Cloud, Data Centres and the Legal Gaps Around AI

Nepal has no artificial intelligence law. Softening that into a claim about an emerging framework would describe something that does not exist.

More precisely: no AI statute, no AI regulator, no licensing or registration requirement for AI systems, no risk classification, no transparency obligation, no rule on automated decision-making, no rule on training data, no liability regime for AI output. The Individual Privacy Act 2075 runs to twelve chapters and none addresses profiling or automated decisions. The Copyright Act 2059 (2002), as amended to 24 November 2006, says nothing about text and data mining and nothing about machine-generated works. The Patent, Design and Trade Mark Act 2022 (1965) says nothing about computer-implemented inventions. As a matter of domestic public law, deploying an AI system in Nepal is unregulated conduct.

What applies by default

Where no specific law exists, general law applies. Contract governs the relationship between a Nepali deployer and its supplier. The Consumer Protection Act 2075 governs the sale of goods and services to consumers and reaches an AI-enabled product through that route, without addressing anything specific to it. The Individual Privacy Act’s consent and disclosure restrictions in sections 23, 26 and 27 reach the personal data used to train or prompt a system, though its protection duty in section 25 is framed around public bodies. Criminal provisions in Chapter 9 of the Electronic Transactions Act 2063 reach misuse of computer systems.

None of these instruments was drafted with machine learning in view. A set of questions is left with no Nepali answer: who is liable when an automated decision causes loss, whether training on copyrighted material infringes, whether a Nepali company can be required to explain a model’s output to a regulator, whether a public body may decide something about a citizen by algorithm. A foreign counterparty’s AI governance questionnaire will ask several of these. The accurate response is that Nepali law is silent and the company’s own policy is the only control.

Data residency

Data residency is the constraint that would actually shape where Nepali workloads run, and it is the one this research could not resolve.

What was verified is narrow. Nepal Rastra Bank’s Cyber Resilience Guidelines require, at clause 118, that backups be maintained at a redundant secondary system not located in the same place as the primary, and at clause 120 that backups be protected at rest and in transit. On their face those clauses require geographic separation and say nothing about the secondary site being inside Nepal. The payment institution licensing policy 2079, as amended in 2080, sets licence categories, minimum paid-up capital of NPR 50 million to NPR 800 million, and a 15% ceiling on foreign investment. It states no server location requirement.

What could not be verified is whether the Nepal Rastra Bank Unified Directives 2082 — the current consolidation for A, B and C class institutions, issued by circular in January 2026 and amended through July 2026 — contain a residency requirement. That consolidation is published in Nepali in a form that could not be read reliably here. If a data residency rule binds Nepali banks, that is the most likely place for it. Its absence here is a limit of the research, not a conclusion that no such rule exists, and it is flagged accordingly.

A great deal turns on the answer. If regulated Nepali institutions must keep customer data in-country, Nepal needs domestic data centre capacity and every foreign cloud provider is shut out of the largest domestic IT budgets. If they need only geographic redundancy, the same institutions can buy from any hyperscaler with two regions. Those are opposite investment cases. Establish the answer from the Bank’s directives before committing capital on either theory.

The case for hosting compute

Three things make a data centre argument in Nepal plausible: electricity generated from hydropower, a cool season and elevation that reduce cooling load in parts of the country, and land costs well below regional hubs. Two cut the other way. Nepal is landlocked and its international bandwidth arrives by terrestrial fibre through its neighbours. And the country sits in a seismically active zone, a live consideration for a facility whose value proposition is continuity.

The FY 2083/84 budget, presented on 29 May 2026, put the state on the plausible side of that ledger by announcing a Sovereign AI Computing Centre at Syuchatar supplied with subsidised hydro-compute, framed as part of a hydropower-to-compute value chain. What exists is a budget line. No implementing instrument, allocation, capacity figure, site arrangement or timetable could be verified, and none is stated here.

The announcement still tells a private investor something. The state intends to compete in the domestic compute market, or at least to seed it, and it is willing to contemplate subsidised power for compute. An investor modelling a commercial facility should assume a state-backed comparator with a different cost of power, and should establish the tariff basis before assuming parity. No published Nepal Electricity Authority tariff category for data centres or large compute loads could be verified, so the power price that would drive the whole model is unknown.

The policy vacuum

One might assume Nepal has cloud and AI policy somewhere and that the research simply missed it. The Information Technology and Digital Governance Office, which sits under the Office of the Prime Minister and Council of Ministers and serves as the government’s own IT policy body, publishes a policy category on its website. As at August 2026 that category contains one document: the Information and Communication Technology Policy 2072, published on 20 October 2015.

A 2015 ICT policy is a perfectly good document for 2015. It is addressed to a different technology stack. It predates the general availability of managed Kubernetes, the commercial large language model, and the entire compliance apparatus that grew up around cross-border cloud processing. A government asking investors to build compute in Nepal is asking them to build under a policy written before the workloads existed.

Tax on cloud consumption

One rule does reach cloud services, and it operates on the buy side. A 2% digital service tax applies where a non-resident supplies digital services to a Nepali resident, with a threshold of NPR 3 million. For a Nepali software company buying compute, storage, observability and developer tooling from foreign providers, that sits on the input cost. It is small relative to the underlying spend, and it is the only fiscal instrument that currently distinguishes cloud consumption from any other imported service.

Open questions

Whether a residency rule binds regulated institutions, and where it is written. Whether the Sovereign AI Computing Centre becomes a procurement or remains a paragraph. Whether Nepal’s copyright statute, last substantively amended in 2006, will be read to permit or prohibit training on protected works, a question no Nepali court appears to have answered. And whether the consolidating information technology and cyber security legislation, if it is revived, treats AI at all, since the versions discussed publicly were framed around cyber security and platform regulation rather than around automated systems.

An investor deciding whether to host compute or data in Nepal is deciding under an unwritten framework in the areas that matter most. That is a risk with two faces. Nothing prohibits what is being proposed. Nothing protects it either, and a rule written after the capital is committed will be written without the investor in the room.

Sources

1. सूचना तथा संचार प्रविधि नीति, २०७२ (Information and Communication Technology Policy, 2072)

   Government of Nepal; listed under Policies by the Information Technology and Digital Governance Office · Kartik 3, 2072 (20 October 2015) · Tier 2 — Official publication

   Supports: That the 2015 ICT Policy is the only policy document in the Office's policy category as at August 2026, and that no cloud, data centre or AI policy appears there.

   Accessed 26 August 2026

2. Nepal Budget 2083/84 (2026/27) — Key Highlights

   NBSM (chartered accountants, Kathmandu) · Budget presented 29 May 2026 · Tier 6 — Professional or news source

   Supports: The announcement of a Sovereign AI Computing Centre at Syuchatar with subsidised hydro-compute; the 2% digital service tax on non-resident digital services above an NPR 3 million threshold.

   Accessed 26 August 2026

3. Cyber Resilience Guidelines

   Nepal Rastra Bank, Payment Systems Department · Notified 27 August 2023 · Tier 1 — Primary legal instrument

   Supports: Clause 118 requiring backups at a redundant secondary system not located in the same place as the primary; clause 120 on protection of backups; the absence of any stated Nepal-specific residency requirement in this instrument.

   Accessed 26 August 2026

4. भुक्तानीसम्बन्धी कार्य गर्ने संस्थालाई प्रदान गरिने अनुमति नीति (प्रथम संशोधन, २०८०), २०७९

   Nepal Rastra Bank, Payment Systems Department · Policy 2079; first amendment notified 9 July 2023 · Tier 1 — Primary legal instrument

   Supports: Licence categories and capital thresholds; the 15% foreign ownership ceiling; the absence of a stated server-location requirement in this policy.

   Accessed 26 August 2026

5. WIPO Lex — Nepal country profile: national IP laws and treaty membership

   World Intellectual Property Organization · Profile as at 26 August 2026 · Tier 3 — Multilateral institution

   Supports: That Nepal's copyright statute is the Copyright Act 2002 as amended through 24 November 2006 and its industrial property statute the Patent, Design and Trade Mark Act 1965 as amended through 25 February 2016.

   Accessed 26 August 2026

6. वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ — The Privacy Act, 2075 (2018)

   Government of Nepal · Authenticated 18 September 2018 · Tier 1 — Primary legal instrument

   Supports: The Act's twelve-chapter structure, none of which addresses automated decision-making, profiling or algorithmic processing, and its absence of any cross-border transfer provision.

   Accessed 26 August 2026