Legal and regulatory considerations

The Nepal regulatory environment, 2026

The relevant framework is thin but real:

• The Individual Privacy Act, 2075 (2018). Nepal’s foundational privacy law. Requires consent for personal data collection, prohibits unauthorised disclosure, provides for data subject rights.
• The Electronic Transactions Act, 2063 (2008). Governs electronic records, digital signatures, and cybercrime — old but still the operative framework for digital services.
• Consumer Protection Act, 2075 (2018). Applies to any product or service sold to consumers, including AI products. Requires honest advertising, quality guarantees, and dispute mechanisms.
• Sector-specific regulation. Nepal Rastra Bank (banking, fintech), Insurance Board, Nepal Telecommunications Authority, Nepal Medical Council — each has domain-specific rules that override or supplement general law.
• Draft AI Policy (as of 2026). Nepal’s IT Ministry is circulating a draft National AI Policy. It is not law yet, but it signals direction: emphasis on ethical use, transparency, and locally-serving AI.

Beyond Nepali law, if you serve users abroad — including Nepali diaspora — you inherit their jurisdictions’ rules. Notably:

• EU GDPR if you have EU users.
• India’s DPDPA (2023) if you have Indian users.
• US state laws (California CCPA, etc.) for US users.

Any AI product with an internet-open URL is potentially in scope for all of these.

The five compliance dimensions

For any Nepal-facing AI product, five things need thinking about:

1. Data protection. How you collect, store, and use personal data.
2. Consumer protection. How you represent your product to users.
3. Sector-specific rules. Domain regulations if you operate in finance, health, education, legal.
4. Content responsibility. Liability for what your AI generates.
5. Cross-border data. Which jurisdictions your data touches.

We’ll take each briefly.

Data protection

If your product collects any personal data (name, email, phone, national ID, location), the Individual Privacy Act, 2075 applies. Practical implications:

• Consent. Get explicit consent before collecting personal data.
• Purpose limitation. Use the data only for the purpose stated.
• Data minimisation. Collect only what you need.
• Rights. Users can access, correct, and delete their data.
• Security. Reasonable technical safeguards required.

The Act is less prescriptive than GDPR but not toothless. Sensible practice:

• Publish a plain-language privacy policy (Section 6.1).
• Store personal data encrypted.
• Delete data on request within 30 days.
• Log access to personal data.

AI-specific note. Sending user queries to a foreign model provider (Anthropic, OpenAI) is a data transfer. Users should be aware that their queries leave Nepal for processing. In sensitive sectors, this may become a compliance issue as regulation evolves.

Consumer protection

The Consumer Protection Act treats AI services as consumer services. What matters:

• Honest marketing. “Powered by AI” is fine; “always accurate” is not.
• Disclosure of limitations. Users should know what the product can’t do.
• Dispute mechanism. Users need a way to complain and get resolution.
• Compensation for damage. If the AI’s wrong output causes measurable harm to a user, the CPA may apply.

Practical guidance: the “honest handoff” document from Course 04 Section 6.3 is not just good UX — it’s a form of consumer protection compliance. Users know what they’re getting.

Sector-specific rules

Every regulated sector has domain rules that apply to AI within it:

• Fintech / banking. Nepal Rastra Bank has rules for automated decision-making in credit, KYC, and payments. Any AI touching these areas needs specific NRB review.
• Health. The Nepal Medical Council and Ministry of Health regulate clinical decision support and telehealth. AI diagnostic tools need care.
• Legal. Legal services are regulated; an AI providing legal advice may be treated as unauthorized practice.
• Education. The Ministry of Education has rules for educational software used in schools.

If your product operates in any of these sectors, consult a lawyer who understands both AI and the specific sector before shipping. This is not overcautious — the fines and reputational damage in a regulated-sector failure are much larger than a consumer product.

Content responsibility

The hardest legal question in AI: who is liable when AI says something wrong?

Current best-thinking, 2026:

• The service provider is liable. If your product returned the answer, you are on the hook, regardless of what the underlying model was.
• Disclaimers help, but don’t eliminate liability. “This is AI-generated advice; consult a professional” reduces exposure but doesn’t eliminate it.
• Systematic mitigation reduces risk. Retrieval-grounded answers with citations, refusals in sensitive domains, evaluation and testing — all of these are protective if a claim is ever made.

Concretely: keep your audit log (Section 3.1). If a user claims damage from a wrong AI answer, you need to be able to reconstruct exactly what happened and defend the reasonable care you took.

Cross-border data

Every LLM call to Anthropic or OpenAI is a cross-border data transfer:

• Nepal → Singapore (Anthropic).
• Nepal → US (OpenAI, unless using a regional endpoint).

For general consumer products, this is generally fine. For products in regulated sectors (banking, health, government) or products handling sensitive data (personal ID numbers, medical records), it becomes complicated:

• Some sectors may require data residency (data must stay in Nepal).
• Some contracts (government tenders, enterprise deals) may prohibit foreign processing.
• Foreign jurisdictions’ laws (US CLOUD Act, EU access rules) may apply to data processed there.

Options for handling:

• Use provider-specific residency features. Anthropic and OpenAI both offer enterprise-grade contracts with regional deployment.
• Use open-source models locally. Llama, Mistral, and Qwen models can be deployed on Nepal-hosted infrastructure. Higher operational overhead, but full data residency.
• Anonymise before sending. Strip PII from queries before making the API call; add it back to the response locally.

For most Nepal-scale products, the default of sending queries to Anthropic/OpenAI’s regional endpoints is fine. Know the answer for your specific product.

The lawyer question

At what point does a Nepal-facing AI product need a lawyer?

Not needed:

• A prototype for internal use.
• A hobby project.
• A very small product (under 500 users) with clear scope and no personal data.

Should consult:

• Any product with 5,000+ users.
• Any product taking money from users.
• Any product in a regulated sector.
• Any product handling personal data of children.

Definitely need:

• Any product where an AI output could cause measurable harm.
• Any government contract.
• Any acquisition, funding round, or B2B enterprise sale.

Legal costs in Nepal are modest by international standards (an experienced tech lawyer’s consult may run Rs 5,000-25,000). Spending it before you need it is much cheaper than spending it after.

Watching the regulation

The AI regulatory landscape in Nepal is evolving:

• Nepal’s draft AI Policy will likely become a formal policy in 2027-2028.
• The Data Protection Act is under revision (as of 2026) to align with international norms.
• Sector-specific AI rules from NRB and other regulators are likely in 2027-2028.
• India, EU, and China’s AI rules will affect the norms Nepal adopts.

Follow: Ministry of Communication and Information Technology press releases, Nepal Rastra Bank circulars, and the Nepal Bar Association’s AI working group. Fifteen minutes a month keeps you current.

The compliance mindset

The teams that stay out of trouble share a mindset:

• Assume the rules apply, even when unclear. Better to comply with a rule that might not exist than to fight a rule you didn’t see coming.
• Document decisions. Every compliance-sensitive choice (what data to collect, how to handle refusals, where to send queries) should have a documented rationale.
• Talk to regulators early. If in doubt, ask. Regulators in Nepal are generally reasonable and prefer engagement to enforcement.
• Read what other markets are doing. EU AI Act, India’s DPDPA, US state laws all foreshadow where Nepal will end up.

Compliance is not glamorous. It is one of the few things that can end a small AI product overnight if handled badly. A little discipline goes a long way.

What comes next

The last section — the practitioner’s playbook. Everything from the course, distilled into a checklist and a one-page reference. The document you can carry into your next project.