Iraq - AI Regulatory Framework

Overview

As of early 2026, Iraq is in the midst of a significant transition toward a digital economy, with artificial intelligence (AI) positioned as a cornerstone of national reform and economic diversification. The Iraqi government's philosophy regarding AI regulation is primarily developmental and strategic, aimed at leveraging emerging technologies to modernize public administration, improve service delivery, and reduce the country's heavy reliance on oil revenues. This approach is codified in the Iraqi National Strategy for Artificial Intelligence (INSAIN) 2024–2030, which was formally reviewed and launched by the Higher Committee for Artificial Intelligence under the leadership of Prime Minister Mohammed Shia' al-Sudani in late 2024. The strategy emphasizes a 'human-centric' and 'agile' approach, seeking to balance the rapid adoption of AI with the need for ethical safeguards and national security. Iraq's journey into the realm of artificial intelligence is a pivotal component of its broader 'Iraq Vision 2030' and the 'White Paper' for economic reform. The nation has moved beyond the initial stages of digital awareness into a structured phase of implementation. The INSAIN strategy serves as the primary guiding document, reflecting a sophisticated understanding of how AI can be harnessed to address systemic issues such as bureaucratic inefficiency, resource mismanagement, and the need for economic diversification away from hydrocarbons. The strategy was born out of a necessity to modernize the state apparatus and provide the youth-heavy population with high-tech opportunities. Under the direct supervision of the Prime Minister’s Office, the strategy coordinates the efforts of various ministries to ensure that AI adoption is not siloed but integrated across the entire public sector. This top-down approach is designed to overcome traditional administrative hurdles and foster a culture of innovation within the government. The maturity of the Iraqi AI ecosystem is currently described as 'emerging but accelerating,' with a focus on building the foundational layers of data infrastructure and human capital before moving into more complex autonomous systems.

Regulatory Approach

Iraq's regulatory approach to AI is currently a hybrid of horizontal strategies and sectoral guidelines, leaning heavily toward soft law and strategic policy rather than prescriptive, binding legislation. The horizontal element is driven by the National Strategy for Artificial Intelligence and the Digital Transformation Strategy 2024–2030, which provide a roadmap for all government entities to incorporate AI into their operations. These strategies prioritize sectors such as healthcare, agriculture, water resource management, and education. The approach is inherently risk-based, particularly concerning national security and the prevention of technological exploitation by extremist groups, which remains a primary concern for Iraqi regulators given the country's unique security context. The regulatory philosophy adopted by Iraq is characterized by 'Agile Governance,' a concept promoted by international partners like the UNDP to help developing nations keep pace with rapid technological shifts. Rather than implementing rigid, static laws that might stifle innovation or become obsolete within months, Iraq has opted for a framework of strategic directives and sectoral guidelines. This approach allows the government to test AI applications in controlled environments—such as the 'AI Sandbox' initiatives planned for the financial sector—before scaling them nationally. The focus is heavily weighted toward the ethical use of AI, ensuring that algorithms do not exacerbate existing social divisions or compromise national security. The government has also emphasized the importance of 'Data Sovereignty,' requiring that critical national data be stored and processed within Iraq's borders. This risk-based approach is particularly evident in the way the government handles AI in the security and telecommunications sectors, where the potential for misuse is highest. By involving academic experts and private sector stakeholders in the policy-making process, Iraq aims to create a regulatory environment that is both protective and permissive of growth.

Key AI Legislation

While a single, omnibus AI Act is still in the legislative pipeline, several key instruments currently define the legal landscape. The Iraqi National Strategy for Artificial Intelligence (INSAIN) 2024–2030 is the most significant, providing the ethical and operational pillars for all AI-related activities. It is supported by the Digital Transformation Strategy 2024–2030, which focuses on the technical migration of government services to AI-enhanced platforms. The Electronic Signature and Transactions Law No. 79 of 2012 remains a cornerstone, as it provides the legal validity for the digital interactions that AI systems facilitate. Furthermore, the Communications and Media Commission (CMC) has issued specific regulations regarding digital content, which now include provisions for AI-generated media and deepfakes, requiring clear labeling and accountability for platforms that host such content. The Draft AI Regulation Bill, currently under review, is expected to introduce a risk-classification system similar to international models, categorizing AI applications into 'unacceptable,' 'high,' and 'low' risk, with corresponding levels of oversight and compliance requirements. This bill will also define the legal status of autonomous agents and establish a framework for algorithmic accountability, ensuring that developers and operators can be held liable for harms caused by their systems. Additionally, the government is working on a comprehensive Cybercrime Law that will address the use of AI in malicious activities, providing the legal tools necessary to prosecute those who exploit these technologies for criminal purposes.

Governance & Enforcement Bodies

The governance of AI in Iraq is centralized under the Higher Committee for Artificial Intelligence (also referred to as the Supreme Committee for AI). Established in 2024 and chaired by the Prime Minister, this body is the supreme authority for AI policy in the country. Its mandate includes approving national strategies, coordinating AI projects across ministries, and overseeing the drafting of new technological legislation. The committee serves as a bridge between the executive branch and technical experts, ensuring that AI deployment aligns with national security priorities and economic reform goals. It also manages the 'Digital Leaders' program, which aims to train high-level government officials in AI governance. Operational enforcement and technical regulation are shared between the Ministry of Communications (MoC) and the Communications and Media Commission (CMC). The MoC is responsible for the underlying digital infrastructure, including the national fiber optic backbone and data centers that host AI applications. The CMC, an administratively independent body, regulates the telecommunications and media sectors, enforcing standards related to digital content and data privacy. Additionally, the National Data Center, housed within the General Secretariat of the Council of Ministers (GSCOM), plays a critical role in data governance, managing the centralized databases that fuel AI-driven public services. The 'Digital Leaders' program is a cornerstone of the governance framework, designed to ensure that the individuals making high-level decisions about AI deployment are technically literate and ethically grounded. This program involves intensive training sessions conducted in partnership with international tech firms and academic institutions, focusing on the nuances of algorithmic bias, data security, and the socio-economic impacts of automation. By building a cadre of AI-aware civil servants, Iraq aims to reduce the risk of poorly implemented technology and ensure that AI projects are aligned with the specific needs of the Iraqi people.

Penalties & Enforcement

Enforcement of AI-related activities in Iraq currently relies on a patchwork of existing statutes, most notably the Iraqi Penal Code No. 111 of 1969. While the Penal Code does not explicitly mention artificial intelligence, its provisions regarding fraud, identity theft, and the disclosure of confidential information are applied to digital and AI-driven crimes. For instance, the unauthorized use of AI to manipulate financial records or commit fraud can lead to imprisonment and significant fines under Article 456. The judiciary has increasingly interpreted these traditional laws to encompass modern technological misuses, though officials have called for more specific 'cyber-aware' updates to the penal framework. More direct enforcement mechanisms are found in the CMC's regulatory directives and the Draft Cybercrime Law. The CMC has the power to impose administrative sanctions, including the suspension of licenses and the levying of fines against telecommunications and media companies that violate digital content or data security standards. The pending Cybercrime Law proposes much harsher penalties, including life imprisonment and fines ranging from 25 million to 50 million Iraqi Dinars (IQD) for acts that threaten national security or public order through information networks. Appeals against regulatory decisions made by the CMC are typically handled through a specialized 'Appeals Chamber' within the commission, with further recourse available through the Iraqi administrative court system. The judiciary is also undergoing a process of modernization, with specialized training for judges on the technical aspects of AI and digital evidence, ensuring that the legal system can effectively handle the complexities of 21st-century crime.

Data Protection Framework

Iraq does not yet have a comprehensive, GDPR-equivalent data protection law, although a Personal Data Protection Law has been in the drafting and consultation phase since 2021. In the absence of a standalone statute, data privacy is governed by the Iraqi Constitution of 2005, specifically Article 17, which guarantees the right to personal privacy, and Article 40, which protects the confidentiality of electronic communications. These constitutional protections are supplemented by sectoral regulations, such as the Electronic Payment Services Regulations No. 3 of 2014, which mandates that financial institutions maintain the confidentiality of customer data. The proposed Personal Data Protection Law aims to establish the Iraqi National Data Protection Authority (INDPA) and introduce modern principles such as explicit consent, data minimization, and the right to erasure. Current requirements for AI developers and data controllers often involve ad-hoc compliance with Ministry of Communications directives, particularly regarding data localization for government-related projects. The National Data Center (GSCOM) enforces strict protocols for the storage and processing of citizen data within national boundaries, reflecting a cautious approach to cloud-based AI services provided by foreign entities. The GSCOM has implemented a multi-layered security architecture to protect the centralized government databases. This includes advanced encryption standards, continuous monitoring for cyber threats, and strict access controls based on the principle of least privilege. The center also conducts regular 'stress tests' of its systems to ensure they can withstand sophisticated cyberattacks. This focus on security is essential for maintaining public trust in AI-driven government services, such as the digital ID system and the automated social safety net programs.

Sector-Specific Rules

In the Education sector, Iraq has taken proactive steps by integrating AI into the national curriculum. In 2025, the Ministry of Higher Education and Scientific Research (MOHESR) established the first dedicated College of Artificial Intelligence at the University of Baghdad. This institution operates under specific ministerial orders that mandate the development of AI applications for engineering, biomedicine, and big data analysis. These academic initiatives are governed by strict ethical guidelines to ensure that AI research is conducted responsibly and benefits the public interest. In the Financial sector, the Central Bank of Iraq (CBI) oversees the use of AI in digital payments and FinTech. Under the Iraq Banking Law and Anti-Money Laundering (AML) regulations, AI systems used for transaction monitoring and fraud detection must meet rigorous transparency and accuracy standards. The 'AI Sandbox' initiative, led by the Central Bank of Iraq, is another innovative regulatory tool. It allows FinTech startups to test AI-driven financial products in a controlled environment with relaxed regulatory requirements, under the close supervision of the CBI. This allows for the identification of potential risks—such as algorithmic discrimination in credit scoring—before the products are released to the general public. Successful participants in the sandbox may then be granted full licenses, provided they meet the rigorous standards established during the testing phase. Similarly, the Healthcare sector is a priority area under the INSAIN strategy, with pilot projects focusing on AI-driven diagnostics and resource allocation. These projects are currently managed through inter-ministerial agreements that emphasize patient data confidentiality and the clinical validation of AI tools before widespread deployment.

International Alignment

Iraq's AI regulatory strategy is heavily influenced by international standards and regional cooperation. The government actively participates in the International Telecommunication Union (ITU) and has called for the establishment of binding global standards for AI ethics under United Nations supervision. Iraq's National AI Strategy explicitly aligns its goals with the United Nations Sustainable Development Goals (SDGs), particularly Goal 9 (Industry, Innovation, and Infrastructure) and Goal 16 (Peace, Justice, and Strong Institutions). This alignment ensures that Iraq's technological growth is recognized by international development partners like the World Bank and the UNDP. Regionally, Iraq coordinates with the Arab League and the Arab ICT Organization (AICTO) to harmonize digital transformation policies across the Middle East. Iraq's participation in the AICTO is particularly noteworthy, as it involves collaborative efforts to develop Large Language Models (LLMs) that are culturally and linguistically tailored to the Arabic-speaking world. This regional cooperation is seen as a way to reduce dependence on Western-centric AI models and ensure that AI applications in Iraq are sensitive to local norms and values. While the country has not formally adopted the EU AI Act, Iraqi regulators have indicated that they are studying the European model's risk-classification system as a reference for their own pending AI legislation. Bilateral agreements, such as the Iraq-UK Higher Education Dialogue, also play a role in aligning Iraq's AI research and ethical standards with global best practices, facilitating the transfer of knowledge and the adoption of international safety protocols. Furthermore, Iraq has engaged in bilateral discussions with several European nations to learn from their experiences in implementing the EU AI Act, specifically regarding the establishment of national AI watchdogs and the creation of certification schemes for trustworthy AI.

Future Developments

The most anticipated development in the near future is the passage of a formal AI Act, which is currently being drafted by a specialized legal subcommittee under the Higher Committee for AI. This law is expected to provide a clear legal definition of AI, establish a licensing regime for AI service providers, and define the civil and criminal liabilities associated with algorithmic failures. Additionally, the government is expected to finalize the Personal Data Protection Law by the end of 2026, which will create the necessary legal infrastructure for more advanced AI applications that require large-scale processing of personal information. Other expected changes include the expansion of 'AI Labs' across all Iraqi provinces and the launch of a National AI Ethics Charter. This charter will serve as a soft-law instrument to guide developers and public officials in the responsible use of technology, focusing on transparency, non-discrimination, and human oversight. The 'National AI Ethics Charter' is expected to be a landmark document, providing a clear moral compass for the development of AI in Iraq. It will address complex issues such as the use of AI in judicial decision-making, the rights of individuals to contest automated decisions, and the responsibilities of AI developers to prevent the spread of misinformation. The charter will be developed through a series of public consultations, ensuring that it reflects the diverse perspectives of Iraqi society. As Iraq continues to improve its digital infrastructure, including the rollout of 5G services, the regulatory focus is likely to shift toward the governance of autonomous systems and the use of AI in critical infrastructure protection, reflecting the evolving nature of the country's technological and security landscape. Additionally, the government is exploring the use of AI in environmental monitoring, particularly in tracking water levels in the Tigris and Euphrates rivers and managing the impacts of climate change on agriculture, which are critical issues for Iraq's long-term stability.

Key Regulations

Enforcement Bodies