Pakistan - AI Regulation (2024)

Overview

The Regulation of Artificial Intelligence Bill, 2024 was introduced in Pakistan’s Senate in September 2024. It seeks to create an institutional framework centred on an Artificial Intelligence Commission responsible for registration, oversight, monitoring and enforcement of AI-related activity in Pakistan. The Senate bill summary notes receipt of notice on 9 August 2024 and introduction and reference to committee on 9 September 2024. Discussion in the Senate Standing Committee on IT & Telecom and reporting by national press indicate the bill advances principles familiar from international AI governance approaches — risk classification, transparency obligations, human oversight and heavy administrative penalties for breaches. For the official summary, see the Senate Bill Summary (Regulation of Artificial Intelligence Bill, 2024) and for ministry-level policy context consult the Ministry of Information Technology & Telecommunication (MoITT) site.

Definitions

The bill defines foundational and operational terms to delimit coverage and obligations: "artificial intelligence" (broadly covering software systems using statistical, machine learning, or other algorithmic approaches to make or assist decisions), "AI system provider" (entities that develop, train, produce, distribute or market AI systems), "deployers" or "operators" (bodies that place systems into operation), "high-risk system" (systems whose failure or misuse could significantly harm individuals or public interest), "data controller/processor" (for alignment with data protection frameworks), and the "Artificial Intelligence Commission" (the proposed regulator). Definitions also address "automated decision-making", "model provenance", "dataset provenance" and "human oversight" to create enforceable duty constructs in the clauses that follow.

Governance and Institutional Framework

The legislative text proposes creation of an Artificial Intelligence Commission (AIC) with a chairperson and members (media accounts indicate a chair plus four members in early drafts) to: (a) register AI providers and relevant systems; (b) set technical standards and guidelines; (c) maintain an AI Regulation Fund to finance operations; (d) adjudicate complaints and initiate enforcement action; and (e) coordinate with sectoral regulators such as the Pakistan Telecommunication Authority and financial regulators. The commission is empowered to require conformity assessment, to order audits and inspections, and to issue administrative sanctions. Interim governance responsibilities are expected to involve the Ministry of IT & Telecom and other ministries for cross-cutting policy. See the Senate bill summary at Senate Bill Summary and MoITT policy materials at MoITT for related institutional developments.

Key Focus Areas

The bill’s substantive obligations cluster around: risk management and mandatory algorithmic impact assessments for systems that may materially affect rights or safety; transparency and documentation (including model cards, dataset documentation and public notices for automated decision-making); data protection alignment (mandating compliance with national data-protection law and data minimisation); human oversight and redress (mechanisms for human review of high-impact decisions and channels to lodge complaints with the commission); safety testing, conformity assessment and certification for high-risk systems; cybersecurity and model-security requirements (secure training data, access controls and incident response); sectoral coordination for healthcare, finance, telecommunications and public services to handle domain-specific risks; market surveillance and post-deployment monitoring; and enforcement measures including fines and remedial orders. These focus areas mirror global AI-regulatory trends while being tuned to Pakistan’s institutional landscape as reported by national press and Senate proceedings (Senate Bill Summary, ProPakistani summary).

Implementation Framework

Implementation envisages phased obligations: an initial registration roll-out, development of rules and standards by the AIC, creation of a certification/conformity pathway for high-risk systems (including third-party testing), and development of sectoral memoranda of understanding with other regulators. The bill describes an AI Regulation Fund to support commissioning of audits and technical capability building. Operational implementation depends on delegated rule-making powers, published compliance guidances and capacity-building by MoITT and the AIC. The Ministry’s parallel national AI policy consultation process is expected to support harmonised implementation across government and industry. See MoITT and media coverage of committee deliberations for implementation commentary.

Monitoring and Evaluation

The bill creates reporting obligations for deployers and a complaints mechanism allowing individuals to report harms to the AIC. Monitoring tools include required record-keeping, periodic compliance reports, and incident notifications for cybersecurity compromises or algorithmic harms. The Commission will have inspection and market-surveillance functions and is expected to publish periodic compliance reports and enforcement statistics to measure effectiveness. Independent evaluation is contemplated via mandated impact reviews and possible collaboration with academic and civil-society stakeholders to audit outcomes in sensitive domains.

Penalties, Liability, and Appeals

The draft contemplates administrative fines (media reports reference ranges up to PKR 1.5–2.5 billion for severe breaches in early summaries), suspension or blocking of non-compliant services, and referral for criminal investigation where offences involve classified or sensitive data misuse. The bill provides for administrative proceedings by the Commission with regulated parties’ right of appeal to the High Court or other judicial fora as specified. Penalty quantum, procedural safeguards, and appeal timelines remain subject to committee modification during clause-by-clause review (ProPakistani, Dawn reporting).

Relationship to Other Instruments

The bill is intended to operate alongside Pakistan’s emerging data-protection and digital-governance instruments, including the proposed Personal Data Protection Bill and the Ministry of IT & Telecom’s national AI policy. It mandates coordination with sectoral regulators (telecom, financial, health regulators) to avoid regulatory gaps and overlapping jurisdiction. The draft instructs alignment of confidentiality, national security and privacy safeguards with existing laws such as PECA and any enacted data-protection statute.

International Alignment

The draft bill draws on international regulatory practice (risk-based approaches, transparency obligations and certification regimes). It signals the government’s intent to align with emerging global standards while preserving national priorities — for example, data localisation for sensitive datasets and coordination with foreign regulators for cross-border AI supply chains. The bill’s architecture mirrors reforms in other jurisdictions prioritising human oversight, safety testing and conformity assessment for high-risk AI applications.

Implementation Timeline

Sources and References