Pakistan does not yet have a dedicated AI law, but AI use by businesses is already shaped by national policy, cyber-crime law, sector regulators and the rules of the foreign markets Pakistani firms serve. This page summarises where things stand and what a Pakistani business can do now. It is a general overview, not legal advice, and the rules are changing quickly.
Where things stand
- National AI Policy 2025. The federal cabinet approved a National Artificial Intelligence Policy in 2025. It focuses on skills, research, adoption across government and industry, and responsible and ethical AI, with new oversight bodies to be set up. It is a policy, not a law, so it does not create direct legal duties for businesses on its own.
- Personal data protection. A Personal Data Protection Bill has been drafted and discussed for several years. Check its current status before relying on it. Until a law is passed, contracts and sector rules carry most of the weight.
- Prevention of Electronic Crimes Act (PECA) 2016. Covers unauthorised access to data, identity misuse and some online content offences, which matter for deepfakes and misuse of personal information.
- Sector regulators. Banks and payment firms follow State Bank of Pakistan rules on outsourcing, cloud and IT risk; listed companies and NBFCs follow SECP requirements. Using AI vendors can count as outsourcing or cloud use under these rules.
- Foreign rules through clients. Firms serving the EU, UK or US (software houses, BPOs, freelancers) often have to meet GDPR, the EU AI Act or US client requirements through contracts and data processing agreements.
What Pakistani businesses can do now
- Adopt a short AI acceptable use policy and an approved tools list.
- Keep client and customer personal data out of AI tools that train on inputs. Check each tool's SafeScore.
- For export clients, sign their DPA terms and use AI tools that offer GDPR rights and a DPA (see GDPR-compliant AI tools).
- Banks, fintechs and insurers: treat AI vendors as outsourcing or cloud providers under your regulator's rules and keep the assessment on file.
- Follow a recognised framework such as NIST AI RMF or ISO/IEC 42001, which international clients understand.
Frequently asked questions
Is there an AI law in Pakistan?
Not a dedicated one at the time of this review. There is a national AI policy, cyber-crime law and sector regulation, and a draft data protection law. Check for updates before making decisions.
Can Pakistani freelancers use ChatGPT or Claude for client work?
Yes, within your client's rules. Read the contract, keep confidential data out of free plans, and tell clients when AI plays a material part in the work.