Not yet. Bangladesh does not have an AI-specific statute, although government policy work on artificial intelligence has continued and specific rules may follow. In the meantime, AI model procurement is governed by general contract law, the Personal Data Protection Act 2026, copyright and other IP laws, cyber security law, sector regulations for banks, telecoms and other regulated businesses, and public procurement law for government buyers. Because these rules were not designed with AI in mind, the contract does much of the work. We advise on how the existing law applies and draft terms that anticipate likely regulatory developments.

Only if the contract allows it. This is a central AI model procurement issue, and many standard terms allow some use of customer data unless the customer opts out. For Bangladeshi businesses, allowing reuse can conflict with confidentiality duties, bank secrecy, professional obligations and the Personal Data Protection Act 2026. The contract should state clearly whether prompts, uploaded files, outputs and fine-tuning data can be used for training, retained or shared, and how deletion works. We review the vendor's terms and settings, negotiate restrictions where needed, and document the position for the client's data protection records.

Ownership depends on the contract and on intellectual property law, which is still adjusting to AI-generated material. Many vendors assign or disclaim rights in outputs to the customer but keep ownership of the underlying model, while fine-tuned weights and custom prompts may belong to either party depending on the drafting. Copyright protection for purely machine-generated outputs is uncertain in many jurisdictions, including Bangladesh. We draft ownership and licence clauses that give the client the rights it actually needs to use, modify and commercialise what it pays for, and protect against third-party infringement claims. Clear drafting avoids later disputes.

AI vendors usually limit liability heavily and exclude responsibility for the accuracy of outputs, on the basis that the customer decides how to use them. Large enterprise buyers can sometimes negotiate higher caps, indemnities for IP infringement and data breaches, and specific commitments on security and service levels. Liability for decisions made using AI, for example in lending or medical triage, will often remain with the business deploying it. We help clients understand where risk sits, negotiate what is achievable and put internal controls, testing and human review in place for the remaining risk in AI model procurement.

The Personal Data Protection Act 2026 introduces rules on processing personal data and on transferring it outside Bangladesh, and sector regulators may impose additional data location or outsourcing requirements on banks, telecoms and other regulated entities. Many AI services process data in other countries, so a transfer analysis is needed before deployment. Implementing rules and guidance are still developing. We map the data flows in the proposed AI solution, identify the legal basis and safeguards for each transfer, negotiate appropriate data processing terms and, where necessary, recommend local hosting, anonymisation or other technical measures.

Banks should treat AI services as material outsourcing or technology arrangements and apply Bangladesh Bank's expectations on risk management, information security, outsourcing, customer data and business continuity. Board-approved AI policies, model risk management, explainability for credit decisions, fair treatment of customers and incident reporting are all relevant. Contracts should give the bank and its regulator audit and information rights and allow the bank to exit without disruption. We advise banks on procurement, contract terms and governance documents, and on how to explain the arrangement to the regulator if questions arise. Early engagement with the regulator can help.

AI-generated content can carry risk if the model reproduces protected material, if the output imitates a recognisable person or brand, or if the vendor's terms restrict commercial use. In Bangladesh, the Copyright Act 2023 and Trademarks Act 2009 provide the main framework for third-party claims, and consumer law applies to misleading content. We recommend checking vendor IP indemnities, keeping human review of important outputs, avoiding prompts that target specific protected works or people, and keeping records of how content was created. We also review AI clauses in agency and content contracts. Records also help in disputes.

An exit plan should cover return or deletion of the client's data, including fine-tuning data and logs, transfer of any custom models, prompts, code and configurations the client owns, continued service during transition, cooperation with a replacement provider and the cost of each step. Without these provisions in place, a client may find itself locked into a vendor whose prices, terms or model have changed. We negotiate exit terms during AI model procurement, when the client has the most leverage, and make sure they are realistic for the technology and the vendor's operations. Exit costs should be priced.