The Strategic Crossroads : An Interview with Shahzad Arif

Question 1How can Pakistan convert its evolving geopolitical position into measurable economic gains, and what specific policy, institutional and security reforms are needed to ensure that diplomatic achievements translate into actual investment, industrial growth and employment rather than remaining announcements and commitments?

Shahzad Arif: Diplomacy opens the door. Only execution at home brings the capital through it. Start with what’s gone right. Two agencies upgraded us this year, reserves are back above twenty billion dollars against under three a few years ago, and foreign investment was up about twenty percent in the first quarter. The floor has been rebuilt. But look at those same three months. Foreign investors took more out in profits and dividends than came in as net new investment. Different accounts, so they don’t cancel. It still tells you something. And it isn’t an argument for stopping profits leaving, because that is what makes the next investment possible. It’s that the inflow is too small beside it. One thing would do more than any roadshow. Publish a quarterly ledger of every framework signed since 2023. Pledged, contracted, disbursed, with the responsible ministry named on each line. Vietnam won manufacturing by shortening the distance between signature and first shipment. Beyond that, fix the tax position in law rather than in an order that can change next year, and make repatriation work by rule. Those two decide whether a factory gets built here as much as whether a data centre does. On security, one named office is accountable for the safety of foreign staff and project sites, reporting into that same document. Nobody expects a guarantee that nothing will happen. They want to know who answers when it does. And there’s a lesson sitting right there. Trade with Afghanistan fell from about one and a third billion dollars to under four hundred million in a year while the crossings were shut. Not one software export was interrupted.

Question 2How realistic is the $10 billion target of Pakistan IT exports under current conditions, and what fundamental changes in business models, access to capital, talent development, international market access and industry-academia collaboration would enable Pakistan to build globally competitive technology companies rather than remain primarily a supplier of relatively low-cost digital services?

Shahzad Arif: Reachable. Not on the way we’re doing it now. Credit first. We closed last year at a record, four point six billion dollars, up twenty-one percent, inside the government’s own range. The first quarter was up nearly eighteen. Then the arithmetic. Keep that rate for three more years and we arrive at about seven and a half billion. Fine number. Not the target. The target needs close to thirty percent a year. The gap is in what we sell. Freelance work is about ninety percent of our export transactions and about a quarter of the value. The average freelance payment is a few hundred dollars. The average consultancy payment is over twelve thousand. And the median freelance payment is falling. We’re adding sellers faster than we’re adding value per sale. Four things change that. Finance for the founder with no investor and no receivable, who’ll spend two years building before he can invoice anybody; the fund we have only tops up a round you’ve already raised. A bridge from university to industry, because the supply of graduates isn’t the problem, one in ten being ready on day one is. Payment and compliance mechanics, where we lose more deals than we ever lose on engineering. And procurement, because the rules were rewritten last month and local preference covers goods and works, not services, so software falls outside. One clause fixes that. The target is reachable. It won’t be reached by selling more hours.

Question 3How exposed is Pakistan’s digital economy to a major disruption of international connectivity or cloud services, and which investments and regulatory measures should be prioritised to protect critical financial and commercial systems? Can Pakistan develop a secure domestic cloud and digital infrastructure ecosystem that not only protects national interests but also attracts international clients and positions the country as a regional digital hub?

Shahzad Arif: The answer has changed, and not the way people expect. The cable problem is getting solved. The legal problem isn’t. We now have six submarine systems and a terrestrial route, about seventeen and a half terabits installed, around thirteen of it lit. Africa-1 came ashore at Karachi early last year, SEA-ME-WE 6 launched in November, and part of that is still being switched on. Real redundancy where there used to be very little. What hasn’t moved is the law. No data protection statute. No regulator. Drafts going round for eight years and not one reaching a vote. Meanwhile a great deal of our commercial data sits on infrastructure that answers to a foreign court. That isn’t a technology gap. It’s a legislative one. And most of the work is done. There’s a governance policy drafted, classifying data and setting residency rules, waiting for notification. Cloud accreditation opened in May. Then enforcement, and this is the figure that stops you. Since 2023 the cybercrime agency has taken more than half a million complaints and secured under two hundred convictions. A capable investigator can’t carry a case the rest of the system can’t finish. So, four things. Finish the second cable landing, because every cable we have comes ashore at Karachi and the Makran Gulf Gateway is already named as planned. Make the failover test a routine return to the regulator rather than something checked internally; banks have had to test continuity plans since 2004, but nobody outside sees the result. Pass the data protection law. And notify that policy. Hosting is won on power, latency and legal certainty. We’re short on the third, and it’s the cheapest to fix.

Question 4How would you assess the 2026-27 budget’s effectiveness in addressing the structural problems faced by IT exporters, freelancers, startups and technology entrepreneurs? Which three or four additional reforms should the government prioritise over the next 12 months to improve ease of doing business, facilitate cross-border payments and help smaller software houses scale into internationally competitive product companies?

Shahzad Arif: A confident down payment, and I said so at the time. It extended the quarter-percent rate on IT exports out to 2029, so a founder signing a three-year contract knows the rules will hold. The most useful thing wasn’t in the budget at all. In April the State Bank dropped the per-transaction form for service receipts under twenty-five thousand dollars and set a one-day turnaround on export proceeds. For a twenty-person house, that is real. Where it stopped short is the transition. A concessionary export rate rewards invoicing. It does nothing for the company spending two years building something before it invoices anyone. The industry asked for ten years and got three. And the retention limit has sat at fifty percent since

2023. So, four things for next year. The incentive horizon in primary legislation, at ten years. A higher retention limit. That product-development financing line with a partial guarantee. And one compliance window across FBR, the State Bank, SECP and PSEB. None of it needs a large outlay. All of it is administratively hard, which is why it’s worth doing.

Question 5Why has Pakistan struggled to translate its strategic relationships and investment commitments into sustained foreign direct investment, and what would a credible investor-confidence framework look like in practice? How should the government measure success beyond signed MOUs, and which institutional reforms would make international investors more confident about committing long-term capital to Pakistan?

Shahzad Arif: Because investors don’t price relationships. They price enforceability. And we finally have a number for it. The World Bank puts a first decision on a commercial dispute here at around seven hundred days. Call it two years. Another six months to enforce. Bottom fifth of the economies they assess. No tax incentive compensates for that, and every investment committee knows it before it reaches the page with the incentives on it. The encouraging part is that the work has started. A committee was set up in June on commercial courts. The Law and Justice Commission has recommended an international commercial court. And an arbitration act drafted on the international model, replacing a statute from 1940, is waiting on the calendar. None of it needs inventing. A credible framework answers four questions and no memorandum answers. Will my tax position change before I get my capital back? How long until I hold a judgment I can enforce? How do I take profits out, and does that rule survive a squeeze? And when it stalls, who owns the decision? Not which committee. Which office. On measurement, retire the memorandum. Publish the disbursement ledger, and two numbers beside it. How long a commercial judgment takes. How long a repatriation takes to clear. Then move them. Two years coming down to one would do more than any delegation, because it’s the one claim an investor can check without trusting anybody. Stability earned us the meeting. Institutions win the money.

Question 6What national strategy should Pakistan adopt to compete in the AI economy, particularly in computing infrastructure, competitively priced power, AI research, workforce reskilling and locally developed technology products? How can Pakistan ensure that AI becomes a source of higher-value exports, productivity and skilled employment instead of deepening the gap with countries investing more aggressively in advanced technology?

Shahzad Arif: Computing capacity is infrastructure now, the way a port is. And this wasn’t a blank year. A data centre opened in Islamabad in July, eight and a half megawatts with room well beyond that. A GPU cluster came online in Lahore in August. One Karachi operator says it has secured over three thousand accelerators. Set that against India’s national mission at more than thirty-eight thousand, and Saudi Arabia talking in hundreds of thousands. We’re late and we’re small. But we’ve started. Here’s the number for anyone who thinks this can wait. We send something like seven, maybe eight hundred million dollars a year out of the country for cloud and compute. That’s an import bill a domestic industry could substitute. So, price the power. There’s still no dedicated tariff for data centres and they pay commercial rates. Four days ago the chief executives of the four largest telecom operators wrote to the Prime Minister asking for industrial treatment for licensed digital infrastructure. They’re right. A data centre turns electricity into computation and goes wherever that conversion is cheapest. Then stand up the governance behind the AI policy, because a billion dollars has been pledged and the council and the committees have lagged. Fund research against industry problems rather than publication counts; we’re at about two tenths of one percent of GDP against South Korea’s four and more. And reskill the people already in work, because the tasks being automated first are the ones our mid-career people were hired to do. One last point. Urdu is about three hundredths of one percent of the pages these models are trained on. If we don’t build for our own language and our own regulated industries, nobody will.

Question 7What reforms are needed to align universities and technical education with the requirements of the AI-driven economy, retain talented professionals and create attractive opportunities at home? Separately, what regulatory, investigative and technology-based safeguards should Pakistan introduce to ensure examination security, transparent remedies and fair treatment for students affected by failures beyond their control?

Shahzad Arif: Two parts, and the same idea runs through both. Institutions have to answer to the people who depend on them. On human capital, one figure carries it. We spend about eight tenths of one percent of GDP on education, against one and a half three years ago. Around twenty-six million children are out of school. And the Higher Education Commission’s recurring grant has sat near sixty-six billion rupees since about 2017, while enrolment, salaries and prices all rose. There’s better news too. Literacy restated at sixty-three percent, and emigration easing rather than accelerating. The practical reform is half built. Every undergraduate programme now has to include a supervised internship of three credit hours, but the rule says nothing about pay and isn’t tied to the final year. Make it paid, put it in the final year, let the employer set the problem. And retention is priced, not persuaded. An engineer with a Dubai offer stays if the work here is interesting and the pay isn’t insulting. Now, examinations. Last year’s series was disrupted and the students who followed every rule carried the consequences. Think about what that’s like. You prepare for two years, you sit the paper, and then you learn it was circulating before you walked in. Several things since then deserve recognition. The awarding body went back to one paper’s data, reversed its own decision, graded those students on what they’d actually written, and offered a free retake in November. Pakistan put Cambridge International on the IBCC register in May. What’s left is turning that into an obligation. Publish the approval notification with its conditions. And make the fee waiver, and the student’s choice of which result counts, standing entitlements rather than concessions granted under pressure. You asked about investigation and technology as well. Investigation is a job for the investigators; what they’ve reported is that they can’t reach servers held abroad. On technology, Cambridge began on-screen exams in June, in six subjects, and we weren’t in that first wave. We should be asking for the next one, and for the highest-risk papers first.

And underneath all of it, where a regulator exists it has teeth. In June the United Kingdom regulator fined Cambridge English, a separate arm of the same parent organisation, close to a million pounds over incorrect IELTS results. The school qualifications our children sit aren’t in that remit, and until this year they weren’t in anybody’s. The IBCC register changes that.

Question 8If you could place five measurable priorities before Pakistan’s economic leadership today, what would they be, who should be accountable for delivering each one, and what results should the country expect by 2029? Finally, what would convince you that Pakistan has genuinely moved from policy announcements and diplomatic goodwill to a sustainable, innovation-led and export-oriented economy that delivers tangible improvements in ordinary citizens’ lives?

Shahzad Arif: Five, and each one is already on somebody’s desk. Power for compute. Ministry of Energy with the IT ministry. Decide the tariff their own task force has had since January. By 2029 we should be hosting regional workloads rather than exporting that spend. Payments. The State Bank. Build on the April reforms and lift the fifty percent retention limit. By 2029 no Pakistani software company should lose a contract over how it gets paid. Enforceable contracts. Ministry of Law with Parliament. Turn the commercial courts proposal into a bill, and pass the arbitration act that’s waiting. By 2029 a judgment should take months rather than two years, and the number should be published. Employability. HEC with NAVTTC and P@SHA. Make that internship a paid final-year placement. By 2029 the share going straight into industry should have doubled. Tax and procurement. FBR with Finance, and the Cabinet Division. Ten years in primary legislation, and one clause extending local preference to software. By 2029 we should be measured on cash received rather than signatures collected. What would convince me it was real? Not an export number. Three things that are harder to arrange than a number. A family sending their child to a government school because it’s good, and not because it’s the only one they can afford. A twenty-five year old engineer with a Dubai offer who turns it down, because the work here is more interesting. And a foreign board approving a second investment here without anybody having to make a telephone call to get something unstuck. The export figures follow those three. They do not cause them.

Question 9Mr. Shahzad, what do you consider the most serious AI-driven threats Pakistan and the world will face over the next five to ten years? Is Pakistan adequately prepared to manage these risks through effective regulation, cybersecurity, responsible AI governance and public awareness? Furthermore, what practical steps should the government, technology companies, financial institutions and educational institutions take now to ensure that Pakistan benefits from AI without allowing its misuse to undermine employment, economic stability, data sovereignty and national security?

Shahzad Arif: This is an unusual moment, and a valuable one. The tools have arrived here before the losses have. That gap is the whole opportunity. Fraud first. This month the cybercrime agency in Lahore announced arrests in a case where, they allege,

AI-generated passport images were used to open bank accounts abroad. Those were foreign banks. Globally the FBI’s crime centre put nearly nine hundred million dollars of reported losses last year against complaints carrying an AI element. Here, complaints to the Banking Mohtasib ran to about four and a half thousand, and not one is publicly recorded as AI-enabled. So the capability is in the country and the losses haven’t followed. Any institution that retires voice and face as a single factor now, rather than after an incident, is acting inside that window. Second, entry-level work is compressing. Our industry association reported in August that entry-level hiring at the larger technology firms is down about a quarter. One honest counterweight: in the Philippines, call centre employment has carried on rising. Exposure isn’t displacement. But an economy selling hours shouldn’t wait for the proof. Third, decisions taken by models, which is the one least discussed here. A customer refused an account, with no explanation and no human being to ask, has suffered something our law doesn’t yet recognise. The Governor of the State Bank said it plainly in January. Human oversight stays essential for AI-driven decisions, particularly credit approval. The principle is accepted. It needs to become a rule. Then data and sovereignty, because where the infrastructure sits decides which government can compel disclosure. That’s a security question, not only a commercial one. And on the state dimension, the worrying thing about these tools isn’t that they’re powerful. It’s that they’re cheap and deniable. An adversary doesn’t need to break into a network if a fabricated voice or a forged document will do, and the targets that matter are civilian. Payments. Telecom. The grid. Public confidence in what people are hearing. Fabricated audio of a public figure, released at the right hour, can move a currency before anybody can deny it. So the defence is civilian too, and it’s unglamorous. Verification that doesn’t rest on a voice or a face. Tested failover. Data held where our own law reaches. A public that can recognise a fake. And investigations that end in prosecutions often enough to deter the next attempt. One more thing. In a crisis you want some of the models, the hosting and the detection built and run here, because the question then isn’t who owns the technology. It’s who controls the switch. Are we prepared? In parts. On cybersecurity the financial sector is ahead; Cyber Shield came in February and responsible AI guidance for banks is in draft. On regulation we are behind, because there’s no AI law and no data protection law. And on public awareness we’ve barely started. Most people can’t yet tell a synthetic voice from a real one, and that is the cheapest defence there is. What’s missing in law is the civil framework. Data protection. Obligations that scale with risk. A right to have a human look at an automated decision that affects you. And liability rules for a customer defrauded by a synthetic voice. So, practically. The government should finish the data protection law and publish risk-tiered rules rather than blanket licensing, which would only push development offshore. Technology companies should disclose where their models and data are hosted, and test their own systems adversarially. Banks should retire voice and face as a single factor now. And universities should teach students to audit these systems rather than only use them. The opportunity is bigger than the risk. But only for countries that build the guardrails while they’re building the capability.