National AI Policy 2025, explained for the officer who has to implement it

What Pakistan's National Artificial Intelligence Policy says, what it asks of the public sector and individual officers, who is responsible for it and what it does not yet do.

In one paragraph

The federal cabinet approved the National Artificial Intelligence Policy on 30 July 2025. The Ministry of Information Technology and Telecommunication (MoITT) owns it. It sets out how Pakistan intends to build an AI ecosystem that is used responsibly and ethically: funding research and startups, training people at scale, securing data, bringing AI into public services and key sectors, building computing infrastructure and working with other countries. It is a policy, not an Act of Parliament. It sets direction and targets; it does not by itself create legal duties or penalties for individual officers.

Page and section references below are to the policy document published by MoITT.

The six pillars

Pillar	What it covers
1. AI innovation ecosystem	A National AI Fund, Centres of Excellence in AI, innovation and venture funds, data standards
2. Awareness and readiness	Public awareness, skills programmes, scholarships, internships and AI training for public servants
3. Secure AI ecosystem	Cybersecurity, transparency, human oversight, data security and privacy, open-source and generative AI, regulatory sandboxes
4. Transformation and evolution	Sector roadmaps (including governance, health, education and agriculture) and AI adoption in public and private organisations
5. AI infrastructure	Computing power, data repositories, AI hubs and shared cloud resources
6. International partnerships	Agreements, joint research, alignment with international standards and investment

What it asks of the public sector

These are the parts most relevant to an officer's day-to-day work.

Training for public servants. The policy asks for a specialised curriculum for public servants on AI basics, ethical use, data governance and personal data protection, developed with the Establishment Division (section 2.2, page 10). Its action matrix sets a target to train at least 70% of existing employees and all new inductees in AI (page 22). Expect this training to reach your department.

Transparency about where AI is used. Section 3.2 (page 11) calls for disclosure of the use of AI systems, including a public register of AI systems used in the public sector. If your department deploys an AI system, assume it will need to be listed and explained.

Human oversight. The same section calls for human oversight mechanisms for critical AI operations, particularly in high-risk scenarios, along with lifecycle evaluations and impact assessments for high-impact systems and regular audits. In practice: a person must remain able to review, question and override what an AI system recommends, especially where citizens' rights or entitlements are involved.

Data security. Sections 3.3 to 3.5 (pages 11 and 12) call for a national data security policy and, among other measures, multi-factor authentication, role-based access controls and periodic reviews of who can access what. These are good practice for any office using AI tools today.

Generative AI. Section 3.7 (pages 12 and 13) asks the AI Directorate to issue regulatory guidelines addressing disinformation, data privacy breaches and fake news and measures against copyright infringement.

Sector roadmaps. Section 4.1 (page 14) lists governance among the priority areas for AI roadmaps, alongside education, health, record digitisation, agriculture and others. It also sets a target to implement an AI maturity model and project management guidelines in at least 50 institutions by 2026.

Who is responsible

AI Council: the apex body for strategic direction and oversight, chaired by the Federal Minister for IT and Telecom, with federal secretaries, provincial chief secretaries and experts from academia, industry and civil society (page 19).
Policy Implementation Cell: within MoITT, manages day-to-day implementation and supports the Council (page 19).
AI Directorate: for the responsible use of AI. The action matrix places it under the National Commission for Personal Data Protection (page 23).
Centres of Excellence in AI: a national network that runs research, training and support for regulatory sandboxes (section 1.2).

Some headline numbers

A National AI Fund drawing on at least 30% of Ignite's R&D fund (section 1.1)
200,000 people trained in AI each year and 10,000 trainers prepared by 2027 (section 2.1)
20,000 paid internships and 3,000 scholarships each year (sections 2.1 and 2.1.2)
Enterprises benefiting from a regulatory sandbox by 2027: the document gives two figures, at least 20 in section 3.8 (page 13) and at least 50 in the action matrix (page 24)

What the policy does not do (yet)

It helps to be clear about the limits, so you neither overstate nor ignore it.

It is not law. The policy itself calls for a legal framework with clear penalties (section 3.2), which means such a framework does not yet exist in the policy.
Data protection law was still a draft. The policy refers to the draft Personal Data Protection Act. Check the current legal position before relying on it.
No tiered risk categories. The policy speaks of high-risk scenarios and high-impact systems but does not define risk tiers in the way some other countries do. The Digital Rights Foundation's analysis makes this point among other criticisms, including the lack of a binding enforcement mechanism.

What you can do now

Use only tools your department approves for official information and never put classified material or citizens' personal data into a public chatbot.
Keep a person in charge of any decision AI helps to make and record that a person reviewed it.
Note where your office uses AI. When the public register and audits arrive, you will be ready.
Take up the training when it is offered and start with our how-to guides for civil servants.
Read the policy itself. It is short and written in plain English. The link is at the top of this page.