The starting point: AI is not a legal vacuum
Artificial intelligence is used to draft contracts, create marketing material, assess credit applications, recommend medical treatment and screen candidates for employment. The fact that a tool uses a machine-learning model is not the answer to whether its use is lawful. The legal assessment depends upon the information supplied, the purpose for which it is processed, the persons affected, the representations made and the sector in which the system operates. Pakistan has adopted national AI policy and established statutory digital-governance institutions; it has not thereby replaced every existing rule on contracts, intellectual property, cybercrime, consumer protection or professional responsibility.
The National AI Policy 2025
The Federal Cabinet approved the National Artificial Intelligence Policy in July 2025. The published policy addresses six broad pillars including innovation, awareness and readiness, a secure AI ecosystem, transformation, infrastructure and international partnerships. It promotes research, skills, responsible generative AI and transparent human oversight. The policy supplies a direction for government and industry, rather than automatically imposing a universal schedule of licensing offences and penalties on every company using AI. A business should identify whether a specific obligation exists under legislation, valid subordinate rules, regulatory directives, contractual terms or sectoral licensing requirements. Confusing policy goals with directly enforceable legal commands produces inaccurate compliance advice.
Digital Nation Pakistan Act 2025
The Digital Nation Pakistan Act, 2025, establishes the National Digital Commission and Pakistan Digital Authority. The PDA has a statutory role in digital transformation, data governance and emerging-technology frameworks, including AI within the scope assigned under the Act. Its mandate operates within the broader regulatory environment and is not a blanket displacement of the State Bank of Pakistan, SECP, PTA or other sector regulators. Companies should distinguish an announced standard from a duly issued and effective direction. Its enabling Act, any applicable regulations and the legal status of the instrument determine who is bound, from which date and subject to what requirements.
The 2026 Islamabad AI Declaration
In February 2026, the Pakistan Digital Authority announced the Islamabad AI Declaration setting out a national direction for sovereign, responsible and accountable AI deployment. It emphasises human accountability and public value. This development is relevant to foreseeable governance expectations, but a declaration should not be reported as an enacted penal code. The proposed National Data Governance Policy 2026 likewise concerns evolving arrangements for public-sector data and institutional coordination. Its legal effect depends on adoption, notification and the instruments issued under competent authority. A careful legal publication must separate current enforceable requirements from prospective policy objectives and implementation plans.
Does Pakistan have a comprehensive personal-data protection law?
Draft Personal Data Protection Bills have circulated for several years, but a draft must not be treated as an Act simply because its text is publicly available. Businesses should not claim the full catalogue of rights and sanctions in an unenacted bill is already universally enforceable. Nevertheless, privacy and confidentiality have important legal foundations: constitutional protections, contractual duties, PECA provisions governing misuse of information and applicable industry-specific rules. Overseas privacy legislation may also apply to particular clients or activities. The proper starting point is to identify the applicable legal instrument, not to assume that the absence of one comprehensive statute allows unrestricted processing.
AI prompts, customer data and confidential material
When an employee pastes customer records, source code, board papers or privileged legal advice into an outside chatbot, the organisation may be disclosing information to an independent service. The terms may permit retention, human review, sub-processing or model improvement. A lawful data source does not automatically establish permission for every new purpose. Before using outside models, businesses should map data categories, contractual restrictions, location, retention, deletion rights, security controls and training permissions. Minimisation and approved tools can reduce risk. Sensitive medical, financial and client information should not be exposed merely for convenience without the necessary authority and safeguards.
Copyright in training materials and output
Copyright issues arise when protected books, images, source code, designs or publications are used as model inputs, and again when output resembles protected material. Public visibility on the internet is not automatically permission for commercial copying or training. The Copyright Ordinance, 1962, contractual licences and any applicable exceptions require case-specific analysis. It is equally unsafe to assume that every generated output belongs automatically to the prompting user or is free of third-party claims. Authorship, originality, human input, chain of title and supplier terms matter. Commercial contracts should allocate rights to datasets, code, model improvements, generated deliverables and third-party material explicitly.
Deepfakes, identity misuse and online fraud
AI can be used to imitate an executive's voice, create an impersonating account, manufacture an apparently genuine message or circulate a sexually explicit synthetic image. Such conduct may engage PECA provisions on electronic fraud, forgery, identity information, dignity, modesty, stalking or spoofing depending upon the statutory ingredients. The use of AI does not by itself establish a criminal offence, and not every synthetic image is unlawful. Prosecutors must prove the act, relevant mental state and required consequences. Where a criminal PECA offence is suspected, NCCIA is the specialised investigation agency; the Pakistan Digital Authority has a different governance mandate.
Employment and automated decisions
AI screening may affect hiring, promotion, performance assessment and disciplinary decisions. Employers should assess the lawfulness and reliability of the data, the risk of discriminatory or erroneous outcomes and the opportunity for meaningful human review. A manager should not treat an automated recommendation as independent proof of misconduct. Workplace policies should identify approved tools and prohibit uncontrolled sharing of confidential records. Evidence of employee consent or notice, where legally relevant, cannot cure every unfair or unlawful processing practice. Retaining version and review records can be valuable if a decision later becomes the subject of employment litigation.
Civil, contractual and professional liability
A model may invent a case citation, calculate a figure incorrectly or give an unsafe recommendation. Liability depends on the duty actually owed, the transaction, reliance, causation, loss and applicable law. A disclaimer does not necessarily eliminate statutory or professional duties. Lawyers and other advisers must independently verify authorities and material facts before relying on generated output. Banks, healthcare operators and financial firms must consider their sector's regulatory requirements. A system described as advisory may still influence decisions in practice, so governance should reflect actual reliance rather than marketing labels. Human responsibility remains central.
AI procurement: what the contract must say
A sound AI contract should define its scope, performance measures, permitted data uses, security standards, incident reporting, geographic processing, ownership of inputs and outputs, and arrangements for subcontractors. It should address model updates, drift, auditability, business continuity and exit. The supplier may not be able to guarantee that every response is accurate, but it can give precise commitments about confidentiality, security, testing, service availability and infringement handling. Liability caps and indemnities should reflect each party's control of the risk, particularly where trade secrets or client data may be exposed. Procurement teams should not ignore open-source licence obligations.
Governance for directors and management
An AI inventory should identify the model, business owner, input data, decision type, affected persons and human approval process. Higher-risk cases such as credit, healthcare, recruitment or public service decisions require more rigorous testing and escalation. Policies should cover access rights, employee training, audit logs, prompt security, incident response and supplier review. The board should approve a workable framework and ensure that material risks reach decision-makers. A register of model versions, quality tests and approval decisions can help demonstrate reasonable oversight. Such measures are prudent even where no single AI-specific statute mandates their precise form.
Practical questions from businesses and readers
Is using ChatGPT itself illegal in Pakistan? No general prohibition follows merely from the technology's name; the use case and underlying legal requirements matter. Can a business use customer data to train a model? Only after examining its rights, contractual permissions and applicable law. Can AI-generated material be used in court? Potentially, but authenticity, relevance, attribution and admissibility must be established; the label AI-generated does not prove its contents. Can an AI supplier be sued for a harmful answer? That depends on the applicable contractual, statutory or civil cause of action and proof of loss. Is every deepfake a cybercrime? No; the statutory elements must be met.
The next legal developments to watch
Businesses should track formal PDA instruments, implementation under the National AI Policy, evolving sectoral standards and the progress of data protection legislation. Draft policies and proposals are informative, but they must be clearly marked as such. The best preparation is an adaptable governance structure with accountable owners, lawful data practices, tested systems, contracts addressing real failure modes and documented human supervision. For related legal remedies consult our NCCIA and PECA guide. Readers should treat emerging announcements as relevant signals without mischaracterising them as immediately binding law.
Primary legal and policy sources
Refer to the National AI Policy 2025, Digital Nation Pakistan Act 2025, PDA's Islamabad AI Declaration and PDA's legislation register. This article is general legal commentary, not a legal opinion on any particular product or matter.
General information only. No advice is given on any particular matter.