Bangladesh Bank Implements Strict Policy on AI Data Usage

In a significant move to enhance data security, Bangladesh Bank has issued a directive that restricts its officials from inputting any confidential or sensitive banking information into artificial intelligence (AI) tools like ChatGPT without obtaining prior approval. This policy addresses rising concerns regarding data protection and the potential risks associated with cross-border information transfer, particularly in financial settings where confidentiality is paramount.

The directive, made effective through an office order dated June 28, 2026, recognizes that the use of AI platforms among bank officials has surged, with tools such as ChatGPT, Gemini, Claude, Grok, and DeepSeek being utilized for various official tasks. These tasks range from drafting office notes to conducting data analysis and preparing reports. However, the Bangladesh Bank warns that using AI tools could inadvertently lead to the exposure of sensitive financial information outside the jurisdiction of the bank, escalating the risk of data breaches and violations of governance policies.

To fortify its stance on data security, the bank has outlined four critical instructions in its directive. First, officials are explicitly prohibited from entering sensitive office information into AI tools. Second, there is a mandatory requirement to seek prior approval before employing AI to undertake any official activities that involve potentially sensitive data, such as policy formulation and data analysis. Third, the bank cautions its employees against using office-related information with AI tools even for personal purposes. Lastly, there is a strict requisition for compliance with existing information security and cyber risk management policies, ensuring continuity in safeguarding the bank’s operational integrity.

This cautious approach by Bangladesh Bank reflects a growing awareness of the potential pitfalls associated with AI in sensitive environments and sets a precedent for other financial institutions to consider similar regulations. As AI technology evolves at an unprecedented pace, the financial sector must recalibrate its operational frameworks to integrate modern technologies responsibly while mitigating associated risks. For procurement professionals, this directive indicates an immediate need to reassess vendor engagement strategies and contract terms, particularly surrounding data handling, vendor oversight, and compliance with strict information security protocols.

The impact of this policy on procurement strategies cannot be understated. Contractors engaged in providing AI and IT services to Bangladesh Bank or similar entities will need to ensure stringent compliance with these newly mandated data security policies. This might mean altering the scope of deliverables, intensifying pre-deployment assessments, and implementing robust approval processes before any AI solution is utilized for banking functions. As the directive reinforces a commitment to responsible AI usage, procurement teams must be proactive in aligning their strategies with this evolving regulatory landscape, which prioritizes security without stifling innovation.

Overall, the Bangladesh Bank’s directive is a vital reminder for financial institutions globally about the delicate balance between leveraging advanced technologies like AI and protecting critical data. As this landscape evolves, staying ahead of regulatory requirements will be essential for contractors and vendors aiming to work within this space, ensuring they are adequately prepared for reassessments that could come as a direct result of such directives.