Nepal's policy moment

What is actually being drafted

It helps to be concrete about which institutions are doing what, because most public commentary treats “AI policy” as a single thing, when in fact it is at least six separate workstreams being pursued by different bodies on different timelines.

1. The data protection regime. The Ministry of Communication and Information Technology (MoCIT) has been working through versions of a personal data protection bill for years. The current draft borrows heavily from India’s framework, which itself borrowed from the EU’s GDPR, with adjustments. Whatever passes will determine what every AI vendor in the country — from a Kathmandu fintech to a foreign cloud-hosted model — can collect, store, and process about Nepali citizens. The drafting choices being made this year are not minor: definitions of “sensitive personal data,” carve-outs for “legitimate state interests,” and the consent mechanism (opt-in vs opt-out) will each shape a different kind of country.

2. Banking and financial AI. Nepal Rastra Bank has, over the last few years, issued a series of directives on digital lending, KYC automation, and risk-model governance. These are not labelled “AI directives,” which is part of why they are under-discussed, but in practice they are the rules that govern credit-scoring models, anti-fraud systems, and automated KYC at every commercial bank, finance company, and licensed payments provider. NRB’s posture — increasingly that vendors must be able to explain their models in plain language and accept liability — is one of the more sophisticated regulatory positions in South Asia, and it is being written largely without public consultation.

3. Digital governance and identity. NITC and the National ID Management Centre are extending the National ID system and the e-governance stack into more services every quarter. Every extension is, implicitly, a decision about which authentication, which logging, which model gets bolted on. The architectural choices being made for the next phase of the digital ID rollout — what biometrics, what API surfaces, what is open and what is closed to commercial integrators — will define the default privacy posture of the state for a generation.

4. Election integrity and political advertising. The Election Commission of Nepal has begun, cautiously, looking at the question of AI-generated political content and paid political advertising on platforms. There is no rule yet. There is going to be one. Whether it follows the EU’s approach (disclosure requirements on platforms), the Indian approach (legal liability for the political party), or invents something specific to Nepal’s federated party structure is being decided in conversations happening now.

5. Telecom and platform regulation. The Nepal Telecommunications Authority (NTA) and the broader question of platform regulation — what obligations sit on TikTok, Meta, Google, and the major Nepali platforms — has been driven so far by content-takedown politics. The next round will inevitably touch AI-generated content, recommendation systems, and the question of whether platforms must publish anything resembling an algorithmic transparency report. The framing of that round has not been set.

6. Sectoral AI use in health, education, and agriculture. The Ministry of Health, the Ministry of Education, and the various agricultural research councils each have small, mostly-internal conversations about where AI fits in their service delivery. These conversations are early enough that one well-prepared technical person in the right meeting can shift the default for a whole sector. They are also late enough that the foreign vendors are already there with PowerPoints.

Why this window is unusually short

Policy windows close in two ways. They close when a rule passes and becomes hard to amend. They also close, more quietly, when a draft sits long enough that its assumptions become the unspoken default — when “the bill says X” becomes “of course it says X, what else would it say?”

Both of these are happening in Nepal in compressed timelines. The data protection bill has been in drafting long enough that several of its definitions are now treated as settled even though the bill has not passed. The NRB directives are issued in tranches and rarely reopened. The digital ID architecture has crossed enough milestones that proposing a different cryptographic backbone now is treated as obstructionism rather than design.

The compressed-timeline problem is made worse by a specific Nepali pattern: the country has a small number of technically fluent professionals who could meaningfully read a draft directive, and most of them are employed in the private sector with no formal channel into the policy process. The drafters, mostly lawyers and generalist civil servants, are doing their best to interpret foreign templates without the technical advisors who could tell them which clauses will actually bite. The result is laws that look modern on paper and fail in implementation because nobody in the drafting room knew, for example, that “the model must be auditable” is a sentence with at least four incompatible technical meanings.

What an ordinary professional can actually do

The honest, useful version of “civic engagement on AI policy” in Nepal in 2026 is not about giving speeches or writing op-eds, though those help. It is about a few concrete actions that are open to a Kathmandu software engineer, a Pokhara data analyst, or a Birgunj small-business owner with technical fluency, and that have surprisingly high leverage given how thinly the policy process is staffed.

1. Read the actual drafts. Most of them are published, in English and increasingly in Nepali, on ministry and regulator websites. Most are not read by anyone outside the drafting committee. Reading one and writing a serious, specific comment — not “this is bad,” but “clause 12(b) defines ‘automated decision’ in a way that excludes credit scoring, here is why that matters, here is a one-sentence fix” — is a contribution most committees will actually engage with, because they get so few of them.

2. Show up to consultations. When MoCIT, NRB, NITC, or the Election Commission holds a stakeholder consultation, the room is usually thin on technical voices. A professional who shows up, asks one well-prepared question, and follows up in writing afterwards is, in practice, a meaningful fraction of the technical input on that draft.

3. Build the missing public datasets. Many of the regulatory failures in this space are downstream of the fact that regulators have no independent way to verify vendor claims. There is no public Nepali-language benchmark for credit-scoring fairness, no public face-recognition dataset that lets a regulator test a CCTV vendor’s accuracy claims on Nepali faces, no shared corpus that would let anyone evaluate whether a chatbot handles Maithili or Bhojpuri-inflected Nepali. Building even small versions of these — and releasing them openly — gives regulators a tool they currently do not have and shifts the burden of proof onto vendors.

4. Join, or create, the standing technical advisory groups. A few of the regulators have informal advisory groups; most do not. Offering to be on one, or convening a small group of peers who collectively offer the same, is a low-glamour, high-leverage move. The decisions get made in those rooms. The room currently has empty chairs.

None of this is about becoming a policy professional. It is about the unusual fact that, in Nepal in 2026, the policy process is thin enough that a serious technical citizen can have outsize influence, and the window in which that is true is roughly the time it takes to finish this course and act on it.

Check your understanding

Quick check

—

A Kathmandu-based software engineer with no political connections wants to make a real contribution to Nepal's AI policy moment in 2026. Which of the following is the most realistic and high-leverage thing she can actually do?

1. AWait until she has a senior government role before engaging — drafts are technical and require formal authority to influence.
2. BWrite opinion pieces in English-language newspapers about long-term AGI risk.
3. CRead the published drafts of bills and directives (data protection, NRB digital-lending, etc.), submit serious clause-level written comments, attend consultations, and help build the few small Nepali-language datasets that would let regulators independently evaluate vendor claims.
4. DLobby foreign AI labs to release safer models, since Nepali policy will follow whatever they do.

Check answer→

What comes next

You now have the course’s basic posture: ethics is mostly present-tense and bureaucratic; three lenses (fairness, autonomy, accountability) make the silent questions visible; and Nepal is in a policy window where ordinary technical citizens have unusual leverage. The next chapter — Bias and fairness — takes the first lens and goes deep: how bias enters a model, why headline accuracy hides it, what “fairness” actually means when it has to be operationalised, and how a Nepali team can check for it before deployment instead of after the journalist calls.