Bangladesh AI Regulation Overview

Overview

Bangladesh has embarked on establishing a comprehensive regulatory and institutional framework for artificial intelligence, aligning technology adoption with its broader national development and digital transformation agendas. Driven primarily by the Information and Communication Technology (ICT) Division of the Ministry of Posts, Telecommunications and Information Technology, the country's AI approach has progressed from strategic guidance toward institutionalization and risk-based policy formulation.

The regulatory foundation was initially set by the National Strategy for Artificial Intelligence in 2020, which articulated a five-year roadmap to leverage AI across priority socio-economic sectors. This was complemented by statutory measures, notably the Agency to Innovate (a2i) Act 2023, which established a permanent autonomous national innovation agency to drive public sector digital modernization. The governance model further advanced with the publication of the draft National Artificial Intelligence Policy 2024, which proposes centralized governance structures, risk-based classification of AI systems, and core ethical principles to guide public and private sector deployments.

Regulatory Approach

Bangladesh's AI regulatory framework currently relies on non-binding policy guidance and institutional enabling laws, with plans to transition toward binding statutory regulation. The 2020 National Strategy for AI established foundational strategic pillars, while the draft National Artificial Intelligence Policy 2024 introduces a structured, risk-based oversight model designed to balance technological innovation with public interest safeguards.

Under the draft 2024 policy, AI systems are categorized by potential impact, placing stricter requirements on "high-risk" applications. Systems that affect fundamental rights, judicial processes, biometric identification, law enforcement, or critical infrastructure are subject to enhanced oversight, mandatory impact assessments, model documentation, data governance protocols, and continuous human oversight. The government has signaled that this policy framework will be operationalized through subsequent legislation, specifically a dedicated AI Act currently contemplated by the Ministry of Law, Justice and Parliamentary Affairs.

Key AI Legislation

• National Artificial Intelligence Policy 2024 (Draft): Formulated by the ICT Division, this policy establishes six core principles—social equity, transparency, safety, sustainability, partnership, and human-centered AI—and proposes a risk-based classification framework alongside specialized institutional bodies.
• Agency to Innovate (a2i) Act 2023: Statutory legislation that created an autonomous national innovation agency to institutionalize digital public service innovation, manage digital public goods, support public research R&D, and protect intellectual property.
• Cyber Security Act, 2023: Enacted to replace the Digital Security Act 2018, this statute protects critical information infrastructure, criminalizes cyber offences (including misuse of AI tools), and empowers a central Cyber Security Agency to oversee incident response and compliance.
• Digital Security Act, 2018 (Repealed): Former foundational statute regulating digital crimes, system integrity, and critical information infrastructure protection before being superseded by the Cyber Security Act 2023.
• National Strategy for Artificial Intelligence: Bangladesh (2020): Strategic blueprint outlining six national pillars and a phased five-year roadmap (2020–2024) to accelerate AI adoption in key socio-economic sectors.
• BTRC Regulation for Digital, Social Media and OTT Platforms (Draft 2022): Regulatory framework drafted by the Bangladesh Telecommunication Regulatory Commission to establish local registration, content moderation, data retention, and messaging traceability requirements for online intermediaries.

Governance & Enforcement Bodies

Central governance for AI policy in Bangladesh is led by the ICT Division within the Ministry of Posts, Telecommunications and Information Technology. To execute policy-level directives, the draft National Artificial Intelligence Policy 2024 proposes creating the National Artificial Intelligence Centre of Excellence (NAICE) to act as a central hub for coordination, standardization, model documentation, and capacity building. Strategic direction is to be guided by a multistakeholder National AI Advisory Council comprising senior representatives from relevant ministries, regulatory agencies, security bodies, academia, and industry associations.

Additional specialized statutory entities manage specific components of the digital and security ecosystem. The Agency to Innovate (a2i), governed by a 15-member board chaired by the ICT Minister, oversees public sector digital innovation and platform stewardships. Cybersecurity compliance, critical infrastructure monitoring, and cybercrime enforcement fall under the jurisdiction of the Cyber Security Agency (reconstituted under the Cyber Security Act 2023), while telecommunications and digital platform governance are regulated by the Bangladesh Telecommunication Regulatory Commission (BTRC).

Penalties & Enforcement

Enforcement mechanisms in Bangladesh's AI and digital regulatory landscape vary depending on the underlying statute and regulatory instrument. The Cyber Security Act 2023 enforces compliance through administrative directives, technical audits, and criminal penalties, including non-bailable offences and substantial fines for attacks against Critical Information Infrastructure or severe cyber offenses. The draft BTRC Regulation for Digital, Social Media and OTT Platforms contemplates administrative fines, blocking orders, and content removal mandates with strict 72-hour compliance windows for non-compliant intermediaries.

For administrative and institutional governance, the Agency to Innovate (a2i) Act 2023 relies on financial management rules, audited accounts, and administrative oversight. The draft National Artificial Intelligence Policy 2024 itself does not contain binding penalty scales or registration thresholds; instead, it explicitly delegates precise enforcement provisions, penalty frameworks, and statutory liabilities to follow-on implementing regulations and the forthcoming AI Act.

Data Protection Framework

Data governance and privacy requirements within the AI landscape are currently articulated through policy principles and cyber security mandates. The draft National Artificial Intelligence Policy 2024 outlines essential data governance safeguards for AI model training and deployment, emphasizing data minimization (especially regarding sensitive data), lawful processing bases, consent mechanisms, and robust cybersecurity protocols to protect user privacy.

Complementary data handling and retention rules exist in related digital instruments. The Cyber Security Act 2023 sets obligations to protect personal data during investigative and security operations, while the draft BTRC regulations mandate specific user metadata retention periods (such as 180 days) for digital and OTT platforms. Where specific standalone data protection acts or GDPR-equivalent statutory regimes are referenced in policy proposals, the provided corpus holds no record of fully enacted dedicated data protection statutes.

Sector-Specific Rules

Sector-specific AI deployment priorities are articulated across seven key domains highlighted in the 2020 National Strategy and expanded in the 2024 draft policy. Priority sectors include smart public services and judiciary (AI-assisted legal research and case management), healthcare (diagnostics, patient monitoring, and telemedicine with privacy safeguards), finance and trade (fraud detection, credit scoring with fairness checks), and agriculture (precision farming and yield prediction).

Other focus areas encompass telecommunications, data governance, smart mobility, manufacturing, education, and climate resilience. Each sector is tasked with developing tailored risk mitigation measures, operational roadmaps, and domain-specific safeguards. However, detailed statutory regulations or binding sector-specific mandates for emerging technologies like autonomous vehicles are not contained within the current record corpus.

International Alignment

Bangladesh's AI strategic and policy initiatives actively align with global ethical frameworks and international best practices. The development and validation of the draft National Artificial Intelligence Policy 2024 involved structured engagements with international bodies, including UNESCO and UNDP, to conduct AI readiness assessments and align policy principles with global ethical AI recommendations.

The strategic framework also draws on international standards regarding human-centered AI, ethical considerations, and technical interoperability. National policies prioritize capacity-building partnerships with global institutions, alignment with international standards for research and innovation, and benchmarking national metrics against global cybersecurity and AI governance norms.

Future Developments

The near-term trajectory of AI regulation in Bangladesh centers on formalizing policy guidelines into binding legislation. The Ministry of Law, Justice and Parliamentary Affairs has signaled plans for a dedicated AI Act to operationalize the draft National Artificial Intelligence Policy 2024 and provide statutory legal backing for AI risk management, safety standards, and enforcement.

Key future milestones include the official onboarding and finalization of the National AI Policy (with target timelines extending into 2025), the formal establishment of the National Artificial Intelligence Centre of Excellence (NAICE), the activation of the National AI Advisory Council, and the potential adoption or revision of digital platform regulations overseen by the courts and regulatory bodies.

Enforcement Bodies