Iran AI Regulation Overview

Overview

The Islamic Republic of Iran's approach to artificial intelligence and digital technology governance combines high-level national policy directives, organizational statutes, and statutory frameworks covering computer crimes and digital commerce. In June 2024, the Supreme Council of the Cultural Revolution (SCCR) approved the National Artificial Intelligence Document of the Islamic Republic of Iran, establishing a comprehensive national vision, governance principles, and priority targets to position Iran among the top global AI developers. This was followed in July 2024 by the enactment of the Statute of the National Artificial Intelligence Organization (NAIO), which centralized AI strategy, technological sovereignty, data processing, and hardware infrastructure under the direct supervision of the President of Iran.

Complementing this AI strategy are established legislative acts regulating the broader digital and telecommunications environment. The Electronic Commerce Law of 2004 provides functional equivalence for electronic records, secure digital signatures, and automated transactions, while the Computer Crimes Law of 2009 penalizes unauthorized system access, interference, and digital misuse under Book Five of the Islamic Penal Code. Additionally, legislative efforts such as the 2025 Law on Combating the Spread of Untrue News Content (categorized as withdrawn) addressed synthetic misinformation, deepfakes, and algorithmic content manipulation, reflecting the state's focus on information security alongside technological development.

Regulatory Approach

Iran's regulatory philosophy relies on a top-down, state-directed model emphasizing technological sovereignty, data localization, and alignment with national ethical and security interests. High-level strategy is set by constitutional and supreme state authorities, including the Supreme Council of the Cultural Revolution (SCCR) and the Supreme Council of Cyberspace (SCC). Governance is structured through centralized executive bodies—notably the National Artificial Intelligence Organization (NAIO) and its Steering Council—working alongside line ministries to implement sectoral action plans, technical standards, and national computing infrastructure.

The regulatory design combines binding statutory prohibitions with policy frameworks and administrative controls. Binding statutory rules, such as those in the Computer Crimes Law and Electronic Commerce Law, establish legal liabilities, criminal offenses, and commercial transaction standards. Meanwhile, strategic frameworks like the National AI Document and NAIO Statute employ soft-law and policy mechanisms, including regulatory sandboxes, national research funding, licensing for knowledge-based entities, and mandatory internal integration plans for public ministries.

Key AI Legislation

• National Artificial Intelligence Document of the Islamic Republic of Iran (2024): A supra-ministerial strategy approved by the SCCR that sets national principles, priority sectors, compute infrastructure targets, and governance roles for AI development.
• Statute of the National Artificial Intelligence Organization (NAIO) (2024): An executive decree establishing the NAIO as an independent entity under the President to coordinate national AI roadmap initiatives, GPU clusters, Persian LLM projects, and regulatory sandboxes.
• Law on Combating the Spread of Untrue News Content (2025 - Withdrawn): An act targeting synthetic misinformation, deepfakes, and automated media manipulation by establishing watermarking requirements, registration rules, and platform monitoring protocols.
• Computer Crimes Law (2009): Codified into Book Five of the Islamic Penal Code, this law criminalizes unauthorized access, interception, breach of protected data, and unlawful digital content distribution.
• Electronic Commerce Law of Iran (2004): Establishes legal validity for electronic contracts, data messages, automated transactions, secure electronic signatures, and baseline digital privacy rules.

Governance & Enforcement Bodies

Policy formulation and top-level governance are shared among several high-level authorities. The Supreme Council of the Cultural Revolution (SCCR) approves macro-level strategic documents and organizational statutes, while the Supreme Council of Cyberspace (SCC) acts as the primary policy-making authority for digital affairs, defining regulatory boundaries and content guidelines. Under these councils, the National Artificial Intelligence Organization (NAIO) serves as the primary executive driver, governed by a Board of Trustees chaired by the President of Iran, an Executive Director, and a high-level Steering Council for AI.

Operational oversight and enforcement are distributed across specialized ministries and judicial bodies. The Ministry of Information and Communications Technology (ICT), the Vice Presidency for Science, Technology and Knowledge-Based Economy, and the Communications Regulatory Authority (CRA) manage technical standards, network infrastructure, and digital communications. Judicial enforcement and cyber surveillance are executed by the Cyber Police (FATA), the Specialized Court for Cybercrimes, and dedicated prosecutorial units, while commercial digital trust is overseen by the Electronic Commerce Development Center (ECDC).

Penalties & Enforcement

Enforcement of digital and computer regulations in Iran involves administrative, civil, and criminal sanctions. Under the Computer Crimes Law of 2009, violations involving unauthorized access, system interference, or the breach of protected and classified national data carry custodial sentences and monetary fines under Book Five of the Islamic Penal Code. Legal entities subject to computer crime proceedings can also face corporate administrative sanctions, including temporary operational suspension or judicial dissolution.

Administrative mechanisms are also enforced through regulatory channels. Under the Electronic Commerce Law, non-compliant digital businesses face the suspension or revocation of their e-Namad trust seals by the Electronic Commerce Development Center, cutting them off from national payment gateways. In content regulation frameworks, non-compliance can trigger bandwidth throttling, total service blocking by the Ministry of ICT, advertising bans, financial penalties, and mandatory content removal orders issued by judicial authorities.

Data Protection Framework

Iran's digital data protection framework is established through provisions within general commercial and computer legislation rather than a single unified privacy law. Article 58 of the Electronic Commerce Law of 2004 introduced statutory privacy protections by prohibiting the processing of personal data—such as health, religious, or racial information—without the explicit consent of the data subject. The Computer Crimes Law of 2009 provides further safeguards by penalizing unauthorized access to or disclosure of protected system data and classified information.

Data governance under recent AI strategy policy emphasizes data sovereignty and localized stewardship. The National AI Document (2024) and the NAIO Statute (2024) direct the state to establish secure data access frameworks and data sharing arrangements for public-interest projects. Principle data sovereignty provisions require the localization of data collection, storage, and processing within national borders, ensuring high-performance computing centers and state-supervised data repositories back the development of national AI models.

Sector-Specific Rules

Sectoral AI deployment and oversight are highlighted across priority domains specified in national policy documents. The National AI Document and NAIO Statute prioritize public interest domains including healthcare, energy, oil and gas, national power grid optimization, water management, education, defense, and public administration. Additionally, mandatory internal integration plans require individual government ministries to adopt AI applications to improve public services and administrative efficiency under NAIO technical oversight.

In the financial and media sectors, regulations establish tight informational controls. The Central Bank of Iran operates as the sole authorized arbiter of factual information regarding financial markets and currency, restricting non-sanctioned financial data dissemination. For commercial applications, the Electronic Commerce Law provides explicit legal recognition for automated transactions executed by pre-programmed software agents. The corpus holds no record of dedicated statutory regulations for autonomous vehicles or employment-specific AI applications.

International Alignment

Iran's statutory framework for digital trade incorporates selected international legal models where aligned with trade standards. The Electronic Commerce Law of 2004 was heavily modeled on the UNCITRAL Model Law on Electronic Commerce (1996), adapting concepts of functional equivalence, secure electronic signatures, and data message reliability into domestic legislation to support digital trade.

However, regarding artificial intelligence strategy specifically, the corpus holds no record of alignment with Western frameworks such as the EU AI Act or OECD AI Principles. Instead, national policy emphasizes AI sovereignty, self-reliance, domestic cloud infrastructure, Persian-language software ecosystems, and localized GPU clusters to reduce reliance on foreign AI platforms.

Future Developments

The national AI framework establishes structured multi-year targets to build national infrastructure and administrative compliance. Under the NAIO Statute (2024), all government ministries are required to submit internal AI integration plans within one year of the organization's setup. The long-term policy targets positioning Iran among the top ten global AI leaders within a decade by expanding compute capabilities, launching national cloud services, and funding innovation via the National AI Development Fund.

Key technological developments include the Persian Large Language Model (LLM) project and the rollout of physical AI Innovation Hubs and regulatory sandboxes in major technical centers like Tehran, Isfahan, and Mashhad. In digital content regulation, legislative measures continue to evolve, as seen in the 2025 Law on Combating the Spread of Untrue News Content, which remains listed as withdrawn following its enactment phase.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
National Artificial Intelligence Organization (NAIO)	Coordinates national AI strategy, infrastructure development, and policy implementation under the President	Issues licenses to AI entities, oversees compute infrastructure, sets technical standards, manages regulatory sandboxes
Supreme Council of Cyberspace (SCC)	Highest policy-making body for digital affairs and cyberspace regulation	Issues binding directives, defines content red lines, sets digital infrastructure guidelines
Supreme Council of the Cultural Revolution (SCCR)	Approves macro-level national strategy and strategic documents in cultural and technological fields	Approves national policy documents, strategic AI frameworks, and agency statutes
Cyber Police (FATA)	Executes cybercrime enforcement, digital forensics, and online security monitoring	Demands content removal, accesses uploader metadata, investigates computer crimes under the Penal Code
Electronic Commerce Development Center (ECDC)	Oversees digital commerce compliance, e-commerce trust seals, and certification service providers	Issues and revokes e-Namad trust seals, audits certification providers, restricts access to payment gateways
Communications Regulatory Authority (CRA)	Regulates telecommunications infrastructure, digital service providers, and content metrics	Determines content producer thresholds, tracks digital compliance indexes, oversees network infrastructure
National Committee for Content Verification (NCCV)	Monitors digital media content and identifies untrue or synthetic misinformation	Issues correction notices to platforms and content producers regarding prohibited or untrue news