By Shahid Raza
In May, I spent almost a week in Nairobi with public officials from 20 countries, examining how governments can effectively govern technologies that are largely developed beyond their borders.
The training, run with the ITU and funded by the European Union’s Global Gateway initiative, brought together 30 regulators, policymakers, and digital practitioners, according to UNESCO.
According to the ITU Academy’s course outline, the program covered procurement and data fundamentals, ethics, and global regulatory approaches, concluding with each group designing an AI-enabled public service and proposing how it should be governed.
The challenge extends well beyond training. Governments across the Global South must make decisions about technologies whose development, infrastructure, and commercial direction are often controlled elsewhere.
The UN Secretary-General’s High-Level Advisory Body on AI found in 2024 that 118 countries, mostly in the Global South, were party to none of the seven major non-UN AI governance initiatives it examined, while only seven were party to all of them.
UNCTAD reported in 2025 that just 100 firms, mainly American and Chinese, account for about 40% of global corporate R&D spending. Stanford’s 2026 AI Index found that the computing behind leading models depends almost entirely on a single chip foundry in Taiwan. For many countries, the practical governance priority is therefore to strengthen oversight of how AI is acquired and used while gradually expanding their influence over how it is developed.
Building the foundations of AI governance
Effective AI governance requires more than a regulatory framework. It depends on whether public institutions have the people, infrastructure, and data systems needed to implement it.
UNESCO’s competency framework for civil servants, which the Nairobi course draws on, highlights three areas for sustained investment: organisational readiness, data and infrastructure, and AI skills. A South African government AI task force brief, drawing on the OECD Digital Government Index, reported that only 18% of senior civil servants understood AI procurement and lifecycles adequately. This points to a practical gap: governments cannot effectively oversee systems they lack the expertise to assess.
The foundations are also at different stages of maturity. UNCTAD’s Cyberlaw Tracker showed that 71% of countries had data protection laws by the end of 2021, compared with 48% of the least developed countries. The World Bank estimated in 2025 that 800 million people still lack official identification.
Language is another consideration. Researchers behind IrokoBench found that the best-performing model trailed its English-language performance by up to 28% on African languages. Such gaps matter when governments consider using AI for public services in communities whose languages and needs may be poorly represented in training data.
These gaps affect more than technological progress. They influence whether people can access digital services, whether their data is adequately protected, and whether AI systems work well in their local contexts. Effective governance must therefore combine legal development, inclusive digital infrastructure, and the capacity to evaluate systems against local needs.
Balancing investment with accountability
This creates a familiar policy balance. The state must attract AI investment while establishing proportionate safeguards, with each measure assessed for both its public value and its effect on competitiveness.
Several initiatives illustrate how this balance can be approached. UNESCO quoted a participant from Assam, India, who took away the lesson that AI works best when built on strong digital public infrastructure, and a colleague from Madagascar who saw promise for justice services if human oversight is preserved. UNESCO said it is working with the Kenya School of Government to train 20,000 officials by 2027.
India’s Press Information Bureau said its AI Mission carries an outlay of about $1.1 billion and has onboarded 38,000 GPUs, though MediaNama reported, citing a parliamentary reply, that about $42 million had been released by early 2026.
Rwanda and Kenya offer examples of legal development and enforcement. The OECD.AI Policy Navigator recorded that Rwanda gazetted its data protection law in 2021, while The Future Society reported that its cabinet approved a national AI policy in 2023. Law firm Bowmans reported that Kenya’s data commissioner fined Oppo Kenya about $38,600, or 5 million Kenyan shillings, in 2022, the highest penalty permitted under the law. Brazil’s AI bill, passed by the Senate in December 2024, was still awaiting a committee opinion in the Chamber of Deputies as of July 2026. These examples indicate that progress is strongest when policy ambition is matched by institutional capability, clear implementation milestones, and credible oversight.
Pakistan’s AI ambitions and the sovereignty question
Pakistan’s journey merits the same balanced assessment. The country has taken steps to establish a national framework, develop computing capacity, and coordinate public and private sector participation. The next question is whether these efforts will be matched by the institutional safeguards needed to make them effective.
The Digital Nation Pakistan Act took effect in January 2025, according to the Digital Policy Alert database, establishing the Pakistan Digital Authority with a mandate covering data governance and AI. The Express Tribune reported last year that the Pakistan’s federal cabinet approved the National AI Policy in July 2025, with a target of training one million AI professionals by 2030. Pakistan’s Press Information Department reported that the National AI Taskforce was developing an implementation roadmap through collaboration among government, academia, and industry. Dawn welcomed the policy while identifying scope for a fuller treatment of AI risks and impacts.
Infrastructure is another part of the picture. Pakistan’s prime minister inaugurated Sky47’s Karakoram-01 in July 2026. According to ZTE, the data centre has 8.5 MW of capacity. It is located within the Capital Smart Technology Zone and operates under the independently administered framework of the Special Technology Zones Authority. In August this year, Pakistan’s IT minister confirmed in written reply to the National Assembly that the National Telecommunication Corporation’s (NTC) sovereign data center in Karachi had entered the procurement stage.
Sovereignty is best understood as a combination of infrastructure, law, and institutional capability. A sovereign cloud can keep data on Pakistani soil, but complementary measures must clarify who may access that data, provide independent enforcement, and equip officials to audit what the state buys. Pakistan has established important elements of this architecture, and the opportunity now is to develop the necessary safeguards and capabilities alongside the infrastructure.
5 priorities for Pakistan
Five practical steps could help turn this ambition into a more durable approach to AI governance.
First, advance data protection legislation. Pakistan needs a framework that provides for an independent commission, clearly defined exemptions, and credible enforcement. These protections should develop alongside sovereign computing capacity, ensuring that domestic data storage is supported by rules governing access and use.
Second, define what makes a cloud service sovereign. TechJuice reported that seven applications were seeking accreditation under the cloud-first framework. Transparent criteria could require disclosure of computing capacity, hardware, ownership, and the terms governing state access. Such criteria would give public institutions a clearer basis for evaluating providers and understanding the limits of their control over the underlying infrastructure.
Third, make procurement a central governance tool. Public-sector AI contracts should include appropriate audit rights, documentation requirements, security obligations, and exit clauses. Governments need to know how systems are assessed, what happens when a supplier changes its service, and whether they can move away from a system that no longer meets their requirements. Procurement rules can turn broad governance principles into obligations that providers must meet.
Fourth, invest in public officials alongside technical infrastructure. Pakistan’s target of training one million AI professionals by 2030 is ambitious, but general AI skills and the specialist capabilities needed to govern public-sector systems are not interchangeable. A dedicated civil-service training stream could equip officials to assess procurement proposals, evaluate risks, and monitor performance. Kenya’s target of training 20,000 public officials by 2027 offers one example of a more focused public-sector approach.
Fifth, give the AI Council a practical implementation role. Working groups with published mandates and annual reports could help translate policy into measurable action. Industry could make computing resources available for independent testing; universities could develop evaluation laboratories and datasets in Pakistan’s own languages; and civil society could contribute to a public register of AI systems used by government. Clear responsibilities and regular reporting would help establish whether initiatives are delivering their intended results.
These priorities do not necessarily require a broader law or a larger announcement. They call for careful sequencing, proportionate disclosure, and credible review mechanisms. Countries that govern AI effectively are likely to be those that regularly assess whether their frameworks can be implemented and then invest in the institutions needed to deliver them. For Pakistan, strengthening these foundations alongside its growing data-centre infrastructure would help convert investment into durable digital sovereignty.
About the author: Shahid Raza examines how emerging technologies and AI governance intersect with public policy, institutional capacity, and economic development in Pakistan and the Global South.
