What is AI regulation in Iraq?
AI regulation: countries and regions
Iraq has no dedicated artificial intelligence law and no comprehensive personal data protection statute in force. AI governance rests on a national AI strategy that remains under development, a Prime Minister led committee and advisory office created from 2023, constitutional privacy rights, and sector rules from the Communications and Media Commission. Organisations must therefore rely on general law, the constitution, telecoms rules and international standards rather than any single AI statute.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
There is no single Iraqi law that defines, classifies or restricts artificial intelligence, and there is no general data protection act of the kind found in the European Union or the United Kingdom. Instead, anyone building or buying AI in Iraq works with a patchwork: the 2005 Constitution, which protects privacy and correspondence; older statutes such as the Penal Code and Civil Code; the Electronic Signature and Electronic Transactions Law of 2012; and rules issued by the telecoms and media regulator.
Iraq has taken policy steps rather than legislative ones. A Prime Minister led committee on artificial intelligence and an advisory office in the Prime Minister's Office have been working on a national AI strategy, but that strategy is still being developed and has not been enacted as binding law. Iraq is also a member of UNESCO, which adopted a global Recommendation on the Ethics of Artificial Intelligence in 2021, and it sits within Arab League and United Nations regional digital initiatives.
For practical purposes, treat Iraq as an early-stage jurisdiction: ambitions and committees exist, but the enforceable rules that touch AI today come from general law, constitutional rights, telecoms regulation and contract, not from an AI act.
Why it matters
The absence of a dedicated framework does not mean the absence of legal risk. Privacy is a constitutional right in Iraq, automated processing of personal data still engages general civil and criminal law, and the Communications and Media Commission regulates the networks, platforms and digital content through which most AI services are delivered. An organisation that assumes "no AI law means no rules" can still face liability for privacy breaches, unlawful surveillance, defamation, or content that the regulator orders restricted.
The flip side matters too. Because there is no comprehensive data protection statute, individuals in Iraq have weaker statutory remedies than they would under a GDPR style regime, and cross-border data transfers are not governed by a clear adequacy or safeguards regime. Buyers and vendors should expect uncertainty: rules can change quickly once a data protection bill or an AI bill is passed, so contracts and governance should be built to absorb that change rather than assume the status quo is permanent.
How it works
No dedicated AI law, a developing strategy instead
Iraq has no binding artificial intelligence statute. The principal national instrument is a policy effort: the Iraqi National Strategy for Artificial Intelligence, coordinated by an AI group in the Prime Minister's Office and an Advisory Office for Artificial Intelligence established in 2023. The Prime Minister's own AI office states on its official site that the strategy is still under development using an agile approach. A Prime Minister led committee on artificial intelligence reviewed the draft strategy in 2024. None of this is enforceable law; it is strategy, governance structure and stated intent.
The constitution as the baseline
The 2005 Constitution supplies the durable rights that AI deployments must respect. Article 17 guarantees every individual a right to personal privacy and protects the sanctity of the home. Article 40 guarantees the freedom and confidentiality of communication and correspondence, including electronic and telephonic communication, which may not be monitored, wiretapped or disclosed except for legal and security necessity and by a judicial decision. Article 38 protects freedom of expression, press and assembly. These provisions are the backstop against unlawful surveillance and intrusive automated profiling, though they are general and have not been elaborated by detailed data protection legislation.
No comprehensive data protection statute
Iraq does not have a general personal data protection law in force. Privacy and data are addressed only through scattered provisions in the constitution, the Penal Code of 1969 and the Civil Code of 1951, plus sectoral rules. There is no national data protection authority, no statutory lawful-basis regime, no general breach-notification duty and no statutory cross-border transfer regime. Iraqi journalist and rights activist Akram Al Sayyab told the digital rights group SMEX in July 2022 that "Iraqi legislators have not enacted any laws regulating the field of journalism and freedom of the press specifically; rather, cybercrimes are addressed based on case law and the principle of referral, as well as on miscellaneous articles from the 1969 Penal Code." As of 2026 no omnibus data protection statute is in force.
The Communications and Media Commission (CMC)
The CMC is Iraq's independent telecoms, broadcasting and media regulator. It was established by Coalition Provisional Authority Order Number 65 of 2004, issued on 20 March 2004, which made it an independent, non-profit administrative body responsible for regulating and licensing telecommunications, broadcasting, information services and other media. The order requires the CMC to be guided by the International Covenant on Civil and Political Rights. In practice the CMC licenses mobile and internet operators, manages spectrum and the .iq domain, and has issued and proposed rules on digital content. It is the regulator most likely to touch AI delivered over networks and platforms, including any rules on online content. Alongside it, the Ministry of Communications runs state telecoms and internet companies and leads digital infrastructure.
Electronic transactions and digital identity
The Electronic Signature and Electronic Transactions Law No. 78 of 2012 gives legal effect to electronic records, contracts and signatures, and is the backbone for digital government and e-commerce that AI systems often plug into. Implementing Instructions issued in 2025 designated the state Informatics and Telecommunications Public Company as the central certification authority and set technical and oversight rules. Separately, the Central Bank of Iraq regulates electronic payment services under Regulation No. 3 of 2014, which is relevant where automated or AI-assisted systems process financial transactions.
Cybercrime: still a draft
Iraq has long debated a cybercrime law without enacting one. The draft had its first reading before the Council of Representatives on 27 July 2011, was formally withdrawn at the Speaker's approval on 6 February 2013, was reintroduced with slight amendments on 12 January 2019, and reached a second reading on 23 November 2020 before being suspended. Human Rights Watch warned in 2020 that Article 3 of the bill set up to life in prison and heavy fines for vaguely defined acts such as "undermining the independence, unity, or safety of the country, or its supreme economic, political, military, or security interests," and in 2021 that the bill "would have allowed Iraqi authorities to prosecute anyone for any social media or online post that they didn't like." As of 2026 no dedicated cybercrime statute has been enacted, so electronic offences are prosecuted through the Penal Code and other general provisions.
Regional and international context
Iraq is a founding member of the Arab League and sits within the Arab Digital Agenda 2023 to 2033, a long-term digital strategy developed by the United Nations Economic and Social Commission for Western Asia (ESCWA) with the League of Arab States. ESCWA and the CMC have jointly run workshops on digital technology policy in Iraq covering cybersecurity, artificial intelligence and cloud computing. Iraq is a UNESCO member state; UNESCO's Recommendation on the Ethics of Artificial Intelligence was adopted by acclamation by 193 member states at UNESCO's General Conference on 23 November 2021 as the first-ever global standard on AI ethics, and UNESCO has delivered AI training to Iraqi participants. These instruments are not binding Iraqi law but shape the direction of travel.
Examples
A telecoms operator deploying an AI fraud-detection or churn-prediction model on subscriber data has no dedicated data protection statute to comply with, but it is licensed by and answerable to the CMC, and it must respect the Article 40 confidentiality of communications, which bars monitoring or disclosure of communications except by judicial decision. The practical control here is the regulator and the constitution, not a privacy act.
A government ministry rolling out an AI-assisted digital service relies on the Electronic Signature and Electronic Transactions Law No. 78 of 2012 and its 2025 implementing instructions to give electronic records and signatures legal effect, with the state Informatics and Telecommunications Public Company acting as certification authority. AI sits on top of this e-government plumbing rather than within a bespoke AI legal regime.
A bank or payment provider using automated decisioning for transactions operates under Central Bank of Iraq oversight, including the electronic payment services regime under Regulation No. 3 of 2014. Automated processing is governed through financial-sector supervision and contract, not a horizontal AI or data law.
Common misunderstandings
"Iraq has an AI law." It does not. There is a national AI strategy under development and a Prime Minister led committee, but no enacted AI statute.
"There is no AI law, so anything goes." Untrue. Constitutional privacy and communication rights, the Penal and Civil Codes, telecoms and media regulation, and financial-sector rules all still apply to AI deployments.
"Iraq has a GDPR style data protection act." It does not. There is no comprehensive personal data protection statute, no data protection authority and no statutory transfer regime in force.
"The national AI strategy is binding law." It is policy and governance, not legislation, and the Prime Minister's office describes it as still under development.
"UNESCO's AI ethics recommendation is enforceable in Iraq." It is soft law. Iraq is a UNESCO member, but the Recommendation guides policy rather than creating directly enforceable Iraqi legal duties.
Risks and boundaries
This article describes the legal architecture; it is not legal advice. The headline limit is that Iraq has no dedicated AI framework and no comprehensive data protection law, so protections for individuals and certainty for organisations are thinner than in GDPR jurisdictions. Constitutional rights are general and have not been fleshed out by detailed privacy legislation, which leaves real uncertainty about how they apply to automated profiling and large-scale data processing.
Several things are pending or could change quickly. A cybercrime law has been repeatedly drafted but not enacted, and its broad drafting has drawn human rights criticism. Calls for comprehensive data protection legislation and for an AI bill continue, and a national AI strategy is in progress. Any of these, if passed, would materially change the picture. Where this article states that an instrument is a draft or under development, treat that status as provisional and verify the current position before relying on it.
What to do next
Map your Iraqi AI activity against what actually applies today: constitutional privacy and communication rights, the Penal and Civil Codes, CMC licensing and content rules, the Electronic Signature and Electronic Transactions Law, and any financial-sector supervision. Do not assume a privacy act exists.
Adopt a recognised governance baseline voluntarily. Because there is no binding AI or data law, use international references such as UNESCO's AI ethics recommendation, GDPR style data minimisation and an AI impact assessment to set your own controls and to be ready for future legislation.
Treat cross-border data carefully. With no statutory transfer regime, rely on contracts, security measures and clear consent, and document your lawful basis under general law.
Watch the legislative pipeline. Track the data protection bill, the cybercrime bill and the national AI strategy, and build contracts and systems that can absorb new duties such as registration, breach notification or impact assessments without re-engineering.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Iraq have a dedicated AI law?
No. As of 2026 Iraq has no enacted artificial intelligence statute. It has a national AI strategy that is still under development and a Prime Minister led committee and advisory office created from 2023.
Does Iraq have a data protection law like GDPR?
No. Iraq has no comprehensive personal data protection statute in force, no data protection authority and no statutory cross-border transfer regime. Privacy is protected only through scattered constitutional, criminal and civil provisions.
What protects privacy in Iraq then?
Mainly the 2005 Constitution. Article 17 guarantees personal privacy and the sanctity of the home, and Article 40 protects the confidentiality of communication and correspondence, which may not be monitored or disclosed except by judicial decision.
Who is the main regulator that touches AI?
The Communications and Media Commission (CMC), Iraq's independent telecoms, broadcasting and media regulator, established by Coalition Provisional Authority Order Number 65 of 2004. It licenses operators and platforms and regulates digital content.
Is there a national AI strategy?
Yes, in development. An AI group in the Prime Minister's Office and an Advisory Office for Artificial Intelligence established in 2023 are developing the Iraqi National Strategy for Artificial Intelligence, which a Prime Minister led committee reviewed in 2024. It is not binding law.
Does the UNESCO AI ethics recommendation apply to Iraq?
Iraq is a UNESCO member state, and UNESCO's 2021 Recommendation on the Ethics of Artificial Intelligence is a soft-law reference point. It guides policy but does not create directly enforceable Iraqi legal duties.
Is there a cybercrime law?
Not yet. A cybercrime bill has been drafted and reintroduced several times since 2011 but has not been enacted. Electronic offences are handled through the Penal Code and general law.
What should an organisation deploying AI in Iraq do now?
Comply with constitutional rights, general law, CMC rules and sector supervision; adopt voluntary international governance standards; handle cross-border data through contracts and security measures; and monitor the data protection, cybercrime and AI legislative pipeline.