Two Mandates, One Missing Interface: Pakistan’s AI Governance Architecture and the Financial Sector

The Digital Nation Pakistan Act 2025 anticipated potential regulatory overlap, required the Pakistan Digital Authority to avoid it, and established a mechanism for resolving conflicts. Yet the operational relationship between PDA’s AI governance mandate and the State Bank of Pakistan’s supervisory authority remains publicly undefined.

Three developments in October
October 2026 brought three developments relevant to Pakistan’s AI governance ambitions.

On 6 October, the World Bank’s MENAAP Economic Update, From Divide to Opportunity: AI, Jobs, and Growth, examined the region’s uneven AI readiness. It framed the productivity question around three gaps: localisation, usage and foundational capital. On Pakistan, it noted that Urdu accounts for roughly 0.03 per cent of URLs against about 0.7 per cent for Arabic, and that the share of LinkedIn members with AI engineering skills more than tripled between 2016 and 2025.

A day later, the Monetary Authority of Singapore issued its final Guidelines on AI Risk Management for financial institutions, setting phased supervisory expectations for October 2027 and October 2028. On 15 October, the Financial Stability Board published 12 sound practices addressing enterprise-wide AI governance and controls across the AI lifecycle.

Together these sharpen a question for Pakistan: how should national AI governance standards interact with the established supervisory authority of financial-sector regulators?

The architecture as it stands
Pakistan has national AI principles, a statutory standards apparatus already issuing published instruments, and existing supervisory frameworks in the financial sector. What has not yet been issued is the AI-specific layer at either level.

The national layer. The Digital Nation Pakistan Act 2025 created the Pakistan Digital Authority (PDA). Section 8(g) assigns it oversight, standard-setting and enforcement over data management and governance, artificial intelligence, virtual assets and other emerging technologies, in areas assigned by the National Digital Commission. Around that mandate sit three instruments:

The National AI Policy 2025, approved in July 2025, favours sectoral roadmaps over uniform cross-sector rules and directs sectoral regulators to develop domain-specific rules.

The Islamabad AI Declaration, adopted in February 2026, sets nine principles including explainable, auditable and risk-proportionate AI. The Prime Minister directed PDA to operationalise a national AI Supervisory Framework aligned with it.

The National Data Governance Policy 2026 carries the most operational AI provisions drafted so far. Its own metadata records its maturity as proposed, with the Gazette reference pending Cabinet approval, and Annex III provides that it takes effect on formal issuance by PDA after Cabinet approval and Gazette notification.

PDA’s standards apparatus is live. Its standards portal has published DNP-D.002 RA, the WASL Reference Architecture, at version 1.0 dated 13 May 2026, approved by the PDA Standards Board, within a classified series covering data governance, digital trust and payments. Within that same architecture sits DNP-A.001 FWK, the National AI Governance Framework, marked “to be issued,” alongside a DNP-A series for AI model governance, evaluation and lifecycle management.

The sectoral layer. SBP’s Guidelines on the Responsible Use of AI in Financial Services were described as at an advanced stage in its Financial Stability Review 2024. Its survey of 55 regulated entities found roughly half already deploying or developing AI. The guidelines have not been issued.

The foundation.

Pakistan has no enacted comprehensive personal data protection law. Successive drafts have circulated since 2018 without passing Parliament.

So the machinery is running at both levels. The AI instrument at each has a defined place and has not yet been issued.

The interface problem
The non-overlap duty sits inside the clause that grants the AI mandate, not as a general provision elsewhere in the Act. Having assigned PDA oversight of artificial intelligence and other emerging technologies, Section 8(g) requires the Authority to ensure that there is no overlap with the mandate or jurisdiction of other regulatory bodies and no conflict with relevant laws or existing regulatory frameworks. The constraint was attached to the AI grant itself.

The Act goes further than a principle. Section 28(3) provides that where conflicts with existing laws are identified, the Authority must establish a consultative process with the concerned regulatory bodies, and that where a conflict persists the Commission may issue recommendations or directives or propose legislative amendments. The forum already exists: under Section 4(1), the Governor of the State Bank of Pakistan sits on the National Digital Commission.

The principle is therefore established in law, and so is a mechanism for giving effect to it. What remains unpublished is how it will operate between PDA’s national AI governance mandate and SBP’s existing prudential and supervisory authority.

The distinction matters. Pakistan may not need new legislation to define this relationship. It needs an agreed operational interpretation of responsibilities already established by law.

 

Figure 1 — Pakistan’s AI governance architecture: statutory anchors, pending instruments and the undefined interface. Sources: Digital Nation Pakistan Act 2025; State Bank of Pakistan Act 1956; PDA Standards; SBP Financial Stability Review 2024.

This is not necessarily institutional failure. It is an unresolved sequencing problem. Without a publicly defined division of responsibilities, sectoral regulation risks either anticipating national standards or requiring subsequent realignment. The result is uncertainty over how the two frameworks will operate together.

Two features make the resolution harder than a routine coordination exercise.

The two statutes point overriding clauses at each other. Section 28(1) of the Digital Nation Pakistan Act provides that the Act applies notwithstanding conflicting provisions in other laws. Section 54A of the State Bank of Pakistan Act 1956 provides that that Act has effect notwithstanding anything contained in any other law. Section 46B of the SBP Act goes further: it establishes the Bank’s functional and institutional autonomy, bars third parties including government and quasi-government bodies from interfering with its management, and prohibits the Bank from accepting instructions from any person or entity.

Neither override resolves the institutional boundary conclusively. Sections 8(g) and 28(3) provide an important mechanism for addressing potential conflicts through consultation, rather than assuming that one institution’s mandate automatically displaces the other’s. The threshold is itself unspecified: Section 28(3) applies where conflicts with existing laws “are identified”, without stating who identifies them or on what trigger. That is one further reason for the division of responsibility to be published rather than assumed.

SBP may sit on both sides of the line. The National Data Governance Policy’s scope clause reaches federal ministries, divisions, departments, statutory corporations, regulators, authorities, commissions, autonomous bodies and federally controlled public-sector companies. SBP is not named, and financial regulators appear only as a category in the composition of the proposed National Data Governance Council. Although SBP is not expressly named, the policy’s references to federal regulators and autonomous bodies raise the possibility that some requirements could extend to it. Whether, and to what extent, they would apply is a question that would need to be reconciled with the Bank’s statutory autonomy. Were they to extend, SBP would occupy two positions at once: a prospective AI rule-setter for its own sector, and a subject of national standards.

A third authority is also still missing. The data governance policy leaves personal data rights to the authority to be designated under a future personal data protection law. That authority does not yet exist.

How others wired it
The jurisdictions examined have adopted different governance structures, but share an important feature: financial-sector supervisors retain a central role in overseeing AI risks within regulated financial institutions. National AI frameworks establish broader requirements without necessarily displacing established financial supervisory responsibilities.

Comparison table of AI governance in Singapore, the United Kingdom, the European Union and Saudi Arabia, showing that financial supervisors retain the central role in overseeing AI in regulated financial institutions.

The European position is the most instructive. Even within the EU’s comprehensive horizontal AI framework, the legislature has generally assigned market surveillance of qualifying high-risk financial-sector AI systems to existing financial supervisors, while allowing alternative arrangements where coordination is assured. The designation is scoped rather than wholesale: it concerns market surveillance of defined high-risk systems directly connected with the provision of financial services, and does not displace the Act’s other allocations, including those for general-purpose AI models.

Saudi Arabia is the closest structural analogue to Pakistan: a national data and AI authority operating alongside a central bank. One difference in sequencing is worth noting. Saudi Arabia’s personal data protection law was in force before AI expectations were layered on top.

Banks: where the gap is felt first
Banks are not the subject of this article, but they are where the gap is felt first, and they must manage its consequences.

A bank deploying AI today faces two prospective rulebooks, unknown sequencing and possible overlap. Its board cannot yet answer basic questions:

• Whose risk taxonomy defines a “high-risk” AI system: PDA’s or SBP’s?
• Will there be one register of AI systems, or two?
• Whose explainability and human-oversight standard applies to a credit or fraud model?
• How will data residency expectations treat vendor-hosted and foundation models?

Regulatory uncertainty need not delay AI adoption, but it can delay investment in the controls required to govern it. Institutions may hesitate to build classification, reporting and assurance frameworks before knowing which standards will ultimately apply.

Yet existing prudential, technology, outsourcing and risk governance obligations remain relevant. Banks cannot reasonably treat the absence of AI-specific guidelines as an absence of supervisory accountability. The danger is not delayed adoption, but adoption progressing faster than the control architecture needed to support it.

That divergence can be measured by comparing a bank’s AI inventory against its documented control framework, identifying deployments for which governance, validation or monitoring arrangements remain incomplete.

Options for building the interface
The following options translate the Act’s existing non-overlap and consultation provisions into a possible operational arrangement. They preserve PDA’s national standard-setting responsibilities and SBP’s financial-sector supervisory authority without requiring either institution to surrender its statutory mandate.

• Define the interface before the rulebooks. A PDA–SBP memorandum of understanding, or a determination at National Digital Commission level under the Section 28(3) consultative process, could set the division of labour. PDA would set national principles, taxonomy and standards; sectoral regulators would supervise within their domains.
• Recognise equivalent sectoral controls. Where SBP’s AI requirements meet or exceed applicable national standards, compliance could be recognised without duplicative assessment or reporting. Requirements falling outside SBP’s mandate would remain subject to the relevant national framework. The approach is analogous to substituted compliance in cross-border financial regulation, where one authority recognises another’s regime as achieving equivalent outcomes rather than identical rules. No comparable arrangement exists between PDA and SBP; the analogy is offered as a model, not a precedent.
• Establish a common classification architecture. PDA and SBP should agree baseline definitions and risk-classification principles while allowing SBP to prescribe additional financial-sector criteria, including model materiality, consumer impact, credit decisions, financial stability and third-party dependencies. An interoperable registration and reporting arrangement would avoid duplication without requiring both institutions to maintain an identical supervisory register. The registry contemplated in the data governance policy is scoped to public bodies operating automated decision-making systems with legal or similarly significant effects, which is a poor structural fit for a bank’s model inventory.
• Issue interim sectoral expectations. SBP could publish a short, principles-based statement aligned to the National AI Policy, the Islamabad Declaration and the FSB sound practices. Singapore’s progression from its 2018 FEAT principles to its 2026 guidelines illustrates how sectoral supervisory expectations can evolve without waiting for comprehensive national AI legislation.
• Consult jointly. A joint consultation on SBP’s guidelines and PDA’s forthcoming DNP-A.001 framework would surface overlaps before either is issued. Enacting the personal data protection law would give both frameworks a foundation they currently lack, but it is a complementary measure rather than a precondition: SBP has sufficient authority under its own statute and existing prudential, technology and outsourcing frameworks to set AI expectations now.

Closing
Pakistan is not short of institutions or intent. It has a national AI policy, a statutory digital authority with a working standards apparatus, a capable central bank and a financial sector already deploying AI.

What has not been published is the wiring between them. Parliament anticipated the problem: it imposed a non-overlap duty alongside the AI mandate, established a consultative mechanism for conflicts, and provided for institutional coordination through the National Digital Commission. The comparative evidence points the same way, with even the EU’s comprehensive statute routing financial-sector AI supervision through the financial supervisor.

The respective AI frameworks are still being developed or finalised. On the sectoral side, the Financial Stability Review 2024 remains the most recent public statement of status that could be located. This is the opportunity to agree how they will fit together, before separate regulatory expectations become difficult to reconcile.

Sources
Primary

Digital Nation Pakistan Act 2025 (Sections 4, 8, 28)
State Bank of Pakistan Act 1956, as amended (Sections 46B, 54A)
National Data Governance Policy, June 2026, MoITT
PDA Standards, DNP-D.002 RA, WASL Reference Architecture
SBP Financial Stability Review 2024, Box 3.2
MAS, Guidelines on AI Risk Management, media release, 7 October 2026
FSB, Sound Practices for Responsible Adoption of Artificial Intelligence, final report, 15 October 2026
EU AI Act, Regulation (EU) 2024/1689, consolidated text (Article 74)
World Bank, MENAAP Economic Update, October 2026

Secondary

UK House of Commons Treasury Committee, AI in financial services
Islamabad AI Declaration and Prime Ministerial directive
Saudi Arabia, SDAIA and sectoral regulators

© 2026 Fayyaz Ahmad. All rights reserved. Short extracts may be quoted with attribution and a link to the original. Reproduction, distribution or adaptation in whole or in part otherwise requires the prior written permission of the author.