Artificial Intelligence and Cyber Law in Pakistan: Emerging Legal Challenges in Protecting Digital Infrastructure

Abstract

The digital economy has grown at a rapid pace in Pakistan over the last ten years, with the rise of mobile banking, e-governance, satellite television, and the early introduction of artificial intelligence (AI) in financial services, the media, and public administration. This growth has outstripped the nation's capacity to regulate the dangers associated with it. Meanwhile, Pakistan is dealing with two challenges: it is both a brand new and more advanced source of threats to the country's digital infrastructure in the form of artificial intelligence-generated deepfakes, disinformation, automated frauds, and intrusion tools, and it is also a tool that the regulators and critical sector institutions are being asked to use in the interest of national security. The current article explores the emerging legal and institutional framework of cyber governance in Pakistan, including the Prevention of Electronic Crimes Act 2016, the controversial amendment of the same act, 2025, the National Cyber Security Policy, and the recently approved National AI Policy 2025. The article provides an evidence-based assessment of Pakistan's current regulatory framework, citing recent enforcement actions, regulatory circulars, and a series of attacks on the country's national broadcasting and financial infrastructure, which highlights its fragmentation, reactive nature, and inherent structural limitations in addressing AI-related risks. It highlights five fundamental legal deficits (no binding data protection legislation, no liability framework tailored to the various levels of risk, inadequate attribution and enforcement possibilities, regulatory fragmentation between sectoral authorities, and human rights issues due to overly generic content-control regulations) and suggests a law reform agenda based on comparative practice.