Pakistani AI startups are building in an unusual regulatory environment: official state strategy encourages them to expand, but there is no statutory law to define their boundaries. The Federal Cabinet formally approved the Pakistan’s First AI Policy framework on July 31, 2025, laying out ambitious state support alongside targets to train one million technical workers by 2030. Yet, more than a year later, the country still operates without an enacted personal data protection statute or a legally binding AI accountability act.

For engineering leads and software founders, this gap provides short-term flexibility. There are no statutory AI compliance audits or model registration requirements at a federal level today. At the same time, it creates serious risks: international venture funds require clear regulatory compliance, cross-border data handling rules remain unsettled, and any future legislation could force teams to rewrite their architecture overnight.

What the 2025 Framework Actually Puts on Paper

The National AI Policy 2025 is organized into six formal pillars: AI Innovation Ecosystem, Awareness and Readiness, Secure AI Ecosystem, Transformation and Evolution, AI Infrastructure, and International Partnerships and Collaborations. It commits the federal government to establishing a National AI Fund to back research and commercial ventures, creating university-based Centres of Excellence (CoE-AI), and rolling out regulatory sandboxes where software houses can experiment with automated workflows under state supervision.

On paper, the document also envisions a National AI Council acting as the highest supervisory body, supported by a dedicated Policy Implementation Cell to synchronize work across provincial and federal ministries. Infrastructure targets include high-performance compute clusters and a centralized national data repository to supply local training data. Startups looking for infrastructure relief can also tap initiatives like the PM Cloud Program for Startups to manage early compute expenses.

Yet policy documents are statements of intent rather than binding law. A policy cannot impose criminal penalties, set civil liability for algorithmic damage, or mandate that companies disclose the datasets used to train commercial models. When the eight-month mark of 2025 passed with little administrative execution on the matrix, public policy researchers pointed to clear friction between the paper targets and actual state capacity.

The Digital Rights Foundation Findings on Ground Realities

The absence of binding statutory constraints has tangible social effects. A research report by the Digital Rights Foundation examined how the public interacts with unregulated machine learning systems in Pakistan. Gathering evidence from 11 focus group sessions with 79 participants alongside 60 survey respondents, the study showed strong public unease regarding unmonitored deployments.

  • 65 percent of participants expressed concern over the loss of personal privacy to automated platforms.
  • 63 percent highlighted anxiety regarding algorithmic disinformation and synthetic media.
  • 50 percent feared unchecked, state or commercial AI-enabled tracking and surveillance.

The research documented practical harms already taking place across the country, such as women targeted by non-consensual deepfakes and sectarian tensions amplified by automated social media networks. Because Pakistan has no legal mechanism defining risk classifications for machine learning algorithms, banned categories in other markets; like social scoring systems or deceptive biometric harvesting; carry no clear statutory prohibition under the current framework.

The Stalled Personal Data Protection Bill

The deepest legal hole under the AI strategy is the lack of a primary privacy law. The 2025 policy references data protection, consent systems, and data subject rights, but all those concepts rely on the Personal Data Protection Bill, which remains unpassed.

The draft legislation has moved through multiple setbacks. After an earlier draft passed the Federal Cabinet, Parliament returned it to the Ministry of Information Technology and Telecommunication because a single member had tabled it. While a redrafted version again secured cabinet clearance, it has not completed passage through both houses of Parliament as of September 2026. The proposed law would create a National Commission for Personal Data Protection (NCPDP) and establish statutory rules for retention, disclosure, and processing consent.

In the absence of the NCPDP, digital crimes and data theft fall under the Prevention of Electronic Crimes Act (PECA) 2016 and its 2025 amendments. PECA criminalizes unauthorized data access and leaks, enforced through the Federal Investigation Agency and the Pakistan Telecommunication Authority. However, PECA is a criminal penal statute, not a civil data-governance system. It does not establish commercial standards for machine learning training datasets or corporate consent handling.

Sector Regulators Are Not Waiting for an AI Act

While Parliament deliberates, financial and telecom regulators have enforced operational requirements directly on regulated companies. Founders selling software to financial institutions must meet stringent compliance checklists today.

In 2026, the State Bank of Pakistan and the Securities and Exchange Commission of Pakistan issued joint Circular No. BPRD/CSD/2026/09. The directive makes cybersecurity audits compulsory for commercial banks, electronic money institutions, and fintech companies. Crucially, it sets an unyielding deadline: all regulated financial institutions must complete data residency audits and obtain incident response certifications by Q4 2026.

Fintech startups building credit-scoring models, automated onboarding systems, or algorithmic trading tools must also consider upcoming SECP rules for algorithmic trading. Similarly, developers utilizing telecom data or customer connection records must follow licensing rules set by the PTA under the Pakistan Telecommunication Re-organisation Act.

Public Data Rules Under the June 2026 Governance Draft

A second major piece of administrative guidance emerged on June 26, 2026, when the Ministry of Information Technology and Telecommunication issued the draft National Data Governance Policy for public feedback. As detailed by analysis on Digital Pakistan, this draft focuses strictly on the public sector rather than private enterprise systems.

The draft treats government agencies as custodians rather than owners of citizen information, establishing a National Data Exchange called WASL and mandating a "once-only" rule so citizens do not repeatedly submit documents to different departments. For founders seeking access to state datasets in healthcare, land registration, or transportation, the document outlines both opportunity and restriction. Sensitive public data must remain stored and processed within domestic borders, permitting overseas processing only under explicit state authorization. If these data localization rules are extended to the private sector in future revisions, software companies relying on external offshore cloud environments will face significant operational adjustments.

How Founders Should Manage the Legislative Void

Who is liable if an AI system makes an error in Pakistan?

At present, no statute answers this. If an automated model produces an inaccurate credit rejection, an erroneous facial identification, or an offensive synthetic asset, there is no specialized AI liability law allocating fault between the software vendor, the hosting client, or the foundational model provider. General contract law, consumer protection statutes, and PECA's criminal provisions remain the only existing avenues for dispute.

Can startups train models on local public web data without explicit consent?

While PECA penalizes unauthorized access and unlawful distribution of protected personal information, Pakistan has no specific law detailing permissible data scraping for machine learning. However, companies looking to raise institutional venture capital or export services abroad should adopt international best practices immediately. Documenting training data sources, logging data provenance, and isolating personally identifiable information protects companies against incoming data privacy statutes.

What should Pakistani software houses prioritize before the law passes?

Startups should audit where their production data is stored, maintain strict user consent records, and prepare fallback infrastructure in case data residency requirements are enacted. Meeting the requirements of SBP and SECP directives now will ensure enterprise readiness well before the federal government turns its policy drafts into statutory acts.

Source: Digital Pakistan