What is AI regulation in Nepal?
AI regulation: countries and regions
Nepal has not yet enacted a dedicated AI law; instead it approved a National Artificial Intelligence Policy (2082 BS, 2025 AD) to guide AI development. In practice, AI is governed by existing laws on data and technology (for example, the 2018 Privacy Act and the 2022 Data Act) and by sectoral rules. The new policy sets out ethical principles (fairness, transparency) and proposes institutions (an AI Council and Centre) to oversee AI.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Nepal's approach to AI is still emerging. In August 2025 the government approved a National AI Policy that outlines goals for ethical and fair AI use, but this is a policy framework rather than enforceable law. Until formal AI laws or regulations are passed, AI projects in Nepal are subject to the country's general legal system - especially data and privacy laws. For example, Nepal's 2018 Privacy Act defines personal data protections, and the 2022 Data Act covers data governance.
At present, no new penalties or licenses specifically for AI are in force. Instead, the AI Policy calls for future legislation and standards, and sets up an AI Regulation Council and National AI Centre under the Ministry of Communications and Information Technology. These bodies are to guide implementation, monitor AI risks, and align Nepal's rules with international norms.
Why it matters
AI technologies are spreading in Nepal's economy, from agriculture and finance to health and education. Without clear rules, organisations risk privacy breaches, bias or legal uncertainty when using AI. The national AI policy signals the government's intent to manage these risks: it emphasises ethical AI (fairness, non-discrimination, transparency) in line with global standards like the UNESCO AI ethics Recommendation. Companies and agencies should heed these guidelines now, even before formal laws arrive, to build trust and comply with Nepal's data-protection rights.
With Nepal's policy only just endorsed by the cabinet in August 2025, leaders must pay attention. Early alignment can yield competitive advantage (for instance, in fintech or government services) and avoid future pitfalls. The stakes include maintaining public confidence and leveraging AI for development (as in a UNDP-supported project that helped rural women use AI to digitise farm data). Understanding the emerging AI framework in Nepal is therefore crucial for anyone deploying or regulating AI here.
How it works
National AI Policy
Nepal's National AI Policy (called the "AI Policy, 2082 [2025]") was approved by the cabinet in August 2025. It is a soft-law framework, not a binding statute. The policy lays out high-level objectives: for example, it calls for developing AI in ways that are fair, transparent and accountable. Crucially, the policy envisions new laws and institutions. It proposes an *AI Regulation Council* (chaired by the ICT Minister) to set AI standards and an *AI Centre* to coordinate research and governance. Until these bodies are established by law, their guidance is advisory. The policy also directs the government to eventually enact AI-specific laws (including data-security laws and standards for AI systems) and to create frameworks for classifying AI by risk. These steps show Nepal plans a risk-based approach to AI. For now, the policy itself sets general expectations (e.g. guiding values and the promise of future rules) but does not impose immediate legal requirements.
Data Privacy and Existing Laws
In the absence of an AI-specific law, Nepal relies on its existing data-protection and tech laws for AI activities. The **Individual Privacy Act, 2075 (2018)** gives individuals rights over personal data. It came into effect in September 2018, but its implementing rules have not been issued, and there is no dedicated privacy regulator. The **Data Act, 2079 (2022)** focuses on data governance and created a National Data Council and Data Protection Authority, but these bodies are not yet operational. These laws broadly apply to AI when it processes personal or organisational data. For example, if a Nepali company uses AI to analyze customer data, it must follow consent and data-security rules under these acts. Other statutes like the Electronic Transactions Act (2006) and the National Criminal Code (2017) address cybercrime and privacy breach, but they are horizontal laws (covering many technologies) rather than AI-specific. In short, AI projects must currently navigate Nepal's general data privacy and sector regulations until dedicated AI laws are enacted.
Institutions and Oversight
The **Ministry of Communications and Information Technology (MoCIT)** leads AI policy in Nepal. The AI Policy sets up new bodies under MoCIT: an **AI Regulation Council** and **National AI Centre**. The Council (with government officials and experts) will advise on AI standards and ethics. The National AI Centre will serve as the secretariat and focal point for AI projects, research and cooperation. These bodies are proposed but not yet in existence - they require new laws or regulations to be formed. In the meantime, other agencies cover parts of AI activities: for example, the **Nepal Telecommunications Authority (NTA)** regulates telecom networks and online platforms; the **E-Governance Board** drives digital projects; and the **National Human Rights Commission** has shown interest in AI's social impact. However, there is currently no dedicated AI regulator or enforcement office. AI oversight today depends on coordination among existing bodies and adherence to policy guidance.
International Alignment
Nepal aligns its AI approach with global norms. It is a UNESCO member state, and its recent AI dialogue (hosted by UNESCO and MoCIT in 2023) emphasized principles from the UNESCO Recommendation on the Ethics of AI. The national policy reflects this by stressing human rights, non-discrimination, and inclusion. There is no regional South Asia AI agreement, so Nepal looks to UN and UNESCO guidance and to major frameworks like the OECD AI Principles by analogy. Regarding extraterritorial reach, Nepal's laws do not specifically target foreign AI providers; the Data Act indicates that processing Nepal-related data by any entity could fall under its scope, but enforcement on foreign companies would be limited by jurisdiction. In practice, Nepal's regulatory influence is primarily national: it expects companies operating in Nepal to comply, and it may cooperate with international partners on data and AI issues.
Examples
- **AI in agriculture:** A UN-supported project (2024) used AI-powered text recognition to digitize handwritten farm records for rural women farmers in Nepal. By turning paper ledgers into digital data, these women gained insights on crop production and built credit histories. This example shows AI enhancing financial inclusion at the grassroots. The project complied with Nepal's AI guidelines by working with local cooperatives and protecting farmers' data (under the Privacy Act framework). It illustrates how Nepal's AI policy envisions combining technology with social development.
- **AI-generated content:** Consider a Nepali media startup using an AI tool to generate articles or translations. Who owns the output? A recent study notes that Nepal's copyright law (the Copyright Act 2002) has no clear rules for AI-generated works. In practice, this means creators must tread carefully. Currently there is uncertainty about authorship and licensing of AI content in Nepal, pending legal updates. This scenario highlights a gap the government aims to fill: Nepal may need new legal definitions or guidelines to handle intellectual property and liability for AI outputs.
Common misunderstandings
- **Nepal already has strict AI laws.** *Not true.* Nepal's AI framework is a policy, not a binding law. There is no "AI Act" yet; instead the government has set out its plans in a policy document. Any rules for AI will come through future legislation. - **The new AI policy is immediately enforceable.** *False.* The policy guides government strategy and initiatives but does not impose penalties or requirements on companies by itself. Enforcement will rely on existing laws and on new rules that may be introduced later. - **Data protection in Nepal is like GDPR.** *Incorrect.* Nepal's data laws cover government and personal data, but they are weaker than GDPR. For example, the Data Act focuses on broad data governance and has only begun establishing a data authority. Nepal currently lacks a fully functional independent data protection regulator, so compliance relies on self-enforcement under the law. - **International AI rules override local law.** *No.* Nepal does not automatically apply rules from other countries or blocs. For instance, the EU AI Act or CCPA do not directly govern AI in Nepal. Nepal follows international guidelines (like UNESCO's Ethics Recommendation) as a reference, but these are aspirational unless adopted in local law. - **All AI use cases are regulated now.** *Not yet.* Sector-specific laws (e.g. telecom or consumer protection) still apply normally, but most AI applications remain unregulated until Nepal passes AI-specific regulations. Organizations should be aware that unapproved uses (for example, biased profiling) could still violate general laws (such as privacy or discrimination provisions).
Risks and boundaries
Nepal's approach to AI is still under development. The National AI Policy itself has no legal force until Parliament enacts laws or regulations. This means that current legal limits on AI come from general statutes: for example, someone harmed by an AI system would rely on existing civil or criminal law for remedies (there is no special "AI liability" law yet). The policy signals where future rules might go, but exact obligations remain uncertain.
The policy's focus is on promoting ethical AI and coordinating research - it does not, for instance, ban specific AI applications. It warns of risks like bias, privacy violations, and misinformation, and calls for risk-management frameworks. In practice, organizations should assume Nepal will adopt a risk-based regulation: AI systems with potential for harm may face stricter scrutiny once rules are drafted.
Until then, boundaries are set by Nepal's Constitution and laws. The Constitution guarantees privacy and equality; any AI use that infringes those rights could be challenged under existing law. On data, the Privacy Act and Data Act limit how personal data can be used (even by AI). Notably, there are no known sweeping restrictions on foreign AI companies beyond standard jurisdictional limits. In summary, the "AI regulation" framework in Nepal is provisional: it outlines intentions but does not yet change what AI systems are permitted to do.
What to do next
- **Review the AI Policy:** Read Nepal's National AI Policy to understand the government's vision and ethics principles. This will help in aligning your AI strategy with national priorities (for example, citizen rights and local capacity-building). - **Follow existing laws:** Ensure any AI projects comply with current data privacy and tech regulations. Obtain required consents under the Privacy Act, protect data according to the Data Act, and adhere to sectoral rules (e.g. finance or healthcare regulations) that intersect with AI use. - **Engage with policymakers:** Stay informed about rulemaking. The government may soon form the AI Regulation Council or publish draft laws. Industry and civil society should contribute feedback during consultations. - **Implement risk management:** Begin using an AI governance framework internally. Classify AI applications by risk (to safety, privacy, fairness) and put in place checks (testing, documentation, audits). This follows the policy's call to develop a "risk management and AI governance framework". - **Build capacity:** Invest in training and hiring talent in AI ethics, data science, and related fields. The policy highlights human capital development and excellence centers; companies and universities can start creating courses or certifications now. - **Coordinate with international guidelines:** Use global best practices (for example, the UNESCO AI ethics principles or OECD AI guidelines) to supplement local policy. This will prepare organisations for future regulations and demonstrate commitment to ethical AI.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Nepal have a law specifically for AI?
No. As of 2026, Nepal does not have an AI-specific statute. Instead, it issued a National AI Policy in 2025 that outlines principles and goals, but any binding rules would require new legislation in the future.
Who makes AI rules in Nepal now?
The Ministry of Communications and Information Technology leads AI initiatives. The new policy proposes an AI Regulation Council (under that ministry) to draft standards and a National AI Centre to coordinate efforts. Currently those bodies are not yet created, so AI use falls under existing agencies and laws.
Is the UNESCO Recommendation on AI binding in Nepal?
No. The UNESCO Recommendation on Ethics of AI is an international guideline. Nepal endorses UNESCO's principles (and held an AI governance dialogue with UNESCO), but those recommendations do not themselves become Nepalese law unless incorporated by the government.
How do privacy and data laws affect AI projects in Nepal?
Any AI system handling personal data must comply with Nepal's Privacy Act (2018) and Data Act (2022). For example, companies need consent to collect Nepali users' data and must secure it. However, these laws are still developing (the Data Act's regulatory bodies are not fully set up), so enforcement may be limited for now.
Do Nepal's AI rules apply to foreign AI companies?
Currently, Nepal has not established extraterritorial AI rules like GDPR. Its Data Act suggests it covers anyone processing Nepal-related data, but practical enforcement on a foreign company is unclear. In practice, international companies serving Nepali customers should follow local laws where they operate.