There is no single statute that requires an AI governance programme as such, but several legal duties effectively require one. Directors must exercise care and diligence over material business decisions, data controllers must comply with the Personal Data Protection Act 2026, regulated firms must manage technology and outsourcing risk to their regulators' standards, and businesses remain liable for consumer, employment and IP breaches caused by their AI tools. A documented AI governance framework is the most practical way to show that those duties are being met. It also prepares the organisation for any AI-specific rules that may follow.

Start with a simple inventory of the AI tools and systems in use, including generative AI used by staff, AI features within existing software, and models built in-house or by vendors. Record what each tool does, what data it uses, who supplied it and which decisions it influences. Then classify uses by risk, appoint accountable owners, adopt a short AI policy and acceptable use rules, and set up an approval process for new tools. We help organisations complete these first steps quickly and then build out more detailed AI governance where the risk profile justifies it.

The Act applies whenever an AI system processes personal data, whether in training, testing, prompting or producing outputs. Organisations need a lawful basis, clear notices, data minimisation, appropriate security, retention limits and processes for data subject rights. Profiling and automated decision-making raise particular concerns about transparency and fairness, and cross-border transfers to foreign AI providers must comply with the Act's transfer rules. Implementing regulations and guidance are still being developed, so we recommend aligning with the core principles now and adjusting as guidance is issued. Data protection is usually the backbone of AI governance in practice.

It can. The EU AI Act applies to providers placing AI systems on the EU market and, in some cases, to providers and deployers outside the EU whose AI outputs are used in the EU. A Bangladeshi software company selling an AI product to European customers, or an outsourcing provider whose AI-supported services are used in the EU, may therefore have obligations or face contractual requirements from EU clients. The obligations depend on the risk category of the system and the company's role. We work with EU counsel to assess exposure and build compliance into the company's AI governance.

Bangladesh Bank expects banks and financial institutions to manage technology, information security, outsourcing and model risk, and to treat all customers fairly. Where AI is used in credit decisions, fraud detection, anti-money laundering screening or customer service, institutions should be able to explain how the model works, test it for accuracy and bias, keep humans involved in significant decisions and report incidents. Contracts with AI vendors should give the institution and its regulator audit and information rights. We help banks and financial institutions design AI governance frameworks that fit within their existing risk and compliance structures.

They can, if the organisation sets clear rules. Uncontrolled use of public generative AI tools can leak confidential information or personal data, produce inaccurate content and create intellectual property questions. Many organisations allow approved tools under enterprise terms with data protection commitments, prohibit entering confidential or personal data into public tools, require human review of outputs used externally and train staff on risks. We draft acceptable use policies and training that strike a balance between productivity and protection, and we review vendor terms to check how prompts and data are handled. Rules should be reviewed regularly.

Liability usually rests with the organisation that deploys the AI system and makes or relies on its outputs, although it may sometimes be able to recover some losses from the vendor under the contract. Claims may arise in contract, negligence, consumer protection, data protection or employment law, depending on the harm. Bangladeshi courts have not yet developed a body of AI-specific case law, so general legal principles will apply. Strong AI governance, including testing, human oversight, records and appropriate contract terms, reduces both the chance of harm and the exposure if a claim is made.

At least annually, and whenever there is a significant change such as a new high-risk AI use, a new law or regulation, a major vendor change or an incident. AI technology and regulation are both moving quickly, and a framework that was adequate a year ago may no longer reflect how the organisation actually uses AI. We recommend a regular review cycle overseen by the accountable owner or committee, with reports to the board. We can carry out periodic legal reviews, update policies and contracts, and brief management on legal developments in Bangladesh and in key export markets.