Data Centers and the Dearth of AI Regulation in Pakistan

By Mehtab Khan

A few days ago, news broke that Pakistan is planning to build a large-scale AI data center with an initial investment of $230 million. The announcement was met with a split in enthusiasm: some celebrated it as a signal of technological development, while others raised alarm about the unfettered use of energy and water in a country already scarce in both resources. Both reactions are understandable but underscore a broader point: we are blindly adopting a new technology without any public participation and regulation.

A recent report by the UN University found that global data-center electricity use could reach 945 TWh by 2030, nearly triple the amount of combined annual electricity use by Pakistan, Bangladesh and Nigeria. The report also noted that by 2030, AI is expected to use as much water as the needs of 1.3 billion people. Ireland recently placed a moratorium on new data center connections until 2028 because the load from data centers became unmanageable. The takeaway here is that Pakistan is making consequential decisions about AI infrastructure without any serious framework for AI regulation.

There is no shortage of AI regulation frameworks in the world right now. The European Union, the United States, the United Kingdom, and Singapore are all working through what it means to govern a technology that may be general-purpose, rapidly changing, and deeply consequential. Pakistan needs to do its own thinking about what AI represents, because the conditions here are not the same. Three principles are worth starting with.

First: AI impacts institutions and people, and those impacts need to be tracked.

This sounds obvious, but we need to challenge the misconception that technology is neutral, instead of seeing it as a tool that reshapes institutions and power relations. Social media reshaped political discourse, journalism, and civil mobilization in ways nobody measured or planned for until the effects were well underway. AI is not neutral either. When a bank uses an AI model to decide who gets a loan, it embeds assumptions about creditworthiness that may reflect historical biases in the data it was trained on. When a government agency uses AI for identity verification, the error rates tend to be higher for women, older citizens, and people with lower digital literacy. When AI is used in criminal justice, it makes assessments from data generated by a system that has not always treated marginalized groups equitably.

These are not merely hypothetical risks but well documented across industries. Just a few weeks ago, a Stanford study found that when different companies adopt the same AI tool to screen job candidates, a candidate rejected for arbitrary reasons by one company would also be rejected by others, without any due process.

Pakistan’s National AI Policy of 2025 does speak of ethics and innovation, but aspiration without implementation is just rhetoric. The solution is documentation, research, and auditing frameworks that have been designed to suit Pakistani contexts. For example, AI systems currently being used in high-stakes domains, such as finance, healthcare, education, criminal justice, need to be periodically audited for their actual effects, not just their intended ones. And this should be mandated by legislation.

Second: Good AI regulation is sectoral, not generic.

One of the signs of ineffective tech policy is a law or framework that treats a technology as a monolith, attempting a comprehensive response. Cybercrime legislation that tries to govern everything from financial fraud to political speech ends up doing neither well. The same trap awaits AI. An AI system that recommends which YouTube video to watch next and an AI system that screens job applicants are both “AI,” but they represent different risk profiles and require entirely different oversight. Pakistan should not adopt a foreign framework wholesale or issue a sweeping national AI policy that sounds comprehensive but means nothing in practice.

This also means resisting the hype. AI systems are impressive but also unreliable. They hallucinate, meaning they fabricate citations and information. They are deficient in performance when deployed on populations that differ from their training data. They fail in ways that are difficult to predict and sometimes impossible to explain. The solution is sectoral regulation. This means asking, for each application: what industry is it being used in and for what purpose, what does this system actually do well, what does it fail at, who bears the cost of those failures, and what recourse exists?

Third: Technology should serve values, and Pakistan needs to decide what those values are.

This is the question that is being asked by policymakers around the world. The EU’s AI Act at its core, states that certain values, such as human agency, fundamental rights, and safety are more important than efficiency. The debates in the US Congress and across US States about data center taxation and AI harms are discussions about who should bear the costs of a rapidly evolving technology.

What does Pakistan want from AI? Faster economic growth? More efficient public services? Greater access to education and healthcare? These are reasonable goals. But without a prior deliberation on the values that shape them, AI can become a tool that optimizes for the wrong things. This includes deploying systems that cut costs by making worse decisions for vulnerable people, or those that accelerate productivity but eliminate skill development. With social media, we never had the values conversation. We got the technology first and are still arguing about what it should and shouldn’t do. The question of values is the most important one and will be recurring every time a new use of AI surfaces.

The data center debate will resolve itself one way or another. What matters more is that it underscores the dire need for structural rethinking about Pakistan’s approach to technology. Would we build a highway without traffic laws? Practice medicine without professional licensing? Introduce drugs into the market without testing? The same logic applies to AI development and deployment. The question is broader than whether to build AI infrastructure. It is whether to build it in a country that lacks the proper frameworks to regulate and distribute the benefits of AI.

Mehtab Khan, Assistant Professor of Law at CSU College of Law; Faculty Associate at Harvard University and Fellow at Yale Law School’s Information Society Project.