“When the armed forces require bidders to confirm if our solutions were ‘tested’, for us Pakistanis, it is a trick question. If we say ‘no’, then we are disqualified or dropped. If we say ‘yes’, we could be at risk of breaking local laws,” one CEO of a private Pakistani defence vendor told Quwa.
DIPRA Ordinance, 2026: powers established, procedures missing
In June 2026 the President’s office promulgated the Defence Industrial Production and Regulatory Authority (DIPRA) Ordinance, 2026. The ordinance gives DIPRA broad powers to regulate public and private defence industry activity: to issue or revoke licences, permits, and NOCs; to oversee defence R&D; to establish military-grade standards; and to conduct or supervise inspection, testing, and certification. It also directs DIPRA’s R&D Committee to develop a mechanism through which private companies can validate indigenous products and to facilitate their access to public-sector testing and trial facilities.
But an enabling ordinance does not, by itself, create an accessible operating pathway. Quwa could not locate publicly accessible DIPRA rules, application forms, decision timelines, or a catalogue of public testing facilities at the time of writing. The ordinance criminalises unlicensed defence development, production, manufacturing, assembly, repair, dealing, and related services — punishable by up to seven years’ imprisonment, a fine up to PKR 10 million, or both, alongside confiscation and licensing consequences — which raises the stakes for private entrants while the administrative route remains incomplete.
Layered arms and explosives law creates legal uncertainty
Private developers face overlapping statutory regimes. Pakistan does not have a single, uniform arms statute: Khyber Pakhtunkhwa, Sindh, and Balochistan have their own arms laws, while the 1965 framework continues to apply in Punjab and in federal contexts. The Khyber Pakhtunkhwa Arms Act, 2013, defines ammunition to include rockets, explosives, fulminating material, and propellants and prohibits manufacture without a licence. The Sindh Arms Act, 2013, expressly requires a licence to manufacture, convert, repair, or test arms and ammunition.
The Explosive Substances Act, 1908, is another major legal layer. Section 2 defines an explosive substance broadly, encompassing materials and apparatus that can be used to cause or assist an explosion; Section 5 penalises making or knowingly possessing explosive substances under suspicious circumstances with a maximum sentence of 14 years’ imprisonment. The Explosives Act, 1884 and the Explosives Rules, 2010 (as amended) provide an explicit licensing route administered by the regulator now called the National Explosives and Petroleum Safety Agency (NEPSA). Quwa’s review shows administrative inconsistencies — NEPSA’s website places it under the Ministry of Energy’s Petroleum Division, while the Rules of Business assign explosives administration to the Industries and Production Division — that a new applicant should not be expected to resolve alone.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTesting and infrastructure shortfalls block credible repeatable data
Most private defence original-equipment manufacturers (OEMs) in Pakistan remain startups or small units within larger groups, and defence work is often a minor part of their portfolios. They lack the laboratories, ranges, static-fire stands, environmental chambers, wind tunnels, telemetry systems, and accredited instrumentation needed to generate credible, repeatable test data. That capacity gap turns testing into a regulatory and commercial trap: bidders are asked whether a product was “tested,” but there is no visible domestic pathway to perform and document that testing lawfully and credibly.
Flight testing adds further complexity. The Pakistan Civil Aviation Act, 2023 allows the Director General to permit otherwise unregistered aircraft to fly for experimental purposes and to permit an aircraft to fly without a certificate of airworthiness for an experiment, subject to conditions. However, the Act defines civil aviation around non-military uses and excludes matériel kept for the exclusive use of the armed forces. In practice, static propulsion tests, captive-carriage trials, unarmed flight testing, release trials, electronic-warfare evaluations, and live kinetic tests implicate different mixes of explosives, range-safety, airspace, security, and defence-product approvals.
What this means for private OEMs, DIPRA/Ministry of Defence Production, and NEPSA
- Private OEMs: face criminal exposure if they begin energetic-material work without the correct licences and NOCs. Many lack capital to build accredited test infrastructure and so need an operational public pathway and access to state facilities before committing to propulsion, motor casting, or live trials.
- Ministry of Defence Production and DIPRA: now possess statutory authority to coordinate licensing, testing, and certification, and an R&D fund to subsidize support — but must publish clear, activity-based procedures, decision timelines, and facility catalogues so companies can comply and invest with predictability.
- NEPSA and provincial home departments: control discrete approvals for explosives, storage, transport, and provincial arms permissions; their procedures must be harmonised with DIPRA’s front-door model to remove administrative ambiguity for applicants.
How to close the gap: coordination, catalogue, IP rules, and funded access
The source lays out a practical two-part remedy that follows from the DIPRA Ordinance itself. First, DIPRA should be operationalised as a single front door: publish an activity-based regulatory map that lists the exact licence or NOC required for inert component design, propellant casting, static firing, unarmed flight testing, warhead integration, live trials, and production; identify issuing authorities; set application order and decision timelines; and offer an early written classification process so firms can determine legal status before investing.
Second, DIPRA should catalogue public test facilities (static-fire sites, flight-test ranges, environmental and electronic testing laboratories, wind tunnels, telemetry systems), publish eligibility, security, scheduling, cost, liability, range-safety, and data-classification rules, and use its R&D fund to subsidise access for startups on priority projects. Access agreements must specify IP and raw-test-data ownership: under the ordinance IP funded by the authority vests in the authority, and IP from joint ventures or P3s is treated as work for hire unless contractually agreed otherwise — a detail that must be clarified in test-access contracts to protect company-owned designs and data.
Until DIPRA converts statutory powers into a readable, public operating framework — and until the ordinance’s status and legislative continuity are secured — ambitious firms will continue moving sensitive R&D overseas, and the investment, employment, and technical learning generated by that work will continue accruing elsewhere, including in target export markets such as the United Arab Emirates (UAE). The next concrete measure is procedural: publish the forms, timelines, and facility catalogue that turn legal authority into a usable path for lawful testing and credible evidence.
Source: Quwa — Pakistan’s Private Sector Needs Transparent Testing Regulations and Capacity Support
