AI tools now draft agreements, screen job applicants, generate marketing images and answer customer queries across Pakistan. Yet almost none of this activity sits under a purpose-built legal framework. That gap creates real risk - for businesses deploying AI, for creators whose work is copied, and for citizens whose faces and data are used without consent. This guide sets out the emerging legal questions honestly: what the law already covers, where the holes are, and what is coming next. It is general information, not advice on your specific matter - for that, speak to a lawyer.
The current legal framework - or lack of one
Pakistan does not have a single statute that says "this is how AI is regulated". Instead, AI questions are answered by stitching together laws written long before modern machine learning existed. Two 2025 developments signal change but neither is yet an enforceable AI code:
- National AI Policy 2025 - approved by the Federal Cabinet in mid-2025 and led by the Ministry of Information Technology and Telecommunication (MoITT). It sets a six-pillar roadmap, an AI Council, a National AI Fund and regulatory sandboxes. It is policy and direction, not binding law with penalties.
- Regulation of Artificial Intelligence Act - a private bill tabled in the Senate to define how AI should be governed. It remains a pending proposal that has not been passed.
Until Parliament legislates, the practical position is that existing law applies to AI by analogy. Here is how the main issues map onto current statutes:
| Legal question | Law currently applied | Status of the gap |
|---|---|---|
| Deepfakes & synthetic media | PECA 2016 (s.20), PECA Amendment 2025 (s.26A) | Partly covered |
| AI-generated IP / copyright | Copyright Ordinance 1962 | Silent - human author required |
| Personal data & training data | No enacted law; PDP Bill pending | Largely ungoverned |
| AI liability / harm | Contract, tort, consumer protection Acts | By analogy only |
| Electronic AI records & signatures | Electronic Transactions Ordinance 2002 | Broadly covered |
| Overall AI conduct | National AI Policy 2025 | Policy, not binding law |
Deepfakes and synthetic media
This is where Pakistani law is furthest along, mostly by accident. PECA 2016 predates modern deepfakes and never uses the word, but two hooks apply:
- Section 20 (offences against dignity) - covers superimposing a person's face onto sexually explicit or defamatory material, which squarely captures non-consensual deepfake intimate imagery.
- Section 26A (added by the PECA Amendment 2025) - penalises intentionally spreading "fake or false information" online, with imprisonment of up to three years and fines up to PKR 2 million. A deepfake video presented as genuine can fall within this.
The 2025 amendment also created the Digital Rights Protection Authority (DRPA), with powers to block or remove unlawful content and regulate platforms. Rights groups have criticised Section 26A as vague and open to misuse against dissent, so its scope will be tested in the courts. If you are targeted by a deepfake or manipulated media, our guides on reporting cyber harassment and online defamation set out the complaint route.
Practical point: a deepfake case usually runs on two tracks - a criminal complaint to the FIA Cybercrime Wing under PECA, and a civil action for defamation or damages. Preserve the content, URLs and timestamps before they are deleted; that evidence is often the whole case.
Intellectual property and AI-generated content
Who owns an image, article or piece of code produced by an AI tool? Pakistani copyright law struggles to answer this. The Copyright Ordinance 1962 vests first ownership in the "author", and Pakistani copyright doctrine - like most jurisdictions - assumes a human creator applying skill and judgement. Purely machine-generated output with no meaningful human authorship may therefore fall outside copyright protection altogether, leaving it unowned and freely copyable.
The flip side is infringement: AI models trained on protected works, and outputs that reproduce someone's style or text, raise unresolved questions the Ordinance never anticipated. There is no Pakistani provision on liability for infringement committed through an AI system. For businesses, the safe course is to secure rights by contract - specify in your agreements who owns AI-assisted deliverables and warrant that inputs are cleared. Our digital contracts guide explains how to make those terms stick.
Data protection and the training-data problem
AI runs on data, and this is Pakistan's biggest legal vacuum. There is no enacted comprehensive data protection law. The Personal Data Protection Bill (2023, with a later 2025 draft prepared by MoITT) remains stuck in Parliament, and the proposed National Commission for Personal Data Protection has not been established. In practice that means AI systems that scrape, profile or train on Pakistanis' personal data operate with little statutory restraint.
What limited protection exists comes from PECA 2016 (unauthorised access to and misuse of data), constitutional privacy principles, and sector rules for banking and telecom. When the Bill passes it is expected to introduce consent, purpose-limitation and cross-border transfer rules that will directly affect how AI models are trained and deployed. Until then, read our data privacy law guide for the current position.
Liability - who answers when AI gets it wrong?
If an AI chatbot gives negligent advice, an algorithm denies a loan unfairly, or an autonomous tool causes loss, Pakistani law has no AI-specific liability rule. Courts fall back on established principles, and the table below shows how a claim is typically framed:
| Scenario | Likely legal basis | Who is usually liable |
|---|---|---|
| Faulty AI product sold to a consumer | Provincial Consumer Protection Acts | Seller / manufacturer |
| AI service breaches its terms | Contract Act 1872 | Service provider |
| Negligent AI decision causing loss | Law of torts (negligence) | Deploying business |
| AI used to defraud | PECA 2016; PPC provisions | The person operating it |
The consistent theme is that liability attaches to a person or business, not the software - the deployer who put the AI to use, or the provider who supplied a defective tool. Consumers harmed by an AI-enabled product or service can pursue redress; see our consumer protection guide and, for money lost to AI-assisted scams, recovering money from online fraud.
AI, electronic evidence and contracts
On the transactional side Pakistani law is comparatively ready. The Electronic Transactions Ordinance 2002 gives legal recognition to electronic records and signatures, so AI-assisted digital contracts and automated records are broadly valid. Electronic evidence is admissible under the ETO and Qanun-e-Shahadat, but the catch with AI is authenticity - a party can challenge whether a document, recording or image has been synthetically generated or altered. Expect courts to demand stronger proof of chain-of-custody as manipulation tools improve. Our guides on electronic signatures under the ETO 2002 and digital evidence in court cover the detail.
Where the law is heading
The direction of travel is clear even if the timeline is not. Expect, over the next few years: passage of a data protection law and a standing data-protection regulator; a dedicated AI statute building on the 2025 policy; sector-specific AI rules for finance, health and elections; and explicit deepfake and synthetic-media offences rather than borrowed provisions. Businesses that build consent, documentation and human oversight into their AI use now will adapt far more easily when binding rules arrive. If you are deploying AI in a regulated sector or facing an AI-related dispute, get advice early.
Frequently asked questions
Is there a law regulating AI in Pakistan?
Not a dedicated one. Pakistan approved a National AI Policy in 2025 and a Regulation of Artificial Intelligence Act was tabled in the Senate, but neither is enforceable primary legislation yet. Existing laws are applied by analogy.
Are deepfakes illegal?
There is no offence called "deepfake", but PECA 2016 Section 20 covers face-superimposition onto explicit content and the 2025 amendment's Section 26A penalises spreading false information. Both can apply.
Who owns AI-generated content?
The Copyright Ordinance 1962 requires a human author, so purely AI-generated output may not attract copyright at all. Secure ownership by contract until the law is reformed.
Is my data protected when AI uses it?
Only partly. There is no enacted data protection law and no data-protection commission yet, so AI training and profiling are largely ungoverned beyond PECA and sector rules.
Who is liable if AI causes harm?
The deploying business or provider, usually - courts apply contract, negligence and consumer law. The software itself is not a legal person.