Governing AI in Pakistan before the data protection law arrives

Pakistan’s AI rules are arriving in pieces, and none of the main pieces is a statute yet. There is a national AI policy, a draft data governance policy for government, a data protection bill still in draft and a central bank guideline still being finalised. For an organisation using AI in Pakistan, the sensible response is to build the governance record those instruments all assume, because each of them asks for some version of the same things.

What governs AI in Pakistan today

There is no AI Act. The Senate’s Regulation of Artificial Intelligence Bill 2024, a private member’s bill introduced on 9 September 2024, stands withdrawn from the committee after the committee neither passed nor rejected it.

There is no comprehensive data protection law in force either. A Personal Data Protection Bill has been drafted by the Ministry of Information Technology and Telecommunication (MoITT), and the government’s own policies refer to it as anticipated, but it has not been enacted. The Prevention of Electronic Crimes Act 2016, amended in 2025, deals with cybercrime rather than how organisations should handle personal data. Article 14 of the Constitution protects privacy, and government policy treats it as the anchor for any processing of personal data by the state.

What does exist is policy. The National AI Policy 2025, approved by the federal cabinet on 30 July 2025, commits the government to human oversight of critical AI operations, a public register of public sector AI systems, lifecycle evaluations and impact assessments for high-impact systems, and audits with redress for unwarranted outcomes. It also proposes an AI Directorate to issue regulatory guidelines, starting with generative AI. In February 2026 the government added the Islamabad AI Declaration, whose principles include human accountability under constitutional authority and explainable, auditable and safe AI.

What is coming for government and its suppliers

The draft National Data Governance Policy 2026 is the most concrete instrument on the horizon. MoITT released it on 26 June 2026, consultation closed on 10 July, and in August MoITT moved to finalise it with the Pakistan Digital Authority. It takes effect once the Pakistan Digital Authority issues it after cabinet approval and Gazette notification.

It would apply to every federal public body and to every contractor, processor and partner that handles government data for them. For AI, clause 14 sets a risk-tiered approach. High-risk uses, including any with legal or similarly significant effects on people, would need five things.

• registration before going into production
• model accountability and explainability suited to the use
• drift monitoring and post-deployment review
• meaningful human review on request, with contestability and redress
• an entry in a public registry describing the system’s purpose, data inputs and decision logic

The residency rules matter just as much for suppliers. Restricted, confidential and personal government data would generally have to be hosted and processed in Pakistan, and internal data could go offshore only with prior approval from the Pakistan Digital Authority. A supplier needs to know which tier of data each of its AI systems touches.

What is coming for banks and other financial institutions

The State Bank of Pakistan said in its Financial Stability Review 2024 that its Guidelines on the Responsible Use of Artificial Intelligence in Financial Services were at an advanced stage of finalisation, with the aim of fostering trust, transparency and accountability while safeguarding consumers. The same review reported that about half of the regulated entities in the SBP’s first survey on AI had deployed AI in financial services or were developing it, for fraud detection, customer service, marketing, credit risk assessment and process automation.

The review named the risks the SBP is watching. Those are operational failures, cyber-attacks, dependence on a few key vendors, correlated behaviour from similar models in markets, and discriminatory treatment of customers through algorithmic bias. A bank that can show which AI it runs, which vendors supply it, how it tests for bias and who reviews credit decisions will be well placed when the guidelines are issued.

What to do now

The instruments differ in status, but they ask for the same foundations. Five steps cover most of it.

1. Build an inventory. Record every AI system and agent, its owner, its purpose, the data it uses and the vendor behind it. The public register in the AI policy and the pre-production registration in the draft data governance policy both start here. Our guide to building an AI system register sets out the fields.
2. Find the decisions that matter. Mark which systems make or shape decisions with legal or similarly significant effects on people, such as credit, hiring, benefits or access to services. Those are the high-risk uses under the draft policy and the obvious focus of the SBP’s bias concern.
3. Assess them. Run an AI impact assessment on each high-risk system, covering who is affected, what could go wrong and what mitigations are in place. The draft policy’s Privacy Impact Assessment trigger covers profiling and automated decisions, so the same work serves both.
4. Keep a person in the loop that counts. For each high-risk system, decide who can review a decision on request and how a person challenges it. The draft policy says oversight must be substantive, not merely formal.
5. Pin down your vendors. Know where each AI vendor processes data, what it does with it and whether it trains on it. Our guide to vendor AI risk covers the questions. If you supply government, map each system to the residency tier of the data it touches.

When the data protection law and the SBP guidelines arrive, an organisation with this record will be adjusting it, not starting from nothing. Structuring the work on ISO/IEC 42001 also lines it up with the AI policy’s commitment to align Pakistan’s AI rules with international standards.

A note on this page

This is Aicura’s reading of Pakistan’s published policies and the SBP’s Financial Stability Review as of 18 October 2026. It is not legal advice. Several of these instruments are drafts and will change, so check the primary sources and take advice on how they apply to your organisation.