Society. Initially, the regulatory environment was purely promotional, guided by the National Strategy for Artificial Intelligence 2020, which focused on capacity building, infrastructure development, and identifying priority sectors for adoption. However, as AI deployment has accelerated in public service delivery and the private sector, the government has shifted toward a more structured governance model. This transition is marked by the publication of the National Artificial Intelligence Policy 2024 (Draft), which provides a principled framework for responsible AI development, emphasizing social equity, transparency, and human-centered design. The policy serves as a bridge between the aspirational goals of the 2020 strategy and the prescriptive requirements of future legislation, ensuring that the country's digital transformation remains inclusive and secure. The current maturity level of Bangladesh's AI regulation can be described as 'transitional.' While the country does not yet have a single, omnibus 'AI Act' in force, the government has explicitly signaled its intent to enact such legislation to operationalize the 2024 Policy. In the interim, AI governance is managed through a combination of high-level policy documents, the Cyber Security Act 2023, and the institutional mandates of the Agency to Innovate (a2i). The regulatory philosophy is dual-track: it seeks to minimize barriers to innovation for startups and researchers while imposing stricter oversight on 'high-risk' applications that could impact fundamental rights, national security, or critical infrastructure. This balanced approach aims to position Bangladesh as a regional hub for AI-led growth while aligning with international ethical standards. The government's proactive stance is designed to mitigate the 'digital divide' by ensuring that AI benefits reach the grassroots level, particularly in rural agriculture and primary healthcare.

Regulatory approach

Bangladesh follows a hybrid regulatory approach that combines horizontal policy guidance with sector-specific mandates. The horizontal layer is defined by the National Artificial Intelligence Policy 2024, which sets out cross-cutting principles applicable to all AI developers and deployers. This policy introduces a risk-based classification system, distinguishing between low-risk applications and high-risk systems—such as those used in the judiciary, law enforcement, and biometric identification. High-risk systems are subject to more rigorous documentation, impact assessments, and human-in-the-loop requirements. This risk-based methodology mirrors international trends, particularly the EU AI Act, but is tailored to the specific socio-economic context of Bangladesh, prioritizing sectors like agriculture and disaster management where AI can have the most significant positive impact on human lives. On the sectoral side, AI regulation is increasingly embedded within the rules of existing authorities. For instance, the Bangladesh Telecommunication Regulatory Commission (BTRC) manages AI's role in digital and OTT platforms, focusing on content moderation and algorithmic transparency. The central bank (Bangladesh Bank) oversees AI in financial services, particularly regarding algorithmic credit scoring and fraud detection, ensuring that automated systems do not lead to financial exclusion. The approach is currently leaning toward 'soft law' through guidelines and voluntary standards, but the move toward a binding 'AI Act' indicates a shift toward a prescriptive, 'hard law' environment. This evolution reflects the government's recognition that voluntary compliance may be insufficient for protecting citizens' data and preventing algorithmic bias in critical public services. The regulatory framework also emphasizes the importance of 'explainability,' requiring that AI-driven decisions in the public sector be understandable to the citizens they affect. The primary architect of AI policy in Bangladesh is the Information and Communication Technology (ICT) Division under the Ministry of Posts, Telecommunications and Information Technology. The ICT Division coordinates national strategies and is the lead agency for drafting the upcoming AI Act. To provide technical expertise and implementation support, the government is establishing the National Artificial Intelligence Centre of Excellence (NAICE). NAICE is envisioned as a central hub for AI standardization, certification, and monitoring, acting as a bridge between the government, academia, and the private sector. It will also maintain a registry of high-risk AI systems to ensure they undergo mandatory impact assessments and adhere to safety protocols before being deployed in the market. Strategic oversight is provided by the National AI Advisory Council, a multistakeholder body comprising senior government officials, industry representatives (such as the Bangladesh Association of Software and Information Services - BASIS), and academic experts. This council is tasked with ensuring that AI adoption aligns with national interests and ethical guidelines. Enforcement of related digital mandates currently falls under the National Cyber Security Agency (for infrastructure protection and cybercrime) and the BTRC (for communication platforms). Once the Personal Data Protection Act is finalized, a new Data Protection Board will also play a critical role in governing the data lifecycles essential for AI operations, including the power to audit AI service providers for privacy compliance and to issue cease-and-desist orders for non-compliant data processing activities.

Enforcement & penalties

Currently, enforcement and penalties related to AI are primarily derived from the Cyber Security Act 2023 and the Digital Security Act 2018 (where still applicable). These laws prescribe criminal and administrative penalties for unauthorized access to systems, data breaches, and the use of digital tools to spread misinformation or threaten national security. Fines under the Cyber Security Act can reach millions of Taka, and serious offenses involving critical information infrastructure can result in lengthy imprisonment. The legal framework also allows for the blocking of digital services that fail to comply with government takedown orders or security standards, providing a significant deterrent for non-compliant AI service providers. The government has shown a willingness to use these powers to maintain digital sovereignty and public safety. The proposed AI Act and the Draft Personal Data Protection Act 2023 are expected to introduce more specific administrative sanctions for AI-related failures. For example, the Draft Data Protection Act contemplates administrative fines for domestic entities and penalties for foreign firms that can reach up to 5% of their annual turnover in Bangladesh. The National AI Policy 2024 suggests that enforcement will involve mandatory audits and the potential suspension of certifications for high-risk AI systems that fail to meet safety or fairness standards. Appeals against regulatory decisions are typically handled through the administrative hierarchy of the relevant ministry, with further recourse available through the High Court Division of the Supreme Court of Bangladesh. The judiciary is also being sensitized to AI-related legal issues through specialized training programs to ensure fair adjudication of complex algorithmic disputes.

Data protection

Bangladesh is in the final stages of establishing its first comprehensive data protection regime through the Draft Personal Data Protection Act 2023. This legislation is heavily influenced by global standards like the GDPR but includes specific provisions for the 'Smart Bangladesh' context. It centers on the concept of 'Data Custodians' and 'Data Processors,' requiring them to obtain explicit consent for data collection and to implement 'privacy by design' principles. For AI, this means that datasets used for training must be legally sourced, and high-risk processing activities will require a Data Protection Impact Assessment (DPIA) to identify and mitigate risks to individuals' rights. The act also emphasizes the right to be forgotten and the right to data portability, which are essential for maintaining consumer control in an AI-driven economy. A significant feature of the emerging framework is data localization. The draft law and related BTRC regulations contemplate requirements for certain 'restricted' or 'confidential' data categories to be stored within the geographical boundaries of Bangladesh. This has direct implications for global AI providers who rely on cross-border data flows for model training and inference. Furthermore, the framework provides data subjects with rights to access, rectification, and deletion, which AI developers must accommodate within their system architectures. The establishment of an administrative Data Protection Board will provide the necessary oversight to ensure that AI-driven profiling and automated decision-making do not violate constitutional privacy protections. This board will have the authority to investigate complaints and impose fines, creating a robust accountability mechanism for the AI ecosystem.

Sector-specific rules

AI regulation in Bangladesh is increasingly tailored to the needs of specific high-impact sectors. In the financial sector, the Bangladesh Bank has begun integrating AI considerations into its digital banking and fintech guidelines, focusing on the fairness of automated credit scoring and the robustness of fraud detection algorithms. The goal is to ensure that AI does not inadvertently exclude marginalized populations from financial services or perpetuate historical biases. Similarly, in the healthcare sector, the 2024 Policy identifies AI-assisted diagnostics and telemedicine as priorities, calling for strict data privacy safeguards and clinical validation of AI models before they are deployed in public hospitals. The Directorate General of Health Services (DGHS) is expected to play a role in certifying AI-based medical devices. The agricultural sector, a pillar of the Bangladeshi economy, is also a focus for specialized AI guidance. The government promotes 'Precision Agriculture' through a2i-led initiatives, which use AI for crop yield prediction, pest management, and soil health analysis. These applications are governed by a mix of ICT policies and agricultural standards to ensure they are accessible to smallholder farmers and do not lead to corporate monopolization of agricultural data. In the judiciary and public administration, the focus is on 'Service Simplification' (e-Nothi and the National Portal), where AI is used to automate document processing and citizen queries. These public sector deployments are subject to mandatory risk assessments under the 2024 Policy to prevent bias in administrative decision-making and to ensure that the 'human-in-the-loop' principle is maintained for all critical government services.

International alignment

Bangladesh actively seeks to align its AI governance with international norms to facilitate global partnerships and attract foreign investment. The National AI Policy 2024 explicitly references the UNESCO Recommendation on the Ethics of Artificial Intelligence, and the government has engaged with UNESCO and the UNDP for 'AI Readiness Assessments.' These assessments help align Bangladesh’s regulatory capacity with global best practices regarding ethics, workforce readiness, and infrastructure. By adopting a risk-based approach similar to the EU AI Act, Bangladesh aims to create a regulatory environment that is recognizable to international tech firms and interoperable with global digital trade standards. This alignment is intended to reduce compliance costs for multinational companies operating in the country. Furthermore, Bangladesh participates in regional forums such as SAARC and the BIMSTEC technology transfer center to discuss digital governance and shared challenges like cross-border data flows and regional cybersecurity. The country is also a signatory to various international agreements on intellectual property and cybersecurity, which inform its AI-related legal developments. While the government prioritizes national sovereignty and data localization for certain sectors, it remains committed to the 'Global Digital Compact' and other UN-led initiatives that promote an open, secure, and inclusive digital future. This international alignment is seen as crucial for the 'Smart Bangladesh' goal of increasing high-tech exports and participating in the global AI value chain, ensuring that Bangladeshi AI products can compete on the world stage.

What's next

The most significant upcoming development is the formal enactment of the Bangladesh AI Act. This legislation will provide the statutory teeth needed to enforce the principles laid out in the 2024 Policy, including the mandatory registration of high-risk AI systems and the formalization of the National AI Centre of Excellence (NAICE). Stakeholders expect the government to conduct further public consultations to refine the definitions of 'high-risk' and the scale of penalties. Additionally, the finalization of the Personal Data Protection Act is a critical milestone that will provide the necessary legal certainty for AI developers regarding data usage and cross-border transfers. The synchronization of these two major laws will define the next decade of Bangladesh's digital economy. Beyond legislation, the government is expected to launch several 'AI Sandboxes' to allow startups to test innovative solutions in a controlled regulatory environment. These sandboxes will likely focus on fintech, agritech, and healthtech, providing a pathway for rapid scaling while ensuring safety and ethical compliance. The ICT Division also plans to release sector-specific AI roadmaps for all ten priority sectors identified in the 2024 Policy, providing more granular guidance for industry players. As the 'Smart Bangladesh 2041' plan progresses, the focus will increasingly shift from foundational regulation to the deployment of large-scale AI infrastructure, including national GPU clusters and open-source datasets, to support indigenous AI research and development. This will be accompanied by massive upskilling programs to prepare the workforce for an AI-augmented labor market.