Pakistan Writes Rules for the Algorithmic State
Pakistan's draft National Data Governance Policy would give citizens a right to human review of automated decisions and force ministries to register high-risk AI. It arrives before the country has a data protection law.
Pakistan is trying to set the rules for artificial intelligence inside government before it has settled the rules for personal data across the economy. The draft National Data Governance Policy 2026, published by the Ministry of Information Technology and Telecommunication in late June, would for the first time oblige federal bodies to explain, audit and subject to human review the AI systems they use to make consequential decisions about citizens. Public consultation closed on 10 July. Since then officials have been finalising the text ahead of cabinet approval, which had not been announced at the time of writing.
What the policy does
The draft declares government data a “strategic national asset”. Its core mechanics are administrative: a “once-only” principle, so citizens are not asked repeatedly for the same information; primary registers as single authoritative sources for records such as identity and land; and a federated National Data Exchange, known as WASL, for agency-to-agency sharing.
On AI, the draft takes a risk-based approach. According to reporting by ProPakistani and Business Recorder, government systems used in high-impact or legally significant decisions must be explainable, auditable, continuously monitored and subject to meaningful human oversight. Departments would need pre-deployment risk assessments and safeguards against bias, and high-risk systems would have to be registered. Generative AI use would carry safeguards against inaccurate output and data leakage. Citizens would gain rights to know what data the state holds on them and who has accessed it, to request corrections, and to obtain meaningful human review of significant automated decisions.
Enforcement rests with the Pakistan Digital Authority (PDA), which would chair a National Data Governance Council, require every federal body to appoint a chief data officer, publish an annual National Data Maturity Index and issue binding directions to non-compliant departments. Sensitive government and personal data would, in most cases, have to be hosted and processed inside Pakistan.
Why it matters now
The policy fills a gap. Pakistan’s National AI Policy, approved by the federal cabinet in July 2025, set ambitious targets, including training one million AI professionals by 2030, but said far less about how the state itself should use the technology. Meanwhile AI is already entering administration: the Prime Minister’s Office has launched a system to track directives from issuance to completion, and in July the Khyber Pakhtunkhwa government announced a provincial AI authority with a budget of Rs1bn.
At a consultative meeting reported in early August, the IT minister, Shaza Fatima Khawaja, described the government as the country’s largest custodian of public data, according to TechJuice. The PDA’s chairman, Sohail Munir, said the framework would not centralise all government data or permit unrestricted sharing.
A right to human review is only as strong as the records that show a human actually reviewed anything.
The gaps critics see
The policy governs the public sector only. Pakistan’s Personal Data Protection Bill, as the technology lawyer Salma Khan noted in Dawn in August, has remained in draft since 2018. The data governance policy extends obligations to contractors and processors through procurement terms, not statute, so the new citizen rights would rest on an executive policy rather than law.
Other commentators question whether the principles can be measured. Writing in The Nation in September, Roshaan E Ali argued that neither the AI policy nor the data policy sets benchmarks for whether datasets represent the whole population, citing a 2025 World Bank assessment that the National Socio-Economic Registry left out about 2.2m households among the poorest 40%. Automated systems trained on such data, the argument runs, could entrench exclusion faster. In The Friday Times, Gleb Tsipursky proposed that every consequential government AI deployment keep a short evidence record of the task, data used, reviewing official and outcome.
What to watch
The immediate test is cabinet approval and gazette notification, followed by a 12-month window for existing contracts to comply, according to Business Recorder. For suppliers to the Pakistani state, localisation of sensitive data, audit trails, risk assessments and high-risk registration will become contractual conditions. For citizens, the question is whether human review becomes an enforceable remedy or remains a principle on paper until a data protection law finally passes.
Sources
- Pakistan proposes first national framework for AI, government data, digital rights — Arab News
- Pakistan unveils National Data Governance Policy 2026 to transform digital governance — Business Recorder
- Govt’s AI decisions to face human review under new policy — ProPakistani
- Pakistan’s new Digital Authority could soon gain massive govt powers — ProPakistani
- IT Ministry finalizes National Data Governance Policy 2026 — TechJuice
- Pakistan’s privacy debate — Dawn
- Blind spots in data governance — The Nation
- Pakistan’s AI policy needs a public-service evidence standard — The Friday Times
- Federal cabinet approves National AI Policy 2025 — Dawn
- KP to set up Rs1b AI authority as govt unveils digital governance drive — The Nation
Discussion
No comments yet. Start the conversation.
