Contact usGet started

Frameworks · Bangladesh

AI laws, regulation and governance frameworks in Bangladesh

Bangladesh has no AI-specific law. It governs AI through the Personal Data Protection Act 2026, which lets people withdraw consent to automated decisions, and the Cyber Security Act 2026, which names AI agents and tools in its offences. A National AI Policy 2026-2030 is in draft. Organisations pair these with international standards such as ISO/IEC 42001 and the NIST AI RMF.

Who regulates AI here

  • National Data Management AuthoritySet up under the National Data Management Act 2026 and attached to the Prime Minister's Office, it administers the Personal Data Protection Act 2026 and issues its regulations.
  • Information and Communication Technology DivisionLeads digital policy, including the draft National AI Policy 2026-2030, and is the division the National Cyber Security Agency is attached to.
  • National Cyber Security AgencyAdministers the Cyber Security Act 2026 and runs the national computer emergency response team that organisations report cyber incidents to.
  • Bangladesh BankThe central bank, which regulates and supervises banks and financial institutions, including the technology and digital services they run.
  • Bangladesh Telecommunication Regulatory CommissionRegulates telecommunications operators and acts on content removal and blocking requests under the Cyber Security Act 2026.

Bangladesh

Bangladesh governs AI through its Personal Data Protection Act 2026, which lets people withdraw consent to automated decisions, and a Cyber Security Act that names AI agents and tools, with a National AI Policy in draft.

LawBangladesh PDPA 2026Bangladesh Personal Data Protection Act 2026 and automated decisionsBangladesh's Personal Data Protection Act 2026 as it applies to AI. Consent to automated decisions, notice, audits, breach reporting and transfers.Act No. 63 of 2026, published 10 April 2026. In force from 6 November 2025 except sections 23 and 31 to 35, which start on a date the government notifies.Public sector policyBangladesh National AI PolicyBangladesh National Artificial Intelligence Policy 2026-2030 (draft)Bangladesh's draft National AI Policy 2026-2030. Risk tiers, banned uses, algorithmic impact assessments, human review and what it means.Draft V2.0 published by the ICT Division on 9 February 2026 after public consultation. Not yet adopted.LawBangladesh Cyber Security Act 2026Bangladesh Cyber Security Act 2026 and AIBangladesh's Cyber Security Act 2026 names AI agents, AI tools and AI-generated content. Incident reporting, infrastructure duties and offences.Act No. 81 of 2026, published 10 April 2026. Treated as in force from 21 May 2025.

All Bangladesh frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Bangladesh

Frameworks elsewhere

Guides

Questions

Does Bangladesh have an AI law?

No. The Personal Data Protection Act 2026 covers AI that uses personal data, and the Cyber Security Act 2026 covers AI misuse in cybercrime. Draft V2.0 of the National AI Policy 2026-2030 says an AI law passed by Parliament could later replace the policy.

When did the Personal Data Protection Act 2026 come into force?

The Act was published on 10 April 2026 and is treated as in force from 6 November 2025, when the ordinance it replaced was issued. Section 23 on Chief Data Officers and sections 31 to 35 on complaints, fines and compensation start on a date the government sets by gazette notification after 18 months.

Does Bangladeshi law regulate automated decisions?

Yes. Section 13 of the Personal Data Protection Act 2026 lets people withdraw consent to automated decisions relating to their personal data, and bars a data fiduciary from processing personal data by automated means without informing the person.

What would the draft National AI Policy require?

Draft V2.0 proposes four risk tiers, bans on uses such as social scoring and manipulative AI, algorithmic impact assessments for public sector and high-risk AI, a right to human review of high-stakes automated decisions, and strict liability for harm from high-risk AI. It creates no obligations until adopted.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us