Building an Effective Legal Framework for Artificial Intelligence in Bangladesh: Challenges, ComparativePerspectives, and Future Reforms.

Abstract

The rapid growth of Artificial Intelligence (AI) in Bangladesh raises significant legal questions, especially in light of the 2024 July Revolution, which prompted the interim government to prioritize AI in its Draft National Artificial Intelligence Policy 2026–2030. Currently, Bangladesh’s legal framework remains reactive, relying on older laws such as the ICT Act 2006 and Cyber Security Act 2023, which are inadequate for addressing automated decision-making. Key legal challenges include algorithmic bias, autonomous liability, intellectual property gaps, and human rights concerns. This article assesses how local policymakers can learn from established regulatory models, such as the EU’s AI Act and the United Kingdom’s approach, and argues for a dedicated Artificial Intelligence Act supported by an independent regulatory authority, employing regulatory sandboxes to harmonize innovation with constitutional rights.

Keywords: Artificial Intelligence; Bangladesh; AI Regulation; Governance; Comparative Law; Human Rights; Data Protection.

1. Introduction

Artificial Intelligence (AI) has rapidly shifted from a specialized technical tool into a globally disruptive, general-purpose technology. Machine learning algorithms, deep neural networks, and generative AI systems are fundamentally rewriting economic production, public administrative structures, and judicial operations across the globe. For an emerging economy like Bangladesh, AI presents a dual-front reality: an unprecedented opportunity to leapfrog historic developmental deficits, balanced against the critical risk of institutional, social, and legal destabilization if left unregulated.

Following the socio-political transformations initiated by the student-led July Revolution of 2024, the interim government led by Professor Muhammad Yunus actively sought to realign the nation’s technological trajectory.¹ Central to this effort was the publication of the National Artificial Intelligence Policy 2026–2030 (Draft V2.0) under the Information and Communication Technology (ICT) Division. This policy document lays out an ambitious plan to weave AI systems directly into public sector service delivery, educational structures, agricultural management, healthcare diagnostics, and judicial administration.

The rapid deployment of autonomous or semi-autonomous systems creates structural tensions within Bangladesh’s domestic legal order. Algorithmic determinations challenge basic principles of civil liability, evidence, constitutional non-discrimination, and data sovereignty. Bangladesh’s current legislative posture is defined by outdated or overly punitive electronic frameworks that are structurally ill-suited to govern the fluid, “black box” nature of contemporary machine learning models.

2. Existing Legal Framework in Bangladesh

2.1 Constitutional Principles

Any assessment of technology regulation in Bangladesh must begin with the supreme law of the land: the Constitution of the People’s Republic of Bangladesh. Several fundamental rights enshrined in Part III of the Constitution are directly challenged by unregulated AI applications:

• Article 27 (Equality Before Law): Guarantees that all citizens are equal before the law and are entitled to equal protection of the law.² Automated profiling, facial recognition deployments, and algorithmic resource allocation systems frequently create disparate impacts that challenge this constitutional mandate.
• Article 28 (Non-Discrimination): Explicitly bars the State from discriminating against any citizen on grounds only of religion, race, caste, sex, or place of birth.³ If public sector AI tools rely on historical datasets reflecting societal inequalities, their deployment by state organs violates this non-discrimination guarantee.
• Articles 31 & 32 (Right to Protection of Law and Life): Protects life, personal liberty, and the right to be treated exclusively in accordance with the law.⁴ Algorithmic determinations that deny public benefits, predict criminal recidivism, or evaluate employment status without transparent, lawful due process run contrary to these foundational articles.
• Article 43 (Privacy of Correspondence): Guarantees citizens the right to privacy of their correspondence and other means of communication.⁵ Mass web-scraping, biometric data aggregation, and persistent surveillance algorithms directly impinge upon this constitutional zone of privacy.

2.2 ICT Act 2006

The Information and Communication Technology (ICT) Act 2006 represents Bangladesh’s foundational attempt to govern digital spaces. While the Act introduced necessary mechanisms for validating electronic signatures and recognizing digital records, its penal provisions — most notably the controversial Section 57 — were primarily drafted to address discrete human actions like hacking, system damage, and the online publication of defamatory matter.⁶ The ICT Act is silent on autonomous software operations, algorithmic accountability, or automated liability. It views digital misconduct exclusively through the lens of human intent and execution, leaving a substantial statutory vacuum regarding automated harms.

2.3 Cyber Security Act 2023

Enacted to replace the widely criticized Digital Security Act (DSA) 2018, the Cyber Security Act (CSA) 2023 retains a focus on digital speech, unauthorized infrastructure access, and cyberterrorism. While the interim administration initiated comprehensive reviews to strip the CSA of its overly punitive and politically weaponized provisions, the statute remains technically narrow. It contains no clauses governing the unique vulnerabilities introduced by AI deployment, such as adversarial attacks on machine learning models, data poisoning of training pipelines, or the mass generation of hyper-realistic deepfakes designed to compromise national security or public order.

3. Comparative Perspectives

3.1 European Union (EU AI Act)

The European Union’s Artificial Intelligence Act (Regulation 2024/1689) represents the world’s first comprehensive, horizontal statutory framework for AI governance.⁷ The EU model utilizes a strict risk-based classification methodology, breaking systems down into four categories:

1. Unacceptable Risk: Prohibited outright (e.g., social scoring, real-time biometric tracking)
2. High-Risk: Allowed subject to strict ex-ante assessments and audits (e.g., healthcare, education)
3. Limited Risk: Subject to basic transparency requirements (e.g., disclosure of chatbots)
4. Minimal Risk: Free deployment with voluntary codes of conduct (e.g., video games)

High-risk developers must maintain exhaustive technical documentation, implement continuous human-in-the-loop oversight mechanisms, and achieve high levels of cybersecurity and data accuracy. For Bangladesh, the EU model demonstrates the utility of prioritizing enforcement assets on high-risk sectors while leaving low-risk, creative applications free to grow without burdensome compliance costs.

3.2 United Kingdom

The United Kingdom has adopted an explicitly pro-innovation, non-statutory, and decentralized regulatory posture. As detailed in its policy paper A Pro-Innovation Approach to AI Regulation, the UK does not introduce new statutory definitions or create a centralized AI regulator.⁸ Instead, it empowers existing cross-sectoral authorities — like the Competition and Markets Authority and the Information Commissioner’s Office — to enforce five core cross-cutting principles: safety, transparency, fairness, accountability, and contestability. This approach maintains regulatory flexibility, though it assumes highly mature public institutions and robust civil enforcement systems — capacities that Bangladesh is still actively developing.

3.3 UNESCO

UNESCO’s Recommendation on the Ethics of Artificial Intelligence, adopted by member states including Bangladesh, provides a normative global framework rooted in international human rights law.⁹ The Recommendation places heavy emphasis on protecting cultural and linguistic diversity, preserving environmental ecosystems during massive compute processing, and safeguarding gender equality. It explicitly warns against using AI to create unappealable social scoring systems, offering Bangladesh a strong human rights baseline for its domestic drafting efforts.

4. Major Legal Challenges

4.1 Algorithmic Bias and Systemic Discrimination

Algorithmic systems learn by identifying patterns within historical training datasets, meaning they inherently copy, automate, and amplify existing societal prejudices. When public or private entities deploy automated decision-making (ADM) tools for credit scoring, employment recruitment, or public utility distribution, these systems tend to penalize marginalized populations who are underrepresented in digital data. In the socio-economic context of Bangladesh, where a stark digital divide exists between urban and rural populations, an uncalibrated algorithm will systematically misclassify rural applicants as high-risk anomalies. This automated disparate impact represents a direct violation of Article 28 of the Constitution of Bangladesh, which strictly prohibits the State from discriminating against citizens on the grounds of sex, race, caste, or place of birth.¹⁰

4.2 Cybersecurity and the Rise of Deepfakes

Artificial Intelligence drastically lowers the technical barriers to executing complex, automated cyber-crimes, creating severe enforcement challenges for local authorities. Using open-source generative models, malicious actors can now rapidly produce hyper-realistic synthetic audio and video, commonly known as deepfakes, tailored to the Bangla language to bypass biometric bank security, manipulate financial markets, and damage individual reputations. Furthermore, traditional cybersecurity frameworks like the Cyber Security Act 2023 are poorly equipped to address AI-specific digital risks, such as adversarial data poisoning — where attackers subtly corrupt an AI’s training data to cause catastrophic system failures at a later stage.

4.3 Human Rights and Mass Surveillance

The deployment of algorithmic tracking, predictive analytics, and automated facial recognition technology (FRT) in public spaces poses an immediate threat to protected civil liberties. Because these AI systems possess the technical capacity to execute continuous, low-cost, mass-scale monitoring of entire populations, they inherently infringe upon the constitutional zone of personal privacy guaranteed under Article 43 of the Constitution.¹¹ Left unregulated, public sector deployment of these technologies creates a chilling effect on democratic speech and political assembly, allowing state organs to automatically profile, track, and categorize peaceful protesters, journalists, and activists without judicial oversight or prior warrants.

5. Towards an Effective AI Regulatory Framework for Bangladesh

5.1 Implementing a Risk-Based Statutory Model

Bangladesh must avoid drafting rigid, over-inclusive prohibitions that stifle domestic technical growth, opting instead to enact a horizontal Artificial Intelligence Act founded upon a risk-based classification model. Mirroring international standards like the European Union’s AI Act, this statutory approach categorizes AI systems based on their potential to cause real-world harm. Systems that threaten human dignity or constitutional rights — such as state-sponsored social scoring or hidden psychological manipulation — must be subject to an absolute statutory ban. Conversely, high-risk systems used in critical sectors like healthcare, law enforcement, and banking must be allowed to operate only after clearing strict pre-market safety reviews and annual data audits, while low-risk applications, such as entertainment or logistics software, remain unburdened by heavy compliance costs.

5.2 Establishing an Independent AI Authority

To ensure that any newly enacted AI legislation functions as an active regulatory tool rather than a nominal law, Parliament must establish the National Artificial Intelligence Governance Authority (NAIGA). Operating as an independent, statutory commission under the guidance of the Ministry of Law and the ICT Division, NAIGA must be composed of a multi-disciplinary panel of jurists, data scientists, ethics experts, and civil society advocates. The authority’s primary statutory powers must include evaluating and certifying high-risk algorithmic models, running a centralized public registry of automated decision-making systems used within the public administration, and serving as a specialized forum to investigate consumer complaints regarding algorithmic injuries.

5.3 Institutional Capacity Building for the Legal System

The technical complexity of Artificial Intelligence requires a major upgrade to the operational capacity of Bangladesh’s law enforcement agencies, public prosecutors, and the judiciary. The state must integrate technical AI training modules directly into the curriculum of the Judicial Administration Training Institute (JATI) to equip judges with the specialized knowledge needed to assess algorithmic evidence, understand deep learning architectures, and resolve intricate intellectual property disputes. Additionally, the government must invest in setting up specialized digital forensic engineering labs within law enforcement structures to assist police officers in tracing adversarial cyber-attacks, deepfakes, and automated corporate non-compliance.

6. Conclusion

Bangladesh stands at a defining technological intersection. The integration of Artificial Intelligence across public and private sectors offers powerful tools to streamline state bureaucracies, optimize industrial production, and build an efficient digital economy. However, deploying these powerful, autonomous systems within an outdated and fragmented legal framework invites systemic bias, severe privacy violations, and unaccountable exercises of automated power.

Building an effective legal framework for AI in Bangladesh does not require choosing between technological innovation and consumer protection. By moving past reactive legislative measures and enacting a unified, risk-based Artificial Intelligence Act, establishing an independent regulatory authority, and embedding clear transparency and human oversight requirements into law, Bangladesh can protect the fundamental rights of its citizens while building a predictable, trustworthy market for digital innovation. The socio-political renewal of recent years has given local policymakers a unique window of opportunity to ensure the nation’s digital transformation is both economically progressive and firmly anchored within the rule of law.

Cases

• Dr. Mohiuddin Farooque v Bangladesh (1997) 49 DLR (AD) 1 (establishing liberalized locus standi for public interest litigation and recognizing the right to a safe environment under Articles 31 and 32).

Bibliography

Primary Sources — Legislation

• Constitution of the People’s Republic of Bangladesh.
• Copyright Act 2000 (Bangladesh).
• Cyber Security Act 2023 (Bangladesh).
• Information and Communication Technology Act 2006 (Bangladesh).
• Patents Act 2023 (Bangladesh).
• Personal Data Protection Bill (Draft, Bangladesh).

Primary Sources — International Instruments

• European Parliament and Council, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L/2024/1689.
• OECD, Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449, 2019).
• UNESCO, Recommendation on the Ethics of Artificial Intelligence (SHS/BIO/REC-AI/2021/1, 2021).

Secondary Sources — Journal Articles

• Zaman NA, “Policy Brief: AI Policy and Governance in Bangladesh” (2024) 3(1) Journal of Digital Governance and Rights 45.
• Rafi NA, “From Strategic Vision to Policy Framework: A Critical Evaluation of Bangladesh’s Digital Evolution” (2025) 12 Indian Journal of Legal Review 670.

Secondary Sources — Books

• Russell S and Norvig P, Artificial Intelligence: A Modern Approach (4th edn, Pearson 2020).
• Susskind J, Future Politics: Living Together in a World Transformed by Tech (Oxford University Press 2018).

Secondary Sources — Reports

• Department for Science, Innovation and Technology (UK), A Pro-Innovation Approach to AI Regulation (Policy Paper, CP 815, 2023).
• Information and Communication Technology Division, National Artificial Intelligence Policy 2026–2030 (Draft V2.0) (Government of Bangladesh 2026).
• Personal Data Protection Commission (PDPC) Singapore, Model Artificial Intelligence Governance Framework (2nd edn, 2020).
• Tech Global Institute, Reforming AI Laws and Regulation in Bangladesh: Current Harms and Possible Future(s) (Research Report, 2024).
• UNESCO, Readiness Assessment Methodology (RAM) Country Report: Bangladesh (Global AI Ethics and Governance Observatory 2026).

Note(S):

1. Information and Communication Technology Division, National Artificial Intelligence Policy 2026–2030 (Draft V2.0) (Government of Bangladesh 2026).
2. Constitution of the People’s Republic of Bangladesh, art 27.
3. Constitution of the People’s Republic of Bangladesh, art 28.
4. Constitution of the People’s Republic of Bangladesh, arts 31, 32.
5. Constitution of the People’s Republic of Bangladesh, art 43.
6. Information and Communication Technology Act 2006 (Bangladesh), s 57.
7. European Parliament and Council, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L/2024/1689, arts 5–15.
8. Department for Science, Innovation and Technology (UK), A pro-innovation approach to AI regulation (Policy Paper, CP 815, 2023).
9. UNESCO, Recommendation on the Ethics of Artificial Intelligence (SHS/BIO/REC-AI/2021/1, 2021).
10. Constitution of the People’s Republic of Bangladesh, art 28.
11. Constitution of the People’s Republic of Bangladesh, art 43.