Artificial Intelligence Governance, Algorithmic Accountability and High-Risk Systems Law

This Law is called the ‘Artificial Intelligence Governance, Algorithmic Accountability and High-Risk Systems Law’ and establishes a horizontal AI governance framework in the Republic of Iraq. Sectoral laws and data protection, cybersecurity, consumer protection and civil and criminal liability rules remain applicable where no specific provision exists, interpreted consistently with this Law's safeguards.

This Law aims to enable safe, responsible AI development and use; protect rights, freedoms and human dignity; prevent discrimination and serious harm; ensure transparency, accountability and reviewability; regulate high-risk and general-purpose systems; support innovation, investment and scientific research; and establish coherent national governance adaptable to technological development.

Governance shall rest on legality, necessity and proportionality; human primacy and effective human oversight; safety, security and robustness; privacy and data protection; non-discrimination and equal opportunities; context-appropriate transparency and explainability; traceability and accountability; competition and innovation; protection of children and groups at risk; and effective objection and remedy.

This Law applies to every public or private natural or legal person developing, providing, importing, distributing, deploying or using AI in Iraq; placing systems or outputs on the Iraqi market; or directing outputs to persons in Iraq or producing substantial legal or material effects on them.

Foreign providers are subject to relevant obligations where they provide systems or services to users in Iraq, target its market, process data of persons in Iraq or generate substantial effects in Iraq. Foreign providers required to register shall appoint an Iraqi legal representative, without relieving the original provider of liability.

Commercial registration and prior assessment requirements do not apply to research and development not placed into service or on the market, or non-professional personal use. Prohibited-practice, rights, data and security provisions remain applicable where others are harmed. Purely military combat systems follow a special regime; this exception does not cover administration, recruitment, surveillance, investigation or public service systems merely because a security or military body uses them.

An ‘AI system’ is a machine-based system designed to operate with varying autonomy, which may adapt after deployment and infer from inputs how to generate predictions, content, recommendations or decisions influencing physical or virtual environments. ‘Provider’ means one who develops a system or places it on the market or into service under their name. ‘Deployer’ means one using it under their professional authority. ‘Affected person’ means someone whose rights, interests, opportunities or legal position are affected.

A ‘high-risk system’ falls within this Law's fields or criteria and, on failure or misuse, presents a significant likelihood of affecting health, safety, rights, livelihoods or access to essential services. A ‘general-purpose AI model’ can perform a broad range of tasks and be integrated into multiple systems. A ‘model with systemic risk’ is a general-purpose model whose capabilities, deployment scale or potential effects warrant additional safety measures.

AI systems shall be classified by actual use, context, capability and potential harm into prohibited practices, high-risk systems, systems with specific transparency duties, and low- or limited-risk systems. Classification shall not be raised or lowered solely by the provider's trade name or technical claims.

Classification shall consider autonomy, affected population size, reversibility of harm, data sensitivity, vulnerable groups, reliance on outputs in decisions, difficulty detecting error, potential large-scale spread, connection to infrastructure, money or physical safety, and reasonably foreseeable misuse.

Placing or using systems employing covert or deceptive techniques or deliberately exploiting age, disability or economic or psychological vulnerability is prohibited where they materially impair informed decision-making and cause or are likely to cause serious physical, psychological, financial or legal harm.

Public bodies and private entities performing public functions shall not establish or use general social scoring that evaluates or classifies people by social behaviour or predicted characteristics outside the data collection context, where this causes detrimental or disproportionate treatment or denial of rights, services or opportunities.

Biometric or behavioural characteristics shall not be used to infer race, ethnicity, religion, sect, political opinion, sexual orientation or other highly sensitive traits for classification or treatment, unless specific legislation authorises necessary, defined processing for a legitimate protective purpose with strict safeguards against discrimination or general profiling databases.

Creating or expanding facial or biometric recognition databases through large-scale untargeted collection of images or recordings from the internet, surveillance cameras or public sources is prohibited without a specific, proportionate legal basis.

Public authorities shall not use real-time remote biometric identification in publicly accessible places for law enforcement except to search for missing persons, prevent imminent danger to life or investigate a specified serious felony, under a prior judicial order defining location, duration, purpose and comparison database, documenting false results and destroying unnecessary data. It shall not be used for general surveillance or tracking lawful protests, political activity or journalism.

Decisions to investigate, detain, search or classify someone as likely to offend shall not rely exclusively or decisively on algorithmic predictions based on personality, traits, past behaviour or social connections without current, objectively verifiable facts connected to a specific offence.

Systems inferring emotional or psychological states shall not be used in workplaces or educational institutions for recruitment, evaluation, discipline, admission or dismissal decisions, except defined medical or safety uses managed by competent bodies with consent and appropriate legal safeguards.

AI shall not be the sole final decision-maker in deprivation of liberty, judicial judgments, withdrawal of civil rights, serious administrative penalties or termination of essential subsistence benefits. A competent person must decide, with genuine power to depart from the system's recommendation after reviewing its grounds and relevant data.

Subject to this Law, high-risk systems include those used for biometric identification; critical infrastructure and services; educational admission and assessment; recruitment and worker management; credit, insurance and essential financial services; public benefits and services; healthcare affecting diagnosis or treatment; law enforcement, borders and migration; justice and dispute resolution assistance; elections and democratic administration; road safety and transport; and allocating resources or services whose denial affects rights or livelihoods.

On the Higher Committee for AI Governance's recommendation and after public consultation, the Council of Ministers may add or amend uses where evidence shows harm comparable in severity and likelihood. A category expressly established by law may be removed only by law.

High-risk providers shall maintain continuous lifecycle risk management covering known and foreseeable risks, intended use and reasonably foreseeable misuse testing, affected groups, mitigation controls, post-deployment verification and documentation of key technical and organisational decisions.

Training, validation and testing data shall be relevant, appropriately high-quality, representative as far as possible of intended populations and contexts, subject to error and known-bias detection, and accompanied by provenance and legal and technical limitations. This does not authorise collection of personal data without a lawful basis.

Before release, providers shall prepare technical files describing intended purpose, general architecture, performance limits, data, accuracy metrics, known risks, security controls, evaluation methods, human oversight, material change records and safe-use instructions sufficiently for competent authority audit without requiring unnecessary trade secret disclosure.

High-risk systems shall generate and retain sufficient operational logs to trace decisions and significant events, detect failures and investigate incidents, with proportionate retention, restricted access and tamper protection. Logging requirements shall not become unlawful surveillance of users or affected persons.

Providers shall clearly explain capabilities and limitations, accuracy and reliability, populations or conditions of weaker performance, data requirements, over-automation risks, error indicators, security measures and how to disable systems or revert to alternatives when necessary.

High-risk design and operation shall allow qualified people to understand tasks, monitor outputs, suspect errors, reject or modify recommendations and stop systems when danger arises. Oversight is not effective if staff are practically obliged to follow outputs or lack time, information or authority to review them.

Providers and deployers, within their responsibilities, shall ensure appropriate, demonstrated accuracy, robustness, continuity and cybersecurity, test resistance to input manipulation, poisoning, leakage and model attacks, and establish recovery, secure update and vulnerability management plans.

Before and after operation, high-risk systems shall undergo reasonable testing for unjustified differences in error rates or outcomes between legally protected groups. Material disparities unexplained by legitimate, proportionate purposes require suspension or restriction of consequential use until corrected.

Before first high-risk use, deployers shall assess purpose, less intrusive alternatives, affected persons and groups, relevant data and rights, error, discrimination and security risks, human oversight, complaints, performance indicators and shutdown plans. Public bodies shall publish an assessment summary unless security or investigation confidentiality requires withholding a specified part.

Where public authorities, essential service providers, large employers or financial, health or educational institutions use systems for consequential decisions, assessment must independently analyse potential effects on equality, privacy, expression, fair trials, children's and disability rights, and work, education and health rights according to context.

High-risk systems shall not enter service before required technical and rights assessments, demonstration of binding-standard compliance and registration where applicable. Regulations shall require independent assessment for the most sensitive uses, including biometrics, law enforcement, justice and critical infrastructure.

Providers and deployers shall collect performance, incident, complaint and significant error indicators after deployment and review changes in context, data or audience that increase risk. Material model, purpose, data-source or autonomy changes require reassessment.

Providers or deployers shall notify the sector regulator and Iraqi National Centre for Artificial Intelligence of serious incidents or failures causing death, serious injury, widespread rights violations, critical service disruption, significant leakage or collective discrimination without undue delay and within seventy-two hours of initial awareness, completing technical investigation later.

Material changes include changes to purpose, user groups, major data sources, model architecture, agent capabilities, autonomy or decision thresholds affecting risk. They require reassessment, documentation and potentially renewed conformity assessment before deployment.

Each value-chain participant shall provide downstream parties with technical information necessary for compliance within its responsibility. Primary providers shall not contractually prevent deployers from meeting legal duties or reporting risks. Open-source component developers are not liable for uses they neither marketed nor controlled except within this Law's limits.

Government high-risk procurement requires auditable safety, rights, security and data and log portability requirements; state testing and auditing rights; supplier exit and avoidance of technology lock-in; and clear data ownership and processing location consistent with data protection and digital sovereignty laws.

People shall receive clear notice when directly interacting with AI where they might reasonably believe they are dealing with a human, and when automation materially assesses applications, eligibility, opportunities or legal status, unless use is inherently obvious or temporary non-disclosure is legally required for a specific investigation.

Anyone substantially affected by an AI-based decision may receive an understandable account of principal outcome factors, relevant data sources, known limitations and human involvement sufficient to understand and challenge it, without requiring unnecessary source code or trade secret disclosure.

People may request meaningful human review of high-impact decisions made automatically or decisively reliant on AI. Reviewers must have authority to change or revoke decisions, examine objections and necessary information, and not simply reconfirm automated outputs.

Deployers shall provide an easy, free channel to object to consequential algorithmic decisions and give reasoned responses within reasonable time. Objection does not bar existing administrative or judicial grievance and appeal routes.

Developing or using systems producing legally prohibited direct or indirect discrimination is forbidden. Lack of knowledge of a protected characteristic does not remove liability where proxies foreseeably produce discriminatory outcomes that reasonable measures could detect or mitigate.

Interfaces, notices and objections shall accommodate disability needs. Reliance on voice, images, movement or biometrics shall not create unjustified exclusion. Suitable alternatives shall be available where particular groups cannot use a system.

Children's best interests shall govern systems designed for them or likely to be widely used by them. Excessive commercial behavioural or psychological exploitation is prohibited. Educational, care and biometric systems for children require stricter necessity, data minimisation and human oversight.

Public bodies and essential service providers shall not covertly test systems potentially affecting rights, eligibility, prices or essential service access without a legal basis, risk plan and monitoring. Individuals shall not be subjects of high-impact decision experiments without appropriate safeguards.

The Iraqi National Centre for Artificial Intelligence shall publish a register of public-sector high-risk systems, identifying the body, purpose, provider, risk category, basis of use, assessment date, human review and objection channel. Specified details may be withheld where publication threatens national security, investigation integrity or cybersecurity, with reasons given as far as possible.

Good-faith employees, contractors or security researchers shall not face retaliation for reporting serious risks, violations or vulnerabilities to competent authorities under responsible disclosure procedures. Protection excludes unlawful data appropriation or disclosure beyond what reporting requires.

In disputes or incidents, providers and deployers shall retain relevant logs and technical documents long enough for investigation or adjudication, protecting confidentiality. Courts may order necessary material made available to independent experts with safeguards for trade secrets and personal data.

This Law does not affect rights to seek cessation of processing, correction of decisions, removal of unlawful effects or compensation under general liability rules. Courts may consider failure to retain legally required logs when assessing evidential burdens and presumptions.

General-purpose model providers shall document capabilities, limitations and integration requirements, provide downstream developers with compliance information, follow a lawful intellectual property and data-source policy, and publish a meaningful summary of principal training data types and sources without disclosing secrets or personal data.

Implementing regulations shall set flexible criteria based on capabilities, reach, autonomy, agentic ability, potential critical infrastructure, cybersecurity or vital-domain use, safety test results and potential harm. No single computational criterion shall be exclusive.

Providers of models with systemic risk shall periodically evaluate capabilities and risks, conduct appropriate adversarial and red-team testing, manage security vulnerabilities, assess large-scale misuse, document serious incidents and mitigate before and after release.

Such providers shall notify the Centre and competent sectoral authority upon discovering capabilities, behaviour or incidents reasonably capable of widespread harm, serious loss of control, major compromise or direct facilitation of extremely dangerous unlawful activity, and submit corrective plans without undue delay.

Providers generating text, audio, images or video shall take reasonable technical measures enabling detection of automated generation or modification where practicable, including provenance metadata or machine-readable labels, respecting open standards and interoperability.

Public publishers of synthetic or substantially altered content imitating a real person's speech or actions in potentially deceptive ways must clearly disclose generation or alteration, unless artistic, satirical or educational context makes this obvious to reasonable viewers. Labelling does not remove liability for defamation, fraud, privacy or other rights violations.

Where systems can independently execute external actions, such as money transfers, commands, system modifications or transactions, providers and deployers must define authority limits, appropriate authentication, human approval for sensitive operations, shutdown capability, traceable logs and prevention of unauthorised privilege escalation.

Open development shall be respected. Publishing a free open-source model or component alone does not impose commercial-provider obligations unless it is marketed, offered as a service or classified as a systemic-risk model under this Law. Data security and anti-circumvention duties remain applicable.

This Law creates no new copyright or intellectual property exception. Model providers shall maintain documented policies respecting applicable rights and reasonable mechanisms for rights-holder requests. Trade secrecy shall not conceal proven unlawful data collection or use.

Regulations shall impose proportionate disclosure of large models' training and operating energy and resource consumption where reliably measurable. Efficient technology shall be encouraged without numerical restrictions unsupported by national data.

Public bodies shall not operate high-risk systems before identifying administrative responsibility, completing impact assessment and registration, training users, defining a human alternative and testing data quality and local context. Use must be reviewable by oversight and judicial bodies.

AI may assist legal research, case management and analysis but shall not replace judges in forming convictions, weighing evidence or determining liability or sentence. Material use in evidence analysis or judicial recommendations must be disclosed in the case file so parties can challenge methodology where necessary.

Criminal analysis, biometric identification and risk assessment systems require written internal authorisation and judicial safeguards according to the intervention. Automated output alone is insufficient for arrest, search or accusation. Facial, voice and fingerprint models shall be accuracy-tested across relevant populations.

Systems affecting diagnosis, treatment or patient prioritisation shall meet medical safety and sectoral requirements in addition to this Law. Clinicians must understand limitations and recommendation sources. Necessary care shall not be denied through unreviewable automated decisions.

Admission, assessment, academic monitoring and dropout prediction systems shall undergo fairness, accuracy and accessibility testing, with human review where admission, achievement or discipline is affected. Unnecessary inference of emotional or health states through continuous student surveillance is prohibited.

Candidate screening, appraisal, promotion or dismissal systems require notice to workers or candidates, discrimination testing, human review and identification of relied-on data. Excessive biometric or behavioural collection merely to improve assessment ‘efficiency’ is prohibited.

Financial and insurance institutions using high-risk credit, pricing or fraud systems must retain understandable outcome reasons, prohibit discriminatory proxies and allow human objections review. The Central Bank of Iraq may impose stricter technical requirements within its powers.

When systems determine eligibility or priority for benefits, support, housing or essential services, automated error shall not trigger immediate interruption without notice, an opportunity to correct and human review. A manual emergency route must exist for system failure.

Systems controlling or assisting control of electricity, water, telecommunications, transport, health and critical financial systems shall meet joint AI and cybersecurity law requirements, including safe isolation, pre-update testing, business continuity, manual or alternative operation and supplier management.

Electoral systems for voter registration or verification, polling centre allocation, result counting or eligibility decisions are high-risk. Core decisions must permit audit, recount or independent verification. Public authorities shall not use individual political profiling to restrict lawful participation.

Biometric verification and border or migration risk assessment require human review and safeguards against discrimination and collective error. Entry, rights or protection applications shall not be refused solely on unverifiable behavioural, emotional or algorithmic prediction.

The Communications and Media Commission shall regulate AI services within its telecommunications, information technology and platform remit consistently with this Law. Transparency or safety requirements shall not become general prior censorship of opinions, news or lawful content.

Security and defence bodies shall establish confidential internal safety, traceability, accountability, human oversight and cybersecurity standards for systems outside public registration. Any use affecting civilians, procedural rights or public services remains subject to constitutional, statutory and special-law safeguards. System secrecy shall not prevent competent judicial oversight.

The existing Higher Committee for Artificial Intelligence shall continue as a national policy and coordination committee. Within ninety days of entry into force, a Council of Ministers decision shall reorganise its powers to ensure regulatory, rights, economic, security and scientific representation without an unnecessary parallel apparatus.

The Committee shall propose national regulatory policy; approve risk classifications and common standards; coordinate sectoral bodies; propose regulations and instructions; review trends and emerging risks; approve research and capacity priorities; supervise the national register; propose agreements and international cooperation; and publish an annual report on AI governance in Iraq.

The Centre shall provide the Committee's technical secretariat, operate the national high-risk register, develop assessment and testing guidance, collect incident reports, manage regulatory sandboxes and coordinate technical testing. It shall not replace legally competent sectoral licensing or sanctioning authorities.

The Central Bank of Iraq, Communications and Media Commission and health, education, transport, financial, security and other authorities shall exercise existing powers over systems in their sectors, applying this Law as a common minimum. Its higher safeguards prevail over conflicting sectoral instructions.

The Commission shall continue regulating AI in telecommunications, information technology, platforms and digital services within its statutory remit, aligning regulations with this Law's classification, rights and procedures. A sectoral regulation alone shall not extend to medical, judicial, banking or employment decisions outside its competence.

For systems under multiple regulators, the Higher Committee shall designate a coordinating lead while preserving other bodies' powers. Unnecessary duplicate registration or auditing shall be prevented; a single assessment may be recognised if it meets all bodies' legal requirements.

The Higher Committee shall form an advisory council of independent university, private sector, professional association, civil society, human rights and cybersecurity experts, persons with disabilities and startup representatives. Its role is advisory; recommendations and members' interests shall be disclosed to avoid conflicts.

Competent bodies shall, where possible, adopt interoperable international or national AI risk management, assessment, audit and security standards adapted to Iraq. Essential rights-affecting obligations shall not be delegated entirely to closed commercial standards whose legal substance the public or courts cannot understand.

Regulations shall specify laboratory and independent auditor accreditation for systems requiring third-party assessment, including competence, independence, data confidentiality and conflicts prevention. Accreditation does not prevent regulators' own examinations.

The Centre shall establish a unified electronic register of high-risk systems marketed or used in Iraq, covering providers, representatives, purposes, risk categories, conformity status, serious incidents and corrective measures. Narrow rules shall identify non-public data protecting security and trade secrets.

Competent bodies shall exchange expertise, technical information and dangerous-system alerts under agreements and law, seeking standards alignment that reduces Iraqi companies' compliance costs and enables mutual recognition of assessments without weakening rights protection.

Within its remit, a regulator may request documents and logs, conduct or commission tests, summon provider or deployer representatives, examine complaints and incidents, order correction, restrict or temporarily suspend use for serious risk, and withdraw systems where less restrictive measures cannot mitigate risk.

Supervision shall prioritise highest-risk and widest-impact systems. Low-risk systems shall not face burdensome routine audit without reason. Sectoral coordination shall avoid duplication and provide simplified small-business compliance unless use is high-risk.

For imminent serious threats to life, safety, rights or critical infrastructure, competent bodies may temporarily suspend a specified function, deployment or update for up to thirty days, renewable once by reasoned decision. Addressees shall have grievance rights and urgent judicial review.

Administrative violations include operating high-risk systems without required registration or assessment, withholding mandatory information, failing to report serious incidents, obstructing audits, breaching transparency or failing to implement final corrective orders. Prohibited practices and deliberately falsified information are serious violations.

Sanctions shall consider severity, duration, repetition, affected numbers, establishment size, cooperation and remediation. They include notice, binding corrective plans, warnings, suspension of functions or services, withdrawal of registration, temporary bans on specified systems and fines within this Law's limits.

Ordinary violations shall attract no more than two hundred and fifty million Iraqi dinars or one per cent of annual Iraqi revenue, whichever is lower. Prohibited practices or deliberate concealment of serious incidents shall attract no more than one billion dinars or two per cent of annual Iraqi revenue, whichever is lower. Regulations may set lower bands reflecting small enterprises without exceeding these limits.

Final sanctions require notice of facts and legal grounds, access to non-confidential evidence and reasonable response time. Decisions must be written, reasoned and proportionate, except urgent temporary orders under Article (85).

Regulatory decisions may be challenged within thirty days before the body designated by law or sectoral regulation, without barring competent court appeal. Courts may suspend enforcement where irreparable harm is likely and suspension does not threaten a weightier public interest.

Liability follows actual control over harm: providers answer for design, information or update defects under their control; deployers for misuse contrary to instructions, changed purposes or neglected oversight. Shared causes may lead to apportioned liability under general rules.

Administrative violations shall not be interpreted as criminal offences unless expressly established by law. Existing criminal provisions apply where AI is used to commit an offence; mere possession of a multipurpose tool or model is not punishable.

Where supervision reveals personal data breaches, cyber incidents or crime, necessary information shall be referred to the data protection authority, National Cybersecurity Centre or investigative body according to law, avoiding unnecessary duplicate provider requests.

The Centre and sectoral bodies shall establish sandboxes for companies, universities and public bodies to test innovative systems within defined time, geographical and numerical limits, with clear data, security, oversight and stopping conditions. Sandboxes cannot exempt prohibited practices or waive fundamental rights.

The state shall encourage independent research on AI safety, fairness, explainability, security, Arabic and Kurdish languages and the Iraqi context. Public bodies may provide anonymised or synthetic research data under data protection and confidentiality laws. Mere academic research not marketed requires no prior licence under this Law.

Regulators shall prepare simplified compliance guides, templates and advisory services for startups and small enterprises and reduce unnecessary registration and audit burdens, without relaxing essential requirements for high-risk decisions.

Public bodies and institutions deploying high-risk systems shall adopt suitable AI literacy programmes for staff and users, covering capabilities, limitations, bias, security, privacy and output verification, with specialised training by sector and role.

Systems widely used in public or essential services must be tested in Arabic and, as needed, Kurdish and constitutionally recognised languages and relevant local contexts. Strong foreign-language performance is insufficient evidence of suitability in Iraq.

Government system and public service contracts shall provide for export of non-confidential data, logs and configurations, open interfaces and standards where practicable, and avoidance of terms unjustifiably preventing supplier changes. Monopoly or technological lock-in practices shall be referred to competition authorities.

Public bodies may procure or trial innovative systems on a limited scale with defined success metrics, risks, duration, alternative trial arrangements and exit plans. Pilots shall not automatically become national deployments or long-term contracts without independent assessment of results, risks and costs.

The Council of Ministers and sectoral bodies shall issue implementing regulations and instructions within their powers within one hundred and eighty days of publication. Instructions shall not add prohibited practices, sanctions or fundamental-rights interference without a basis in the Law.

Within one hundred and twenty days of entry into force, the Communications and Media Commission shall review any existing or draft AI services regulation and align its scope, classification, registration, data and sanction requirements with this framework and other sectoral laws.

Within one hundred and eighty days, every public body shall inventory algorithmic and AI systems it uses or procures, classify them provisionally and send high-risk data to the Centre for registration and priority review.

Existing high-risk systems shall have twelve months to complete registration, assessment and documentation. Prohibited practices shall stop under shorter timetables not exceeding ninety days, unless temporary continuation is necessary to prevent greater danger under reasoned decision and competent supervision.

Providers of general-purpose models available in Iraq before entry into force shall have twelve months for documentation and transparency compliance; systemic-risk models shall have nine months for required safety assessments.

Personal data protection rules apply throughout AI lifecycles. Compliance with this Law is not an independent processing basis. Assessments needing sensitive or personal data must identify lawful grounds, minimise data and ensure security under the relevant law.

Cybersecurity and critical information infrastructure protection requirements apply additionally to covered systems. Incident reporting shall be coordinated to avoid duplication; stricter security standards prevail for critical infrastructure or vital services.

Health, education, labour, banking, telecommunications, consumer protection, intellectual property, competition, criminal procedure and other laws remain effective. Registration or conformity assessment does not authorise activities requiring separate professional or sectoral licences.

No provision shall diminish judicial independence, defence rights, expression, journalism, scientific research, communications confidentiality, privacy, equality or constitutional safeguards. Rights restrictions must be prescribed by law, necessary, proportionate and challengeable.

Every two years, the Higher Committee shall submit to the Council of Ministers and Council of Representatives a public report on implementation, technology, incidents, costs, innovation and regulatory effects on rights and markets, proposing amendments as needed. Periodic review does not replace Parliament's authority to amend prohibitions or fundamental rights.

Expressly conflicting provisions are repealed to the extent of conflict, and existing instructions and regulations amended under Article (102). This does not abolish existing sectoral powers unless irreconcilable with this Law.

This Law takes effect ninety days after publication in the Official Gazette, subject to its specific transitional periods.