AI regulation in Bangladesh: laws & policy (2026)

The interim ICT Division published the second draft of the National AI Policy 2026-2030 on the dedicated portal aipolicy.gov.bd, closing public input in early February 2026. The draft introduces a risk-based classification for AI systems, prohibits mass surveillance and social scoring, mandates algorithmic impact assessments for high-risk applications (judiciary, biometrics, law enforcement), and commits Bangladesh to aligning with the Council of Europe's AI Framework Convention; a permanent Artificial Intelligence Act is planned for 2030.

The interim government gazetted the Cyber Protection Ordinance 2025, replacing the Cyber Security Act 2023. It is the first legal instrument in South Asia to explicitly name AI as a vector for cyberoffences, covering deepfakes, AI-generated disinformation, and autonomous hacking, and also introduces a legally recognized right to internet access; critics note it lacks a functional definition of AI and enforceable ethical safeguards.

Student protests over civil-service quotas escalated into a nationwide uprising that forced Prime Minister Sheikh Hasina to flee on 5 August 2024, ending 15 years of Awami League rule; an interim government under Nobel laureate Muhammad Yunus took power. The political rupture froze the Draft Personal Data Protection Act 2023 and the National AI Policy 2024 draft, both of which had been advancing through government channels.

The ICT Division released the third draft of the National Artificial Intelligence Strategy, marketed also as the National AI Policy 2024, covering ethical AI principles, a proposed national AI regulatory authority, sector-specific deployment guidelines for health, education, agriculture, and the judiciary, and data-governance requirements; it was developed in partnership with UNESCO and UNDP and opened for stakeholder consultation.

The government formally established the Agency to Innovate (a2i) via SRO No. 20-Law/2024, operationalising the a2i Act 2023. Governed by an 18-member board chaired by the ICT Minister, a2i is the designated national body for AI-enabled public-service innovation and digital public goods, making it the primary implementing arm for government AI deployment.

The Cabinet approved in principle the Personal Data Protection Act 2023, proposed by the ICT Division, which would set cross-sectoral rules on the collection, processing, storage, and transfer of personal data and create a Bangladesh Data Protection Board; the bill was sent for law-ministry vetting but never reached parliament, leaving AI training-data governance without a statutory framework.

The Jatiya Sangsad passed the Cyber Security Act 2023, establishing a national Cyber Security Agency with investigatory and directive powers over public and private entities and designating Critical Information Infrastructure relevant to AI-driven public services; it removed some (but not all) speech-restriction provisions from the DSA 2018, drawing continued criticism from civil-society groups.

Parliament enacted the Agency to Innovate Act 2023, converting the previously UNDP-supported a2i programme into a permanent statutory agency under the ICT Division mandated to scale AI-driven digital services and public-sector innovation across Bangladesh, institutionalising AI-led government transformation for the first time.

The Digital Security Act replaced the ICT Act 2006 and became the dominant legal framework governing digital platforms, algorithmic content distribution, and cybercrime for five years; its sweeping provisions, including warrantless arrest powers and offences for 'damaging the image of the nation', were widely misused and drew Amnesty International and UN criticism, directly motivating the legislative reform cycle that produced the CSA 2023 and CPO 2025.

Bangladesh's first major digital-era statute established the legal basis for electronic transactions, cybercrime offences, and digital governance, laying the regulatory groundwork later applied to AI-adjacent technologies; Section 57's broadly worded 'offensive online content' provision became a notorious tool of suppression, ultimately driving the 2018 and 2023 legislative overhauls.