Pakistan's AI policy lacks the legal teeth to enforce rules

Ambition vs. Enforceability

Pakistan's Cabinet signed off on the National AI Policy 2025 on July 31, 2025. The document serves as a roadmap for the country's digital future, focusing on six pillars such as the AI Innovation Ecosystem and International Partnerships. It sets high-level goals like establishing a National AI Fund and creating AI Centres of Excellence at universities.

However, there is a critical distinction between a policy and a law. As Digital Pakistan reported, the current document is a statement of intent that cannot compel companies to follow specific rules or penalize developers who ignore its principles. It lacks an enforcement body with the authority to oversee the technology or provide legal claims for citizens who might be harmed by AI systems.

This gap creates a unique operating environment for the local tech scene. While there are no immediate hurdles for compliance, there are also no established rules of the road. This lack of certainty can make it difficult for startups to secure investment or plan long-term product roadmaps that might be rewritten if a strict law is suddenly enacted.

The missing data framework

A major piece of the puzzle is the absence of an enacted Personal Data Protection Act. The National AI Policy relies heavily on data protection principles, but the necessary legislation is still mired in Parliament. Without this law, there is no clear legal framework for how companies should obtain consent before training models on Pakistani users' data.

The government has attempted to move forward with various drafts, including the Personal Data Protection Bill 2023. These drafts aim to define personal data broadly and create a National Commission for Personal Data Protection. Until these pass into force, startups are left to guess at the compliance vocabulary that will eventually govern their data governance processes.

For now, enforcement of data offenses falls under existing cybercrime statutes like PECA. While these provide some protection against unauthorized disclosure, they are not designed specifically for the nuances of AI. Founders are currently advised to prepare for the laws that are coming rather than the ones that currently exist in the legal code.

Sector-specific oversight

Despite the lack of a general AI law, certain industries are already facing active regulation. The State Bank of Pakistan (SBP) and the Securities and Exchange Commission of Pakistan (SECP) are already issuing rules that affect AI products in the financial sector. These include frameworks for algorithmic trading and mandatory cybersecurity audits for licensed banks and digital wallets.

In 2026, the SBP and SECP issued Circular No. BPRD/CSD/2026/09, which requires data residency audits and incident response certifications by Q4 2026. This means that if an AI product is embedded within the financial services stack, it must already comply with these specific rules regardless of the broader AI policy. These regulators are moving faster than the general legislative process.

Additionally, the Pakistan Telecommunication Authority (PTA) governs data for telecom and ISP services. Any AI tool that utilizes customer traffic patterns or works with a licensed operator must adhere to PTA's existing licensing conditions. These sector-specific requirements create a patchwork of rules that developers must navigate while waiting for a unified national AI law.

Public data and localization

A new draft National Data Governance Policy released in June 2026 provides a preview of future government standards. This policy focuses on public bodies, stating that "Public bodies are custodians, not proprietors" of data. It introduces the "once-only" principle, where citizens should not have to submit the same information to the government more than once.

The policy also proposes a National Data Exchange called WASL to allow federal agencies to share information securely. It suggests a risk-based approach for the government's use of AI, requiring more oversight for systems that have significant effects on citizens. This signals a move toward a more organized, though still developing, digital public infrastructure.

One important detail for startups is the proposed data localization principle. The draft suggests that sensitive government and personal data should generally remain hosted and processed within Pakistan. If this principle eventually expands to the private sector, it could significantly impact startups that currently rely on offshore cloud infrastructure for training and hosting their AI models.

Unresolved risks and harms

The current regulatory vacuum leaves several high-risk issues unaddressed by the law. There is no legal mechanism to determine who is responsible if an AI system makes a wrong credit decision or misidentifies someone in a facial recognition system. The policy mentions fairness as a value but does not create any obligation to test for bias or provide a remedy for those harmed by it.

Real-world harms are already being documented in the country. Reports show women being targeted by AI-generated deepfakes and AI-fueled disinformation being used to exacerbate sectarian violence. Because there is no specific legal instrument for synthetic media, these harms currently lack a dedicated legal remedy or clear prohibition on distribution.

The proposed AI Directorate within the National AI Policy currently has no defined legal status or enforcement power. Until a formal law is passed, the government's goals for a secure AI ecosystem remain aspirational. For now, the responsibility for ethical AI largely falls on the developers themselves, as the state lacks the tools to mandate it.