Pakistan AI Regulation Overview

Overview

Pakistan's national governance framework for artificial intelligence and digital transformation relies on a combination of strategic executive policies and recently enacted federal statutes. The centerpiece of the country's AI strategy is the National Artificial Intelligence Policy 2025 (National AI Policy), approved by the Federal Cabinet in July 2025. Formulated by the Ministry of Information Technology & Telecommunication (MoITT), the policy establishes a national roadmap structured around six strategic pillars: AI Innovation Ecosystem, Awareness & Readiness, Secure & Trustworthy AI, Transformation & Evolution, AI Infrastructure, and International Partnerships. It establishes ambitious goals, including training one million AI professionals by 2030, supporting 1,000 local AI products, and deploying 50,000 civic AI projects.

Alongside executive guidance, Pakistan has established statutory institutions to supervise national digital infrastructure and online content. The Digital Nation Pakistan Act, 2025 (Act No. I of 2025), enacted in January 2025, creates an institutional framework to execute the National Digital Masterplan and manage Digital Public Infrastructure (DPI). Concurrently, the Prevention of Electronic Crimes (Amendment) Act, 2025 (Act No. II of 2025) expanded state oversight over online communication and created specialized cybercrime and regulatory authorities. These 2025 developments build upon earlier strategic baselines, including the Digital Pakistan Policy (2018), National Cyber Security Policy 2021, Pakistan Cloud First Policy (2022), and the Presidential Initiative for Artificial Intelligence & Computing (PIAIC).

Regulatory Approach

Pakistan adopts a hybrid regulatory approach combining policy-driven soft law with focused statutory oversight. The National AI Policy 2025 serves as non-binding administrative guidance designed to accelerate adoption while fostering trustworthy AI development. Rather than imposing immediate rigid legislative mandates across all AI applications, the policy prioritizes regulatory sandboxes for supervised testing, risk-based impact assessments, and sectoral implementation roadmaps. It distinguishes high-risk applications—such as those used in healthcare diagnostics, critical infrastructure, social services, law enforcement, and financial decisions—which require conformity and safety evaluation pathways.

For public sector systems and foundational digital platforms, binding obligations are established through enabling statutes. Under the Digital Nation Pakistan Act, 2025, federal and provincial government entities, state-owned enterprises, and private-sector partners must adhere to technical standards, interoperability protocols, and data governance policies issued by the newly created Pakistan Digital Authority. Similarly, digital communications and platform operations face statutory requirements under PECA 2025. While standalone private members' proposals like the Regulation of Artificial Intelligence Bill, 2024 sought to establish a dedicated, highly prescriptive legislative regime, executive authorities have emphasized an ecosystem-first, policy-led trajectory supported by sectoral regulators.

Key AI Legislation

• Digital Nation Pakistan Act, 2025 (Act No. I of 2025): Federal statute assented to on 29 January 2025 that establishes a three-tier governance framework comprising the National Digital Commission, the Pakistan Digital Authority, and an Oversight Committee to direct national digital transformation, manage Digital Public Infrastructure (including the Pakistan Stack and WASL data exchange layer), and issue binding technical and data governance standards.
• National Artificial Intelligence Policy 2025: Comprehensive national strategy approved by the Federal Cabinet on 30 July 2025 framing national AI goals around six pillars, establishing a National AI Fund (NAIF), creating regional Centres of Excellence, and introducing regulatory sandboxes and risk management guidelines for high-risk applications.
• Prevention of Electronic Crimes (Amendment) Act, 2025 (Act No. II of 2025): Enacted on 29 January 2025 to amend PECA 2016, establishing the Social Media Protection and Regulatory Authority, the National Cyber Crime Investigation Agency (NCCIA), and the Social Media Protection Tribunal while inserting Section 26A criminalizing intentional false or fake online information.
• Regulation of Artificial Intelligence Bill, 2024: Private members' bill introduced in the Senate in September 2024 proposing an Artificial Intelligence Commission, mandatory registration of providers and systems, algorithmic impact assessments, and administrative penalties; currently pending or under committee consideration.
• Pakistan Cloud First Policy (2022): Government-wide policy requiring federal Public Sector Entities to prioritize accredited cloud services, introducing a five-tier data classification system, and establishing a Cloud Office and Cloud Board within MoITT.
• National Cyber Security Policy 2021: Strategic framework establishing active cyber defense protocols, critical information infrastructure protection, and the Cyber Governance Policy Committee alongside PKCERT.
• Digital Pakistan Policy (2018): Cabinet-approved policy setting foundational goals for national connectivity, public sector digitization, IT export incentives, and legal modernization.
• Presidential Initiative for Artificial Intelligence & Computing (PIAIC): Nationwide executive capacity-building program launched in 2018 providing certified education in AI, data science, cloud-native computing, and IoT.

Governance & Enforcement Bodies

Institutional oversight of AI and digital policy in Pakistan is distributed among executive committees, statutory authorities, and administrative bodies. At the policy and strategic level, the National Digital Commission (NDC)—chaired by the Prime Minister—and the AI Council—chaired by the Federal IT Minister—provide high-level direction across federal and provincial jurisdictions. The Ministry of Information Technology & Telecommunication (MoITT) serves as the primary executive organ responsible for drafting policy instruments, managing national programs, establishing regional AI Centres of Excellence, and operating the Cloud Board and Cloud Office under the Pakistan Cloud First Policy.

Operational execution and statutory enforcement are led by specialized authorities created under 2025 legislation. The Pakistan Digital Authority (PDA) functions as an autonomous statutory body tasked with executing the National Digital Masterplan, setting technical standards for Digital Public Infrastructure, evaluating major public digital projects, and managing the Digital Nation Fund. Content regulation and cybercrime enforcement fall under the Social Media Protection and Regulatory Authority and the National Cyber Crime Investigation Agency (NCCIA), the latter replacing the former cybercrime wing of the Federal Investigation Agency (FIA). Specialized appellate mechanisms, such as the Social Media Protection Tribunal, handle administrative challenges against regulatory orders.

Penalties & Enforcement

Enforcement capabilities and penalty structures vary across Pakistan's regulatory instruments. Statutory cybercrime and platform regulation under the Prevention of Electronic Crimes (Amendment) Act, 2025 include explicit criminal and administrative sanctions. Section 26A of the Act introduces a criminal offence for the intentional dissemination of false or fake information likely to cause fear, panic, disorder, or public unrest, punishable by imprisonment for up to three years, a fine of up to two million rupees, or both. Additionally, the Social Media Protection and Regulatory Authority is empowered to issue expedited removal or blocking directives within 24 hours, impose administrative fines, and suspend or revoke operating licences of non-compliant social media platforms.

In contrast, Pakistan's policy instruments—including the National AI Policy 2025, National Cyber Security Policy 2021, and Cloud First Policy—do not directly impose statutory criminal or civil fines. Instead, compliance is enforced through administrative mechanisms, eligibility requirements for public procurement, cloud accreditation procedures, and subordinate regulations promulgated by sectoral regulators such as the Pakistan Telecommunication Authority (PTA) and the State Bank of Pakistan (SBP). Appeals against administrative decisions of the Social Media Protection and Regulatory Authority are heard by the Social Media Protection Tribunal, with further rights of appeal to the Supreme Court of Pakistan within 60 days.

Data Protection Framework

Pakistan's legal framework for data governance is currently characterized by targeted policy directives and public-sector regulations, while statutory personal data protection legislation remains pending. Existing policy instruments, such as the Digital Pakistan Policy (2018) and the National AI Policy 2025, explicitly highlight the necessity of an enacted Personal Data Protection Act to provide baseline safeguards for individual privacy and fundamental rights alongside expanding public-sector digitization and automated decision-making.

In the absence of a consolidated standalone data protection statute, data handling and security baselines are established through sector-specific frameworks. The Pakistan Cloud First Policy (2022) introduces a mandatory five-tier data classification model (Open, Public, Restricted, Sensitive/Confidential, and Secret), defining strict deployment baselines and contractual protections for federal Public Sector Entities and accredited Cloud Service Providers. Furthermore, the Digital Nation Pakistan Act, 2025 mandates that data exchange across public bodies and private partners via the central WASL platform conform to strict data governance, security, and interoperability protocols defined by the Pakistan Digital Authority.

Sector-Specific Rules

Rather than establishing uniform cross-sector restrictions, Pakistan's National AI Policy 2025 promotes tailored sectoral roadmaps to drive AI adoption in critical domains. Priority sectors highlighted in the national strategy include healthcare (focusing on tele-diagnostics and decision support systems), education (personalized learning platforms), agriculture (crop yield forecasting and supply chain analytics), and governance (public service automation and revenue administration). The policy instructs relevant sector ministries to implement mandatory risk assessments, human oversight clauses, and fairness controls to ensure deployed AI systems prevent discriminatory outcomes and protect citizen safety.

In regulated technical and commercial sectors, oversight is administered through established regulators. The Pakistan Telecommunication Authority (PTA) enforces infrastructure security and operational compliance under instruments such as the Critical Telecom Data and Infrastructure Security Regulations, while the State Bank of Pakistan (SBP) oversees financial tech, digital banking, and cloud outsourcing baselines. The corpus contains no records detailing explicit standalone regulations for autonomous vehicles or employment-specific algorithmic management.

International Alignment

Pakistan's AI strategy emphasizes international alignment and bilateral cooperation to integrate global technical standards while maintaining national policy sovereignty. The National AI Policy 2025 explicitly outlines international partnerships as one of its six core pillars, prioritizing active participation in global AI governance forums, alignment with international standard-setting bodies, and cross-border collaborative research initiatives. The policy aims to position domestic AI products for international compatibility and export readiness.

Similarly, technical and security frameworks across Pakistan's digital policies incorporate international benchmarks. The Pakistan Cloud First Policy benchmarks its accreditation criteria and security baselines against international cloud security standards, and the National Cyber Security Policy 2021 structures its information assurance frameworks and CERT operational hierarchies around international cybersecurity practices. The corpus holds no record of formal adoption or statutory cross-referencing of external instruments such as the EU AI Act or OECD AI Principles.

Future Developments

Future regulatory activities in Pakistan focus on operationalizing the National AI Policy 2025 and building out subordinate administrative frameworks. Key upcoming initiatives managed by MoITT and the AI Council include the creation of the National AI Fund (NAIF) by ring-fencing R&D allocations, the formal launch of geographically distributed AI Centres of Excellence in major urban centers, and the publication of formal guidelines for regulatory sandboxes to support supervised AI model testing.

Additionally, policy stakeholders continue to emphasize the necessity of complementary primary legislation. Priority legal developments anticipated by government entities include the passage of a formal Personal Data Protection Act and updated cybersecurity regulations to establish explicit statutory rights, privacy protections, and procedural safeguards alongside expanding AI adoption and public data exchange under the Pakistan Digital Authority. Meanwhile, private members' legislative initiatives, such as the Regulation of Artificial Intelligence Bill, 2024, remain under committee review.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Pakistan Digital Authority (PDA)	Executing the National Digital Masterplan and managing Digital Public Infrastructure.	Issues technical standards, interoperability protocols, and registers digital service providers.
Social Media Protection and Regulatory Authority	Supervising digital communications and regulating social media platforms under PECA 2025.	Issues removal/blocking orders within 24 hours, registers platforms, imposes regulatory fines, and suspends operating licences.
National Cyber Crime Investigation Agency (NCCIA)	Primary federal agency for cybercrime investigation under the PECA Amendment Act 2025.	Conducts digital forensics, cybercrime inquiries, and law enforcement investigations.
Ministry of Information Technology & Telecommunication (MoITT)	Lead federal ministry for national AI policy formulation, digital strategy, and cybersecurity stewardship.	Coordinates National AI Policy implementation, chairs the Cloud Board, and establishes Centres of Excellence.