National AI Policy 2025: what's missing?

Ambitious and timely though it is, Pakistan's National Artificial Intelligence Policy (2025) lacks comprehensible national data governance policy.

We speak of machine learning before ensuring that the machines have anything reliable to learn from. The NAI policy calls for shared data repositories, provincial AI hubs and algorithmic regulation, but it forgot to answers the fundamental questions, who owns the data? Who safeguards it? Who can share or monetise it? Without addressing these questions AI revolution will remain a dream.

AI systems learn from enormous datasets — on health, education, agriculture, trade or logistics. Unfortunately, in Pakistan, these datasets are either fragmented or trapped in red tape. The proposed National Data Repository lacks an operational blueprint. Moreover, public institutions still operate on paper-based records, while privacy frameworks remain nascent. The draft Personal Data Protection Bill 2023 has lingered for years without clear enforcement mechanisms, expose lack of interest in data governance.

Contrast this with the EU, which sequenced its digital transformation systematically by developing General Data Protection Regulation first, to prioritise the protection of citizens, followed by the Data Governance Act to manage sharing, and finally the AI Act to regulate algorithms. However, Pakistan is endeavouring to regulate AI before defining the legal status of the very data feeding those systems.

Without a comprehensive data governance policy, even the most well-funded AI initiatives will falter. For instance, healthcare AI. The training diagnostic models require access to patient data across clinics, hospitals, pharmacies and insurance systems. Nonetheless without consent procedures and interoperability standards, such sharing is legitimately risky and morally questionable. Likewise, agricultural AI models cannot predict yields accurately when provincial or district departments store data in incompatible formats or restrict access for fear of "data leakage".

This void may create data hoarding. Where public institutions treat information as property rather than a public good, private firms are cautious about sharing proprietary datasets without legal guarantees of confidentiality or compensation. The outcome is fragmentation, where every stakeholder collects data, but no one can harness it.

Successful AI ecosystems began by treating data as infrastructure. Singapore's Smart Nation initiative built unified data catalogues and citizen consent systems years before scaling AI projects. The UAE created a National Data Management Office to set uniform standards for data curation, storage and reuse across ministries. Both countries understood that governance, not algorithms, powers AI adoption.

Pakistan must follow that path. Data is not a by-product of governance rather it is the resource of modern policymaking. Without trusted, interoperable datasets, AI applications in any sector will remain prototypes rather than public assets.

To make it work on reliable grounds I propose a three-step policy re-adjustment:

First, launch a National Data Policy 2.0. This new policy must precede mass AI deployment. It should define ownership, consent, cross-border data flows and commercial reuse rights. This "Data Commons Act" could establish that non-personal government data is open by default, while personal data remains protected by strict access and anonymisation protocols. Second, create Pakistan's data authority. A single regulator, like UK's Office for National Statistics and Information Commissioner, should set standards for data formats, metadata tagging and ethical access. NADRA's digital identity infrastructure can be integrated but must be restricted from commercial use. Third, link funding to data quality. Every AI grant, training programme or public-sector pilot funded through the National AI Fund should require open, auditable datasets as outputs. If an institution receives public funding, it should be mandated to publish its non-sensitive datasets to a national catalogue. This will incentivise transparency and build the habit of data stewardship.

Pakistan's AI policy rightly aspires to global competitiveness. But we cannot harness the potential of AI without structured and authentic data.