Bangladesh Cyber Security Act 2026 and AI

What it is

The Cyber Security Act 2026, Act No. 81 of 2026, is Bangladesh’s main cybersecurity and cybercrime law. It re-enacts the Cyber Security Ordinance 2025 issued by the interim government, and is treated as in force from 21 May 2025. Section 50 repeals the Cyber Security Act 2023, and section 51 repeals the 2025 ordinance.

The Act sets up the National Cyber Security Agency, the national computer emergency response team and the National Cyber Security Council. It lets the government declare critical information infrastructure, and it defines cyber offences and the tribunals that try them.

Who it applies to

The Act applies to anyone who commits an offence under it in Bangladesh. Section 4 extends it to Bangladeshi citizens offending abroad, to people outside Bangladesh who commit an offence inside the country using a computer, system, network or device located there, and to offences committed from Bangladesh against targets abroad. Its incident reporting duty applies to every government, private and autonomous body or institution. Its infrastructure duties apply only to systems the government has declared critical.

What it requires

The Act names AI in a way most cyber laws do not. The definitions in section 2 include AI software agents, large language models and AI tools in what counts as data and digital devices, cover AI-generated data within cyberspace, and include developers of AI virtual agents among service providers. Several offences then reach acts done with AI.

• Hacking critical infrastructure. Section 17 makes it an offence for a person, software developer or AI tool user to access critical information infrastructure unlawfully, including generating new data through an AI agent.
• Unlawful access and damage. Section 18 covers unlawful access to computers and systems, including producing new data through an AI agent after hacking in.
• Forgery. Section 21 defines cyber forgery to include acts by a person or an AI agent.
• Harmful content. Section 25 covers sending or publishing content made or edited by AI for blackmail, sexual harassment, revenge porn, child sexual abuse material or sextortion.

For organisations, the duties that matter are these.

• Incident reporting. Section 9(4) requires any government, private or autonomous body where a cyber incident occurs to inform the national computer emergency response team without delay.
• Critical infrastructure. Section 9(2) requires each declared critical information infrastructure to run its own computer emergency or incident response team and security operations centre, reporting quarterly to the national security operations centre. Section 16 requires an annual internal and external audit reported to the Council and allows the Agency’s Director General to inspect.
• Content removal. Section 8 lets the Director General remove or block content that threatens cybersecurity, or ask the telecoms regulator to do so, with the tribunal’s permission needed within three days.
• Company liability. Section 29 sets out how the Act applies where a company commits an offence.

Key dates

• 21 May 2025. Cyber Security Ordinance 2025 takes effect. The Act is treated as in force from this date.
• 10 April 2026. Cyber Security Act 2026 published, alongside the Personal Data Protection Act 2026 and the National Data Management Act 2026.
• 30 June 2026. Parliament passes a Cyber Security (Amendment) Bill. It is aimed at faster removal of harmful AI-generated content from social media, requires platforms to take down disputed content within a set time and updates the definitions of misinformation and defamation with stiffer penalties.

Further amendments were reported in draft from July 2026, including higher penalties for defamatory content made with AI and a new offence of spreading rumours or disinformation online. Check the Laws of Bangladesh portal for the text in force.

How it relates to other frameworks

The Act and the Personal Data Protection Act 2026 each have their own reporting route. A security incident goes to the national computer emergency response team under this Act. A personal data breach likely to cause significant harm goes to the National Data Management Authority under the data protection law. An AI incident can trigger both, so an incident response process should check each one.

Bangladesh’s draft National AI Policy relies on this law to hold people accountable for harmful AI use. Security testing of AI systems, red teaming and giving each AI agent its own identity and scoped access all help an organisation show it controls how its AI reaches its systems and data.

A note on this page

This is Aicura’s reading of the Act as first published, translated from the Bangla text on the Laws of Bangladesh portal. It is not legal advice and it is not the law itself. Read the primary source and take advice on how the Act applies to your organisation.