Iraq's Communications and Media Commission (CMC) released on September 23, 2026 a draft regulatory framework for artificial intelligence services for public consultation, the country's first comprehensive AI rulebook. Issued under the powers the CMC holds under Coalition Provisional Authority Order No. 65 of 2004, the draft opened a 30-day comment window on September 23, 2026, with written submissions due to [email protected] by October 23, 2026.
The proposed regulation reaches every operator offering AI services in the Republic of Iraq, from domestic telecom carriers to international platforms. It sets out to establish compliance, operational and oversight standards covering the use and development of AI, the protection of user rights and data, and the security, safety and transparency of AI systems, while explicitly weighing digital sovereignty and the public interest against the goal of encouraging innovation and investment.
Who must engage with the consultation, and why now?
Any entity that builds, deploys or distributes AI services to Iraqi users falls inside the draft's scope. That includes the three mobile operators licensed by the CMC, Zain Iraq, Asiacell and Korek, alongside internet service providers, over-the-top platforms and the international technology companies whose models reach the Iraqi market. The CMC has invited interested parties and stakeholders to comment, and this window is the practical moment for those operators to shape obligations that will bind them.
The 30-day deadline is short, and the consultation is the only structured input opportunity before the CMC finalises the text. Operators that stay silent accept the framework as written. The instrument is a binding national regulation rather than guidance: once adopted and published in the official gazette Al-Waqai' al-Iraqiya, it enters into force on the date it fixes.
What does the draft framework cover?
The CMC frames the regulation around six objectives drawn from the CMC announcement: regulating the use and development of AI services, protecting users' rights and their data, strengthening security and safety, enforcing transparency, supporting innovation and investment in emerging technologies, and safeguarding digital sovereignty and the public interest. The announcement does not publish the article-by-article text separately from the draft PDF, so compliance teams should read the full draft to map obligations to their operations.
For operators already licensed under the CMC's 2025 Framework Regulations for Digital Platforms and Services, the AI framework layers a new set of duties on top of existing platform, content and data obligations. Expect registration, transparency and risk-management requirements tailored to AI specifically, though the precise thresholds, classification tiers and enforcement penalties will become clear only in the final text.
How does this fit Iraq's existing digital regulation?
Iraq has no comprehensive data-protection law and no AI-act equivalent on the books. A personal-data-protection bill remains under consideration, and until it passes the CMC is the de facto digital-sector regulator. The 2025 digital platforms framework, in force since February 17, 2025, was the closest existing instrument, and this AI draft extends the CMC's remit from platforms and content into algorithmic services.
The draft is distinct from the separate Cybercrime (Informatics Crimes) Law, a 32-article parliamentary bill that criminalises online conduct and carries penalties up to life imprisonment. That bill is still in the legislative process and targets criminal conduct, whereas the CMC's AI regulation is administrative rulemaking for service providers. Compliance teams should track both, but they are independent instruments moving on different timelines.
| Instrument | Status | Key date |
|---|---|---|
| CMC Framework Regulations for Digital Platforms and Services (2025) | In force | February 17, 2025 |
| Draft Regulatory Framework for AI Services | Public consultation open | September 23 to October 23, 2026 |
| Personal Data Protection bill | Under consideration | No date set |
Continuous, per-jurisdiction real-time monitoring surfaces a development like this the moment the regulator publishes it, giving exposed operators the full comment window to respond rather than discovering the rule after it binds.
Subscribe to the free newsletter
Before the October 23, 2026 deadline, exposed operators should take three concrete steps:
- Download the draft from the CMC site and map each obligation to the AI services you operate in Iraq.
- Send a written submission to [email protected], flagging any scope, threshold or feasibility concern.
- Brief compliance, legal and product teams so the final text does not arrive as a surprise.
Iraq's first binding AI rule is being written now, and the consultation is the moment to shape it. Obsidian follows every CMC publication from day one, so your team can engage while the text is still open.
