Contact usGet started

Frameworks · Pakistan

AI laws, policy and governance frameworks in Pakistan

Pakistan has no AI-specific law and no comprehensive data protection law in force. It governs AI through the National AI Policy 2025, approved by the federal cabinet on 30 July 2025, with a draft National Data Governance Policy that would set risk-tiered AI rules for federal public bodies. Organisations pair these with international standards such as ISO/IEC 42001 and the NIST AI RMF.

Who regulates AI here

  • Ministry of Information Technology and TelecommunicationLeads national AI and digital policy, issued the National AI Policy 2025 and prepared the draft National Data Governance Policy and Personal Data Protection Bill.
  • Pakistan Digital AuthorityEstablished under the Digital Nation Pakistan Act 2025, and named to issue and oversee the National Data Governance Policy, including its rules for AI in federal public bodies.
  • State Bank of PakistanRegulates and supervises banks, microfinance banks and payment operators, and has said guidelines on the responsible use of AI in financial services are at an advanced stage.
  • Securities and Exchange Commission of PakistanRegulates the corporate sector, capital markets, insurers and non-bank finance companies, so it is the regulator their use of AI answers to.

Pakistan

Pakistan governs AI through a national AI policy approved in 2025, with a draft data governance policy that would set AI rules for federal public bodies and no data protection law yet in force.

Public sector policyNational AI Policy 2025Pakistan National Artificial Intelligence Policy 2025Pakistan's National AI Policy 2025, approved by the cabinet on 30 July 2025. Its six pillars, human oversight, a public AI register and impact assessments.Approved by the federal cabinet on 30 July 2025. A policy, not legislation.Public sector policyNational Data Governance Policy (draft)Pakistan National Data Governance Policy 2026 (draft) and AIPakistan's draft National Data Governance Policy 2026 sets risk-tiered AI rules for federal bodies. Human review, ADM registry, residency and contractors.Draft released 26 June 2026. Consultation closed and MoITT moved to finalise it in August 2026. Takes effect on issuance by the Pakistan Digital Authority after cabinet approval and Gazette notification.

All Pakistan frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Pakistan

Frameworks elsewhere

Guides

Questions

Does Pakistan have an AI law?

No. The National AI Policy 2025 is a policy approved by the federal cabinet, not legislation. The Regulation of Artificial Intelligence Bill 2024, a private member's bill introduced in the Senate on 9 September 2024, stands withdrawn from the committee after the committee neither passed nor rejected it.

Does Pakistan have a data protection law?

Not a comprehensive one in force. A Personal Data Protection Bill prepared by the Ministry of IT and Telecommunication remains in draft. The Prevention of Electronic Crimes Act 2016 is a cybercrime law rather than a privacy framework, and Article 14 of the Constitution protects privacy.

What is the National Data Governance Policy?

A draft policy released by MoITT on 26 June 2026 for governing public-sector data. It would apply to federal public bodies and their contractors, set residency tiers for government data, and require registration, explainability, drift monitoring and human review on request for high-risk AI. MoITT moved to finalise it in August 2026, and it takes effect after cabinet approval and Gazette notification.

Who is responsible for AI policy in Pakistan?

The Ministry of Information Technology and Telecommunication leads national AI policy, and an AI Council chaired by the Federal Minister for IT and Telecom oversees the National AI Policy. The Pakistan Digital Authority would oversee the AI rules in the draft National Data Governance Policy.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us