AI regulation in Sri Lanka (2026)

A National AI Strategy (2024–2028) titled 'AI Sri Lanka 2028' was developed by the CFSAI and underwent public consultation until 14 March 2025 under the Ministry of Digital Economy. It aims to position Sri Lanka as a regional AI hub, guided by seven principles including transparency, human-centricity, and agile governance.

The Ministry of Technology published an AI White Paper in March 2024 identifying structural challenges — skills gaps, brain drain, and weak data governance — and recommending creation of an AI Innovation Hub, reactivation of the Government Open Data Portal, and a National Centre for AI (NCAI) to coordinate implementation.

The Personal Data Protection Act No. 9 of 2022 — the first comprehensive data protection law in South Asia, modelled on the GDPR — governs processing of personal data including by AI systems. The Data Protection Authority of Sri Lanka was established under it in August 2023 to handle enforcement.

The National Centre for AI (NCAI) is the planned institutional body to execute and coordinate Sri Lanka's AI strategy across government, private sector, and academia. As of August 2025, the NCAI was actively driving implementation of the national AI strategy, though it is not yet a statutory regulator.

As of mid-2026, Sri Lanka has no enacted AI-specific law or binding regulatory framework. Civil-society organisations including Access Now and LIRNEasia have publicly urged the government to introduce rights-protective, enforceable AI regulation, noting the existing strategy lacks mandatory accountability mechanisms.

Sri Lanka's tech industry association SLASSCOM launched the country's first industry-led AI policy framework in 2019 in partnership with ICTA and the Ministry of Digital Infrastructure, covering ethics, skills development, R&D incentives, and sector applications. It served as an early non-binding policy reference that informed later government work.