Pakistan’s National AI Policy, Explained

Pakistan has an artificial intelligence policy. It was approved by the Federal Cabinet on 30 July 2025, it runs to six pillars, and roughly a year later most of the companies it governs still could not tell you what it requires of them.

That gap matters more this month than last, because the policy has started producing consequences. In August 2026 the Commerce Ministry began work on a sovereign cloud and an AI-driven trade intelligence system, and the shape of that project comes directly from the policy’s infrastructure pillar.

What the policy actually is

The National AI Policy 2025 is a framework, not a statute. It sets direction, targets and institutional structure; it does not by itself create criminal or civil liability. Binding obligations are expected to flow from subordinate regulations issued by a new AI Directorate under the Ministry of Information Technology and Telecommunication.

The six pillars cover the AI ecosystem end to end. The fifth is the one with the largest budget implications: AI Infrastructure, which envisions a national compute grid, centralised datasets, AI hubs and cloud resources intended to make large-scale model work possible inside Pakistan. The sixth pillar, International Partnerships and Collaborations, commits the country to joint research, cross-border projects and alignment with international standards.

The policy does not stand alone. It is written to interlock with the draft Personal Data Protection Act, the Pakistan Cloud First Policy, the Digital Pakistan Policy, the Digital Nation Pakistan Act and Uraan Pakistan, the National Economic Transformation Plan 2024–29. Reading any one of those documents in isolation gives a misleading picture of what is being built.

The obligations that are already real

For a startup or an established firm deploying AI systems, three provisions have moved from aspiration to planning problem.

The first is risk classification. Products are expected to be screened by risk level, which means a company needs to know where its systems sit before a regulator asks. The second is AI impact assessment, which the Directorate is expected to require for higher-risk deployments. The third, and the most expensive, is the sovereign-cloud preference: hosting arrangements that route national or sensitive data through foreign infrastructure are being discouraged, which changes vendor decisions that most firms made years ago.

There is also a measurable target. The policy commits to implementing an AI maturity model and project-management guidelines in at least 50 institutions and organisations by 2026 — a deadline that arrives in four months.

The Islamabad Declaration, and what it is not

In February 2026 Pakistan adopted the Islamabad AI Declaration. It is worth being precise about its status, because coverage has tended to blur it with the policy itself.

The Declaration is a strategic and diplomatic commitment. It signals intent to develop sovereign AI capability and to participate in international AI governance forums. It does not create statute, and no company acquires a legal obligation from it. The enforceable material sits in the policy instruments and in whatever the AI Directorate eventually issues.

Sovereign cloud arrives at the Commerce Ministry

The clearest sign that the infrastructure pillar has left the page came this month. Commerce Minister Jam Kamal Khan held separate meetings with the Pakistan Digital Authority and with data-centre operator Sky47 to explore an integrated, AI-enabled digital ecosystem for the ministry and its attached organisations.

The premise stated in those meetings is that government data is a national asset. The Commerce Ministry holds information on thousands of tariff and product lines, exporters, international markets, trade bodies, chambers of commerce and overseas trade missions — material that is currently fragmented, inconsistently formatted and difficult to query. The proposal is to standardise and integrate it, host it on sovereign infrastructure, and train an indigenous AI platform on authorised government and sectoral datasets to support export policy.

The Sky47 discussion covered data-centre capacity, cybersecurity, disaster recovery and the compute requirements that AI workloads impose. Participants also discussed a national digital master plan under which sector-specific digitalisation roadmaps would be developed with federal and provincial governments.

The criticisms worth taking seriously

Two objections recur among people who have read the document closely, and both are substantive rather than reflexive.

The first is that the sectoral focus is too generic for the economy it governs. Pakistan’s output is driven heavily by agriculture and textiles, but the policy treats sectors broadly rather than committing to targeted programmes — grants for agricultural automation, or computer-vision defect detection in textile production, are the examples usually offered.

The second concerns language. The policy mentions national AI models but does not commit to building one. Critics argue a state-backed Urdu large language model is not a nice-to-have but a precondition for AI-driven citizen services, because the majority of Pakistanis who would benefit from those services do not operate in English. Without it, AI in government reaches the population that least needs the help.

A third argument connects the policy to the balance of payments. Reliance on foreign cloud providers is a continuing outflow of dollars, which is part of why sovereign infrastructure appeals to the finance side of government as much as the security side.

What to watch

The AI Directorate’s first implementing regulations — this is where obligations become enforceable.

Whether the 50-institution maturity-model target is met, and how it is measured.

Passage of the Personal Data Protection Act, which the AI framework assumes but does not yet have.

Procurement notices for national compute and data-centre capacity — the clearest evidence of whether pillar five is funded.