IAEA Runs Its First-Ever Security Review of Pakistan's Nuclear Sites, Calls the Regime 'Robust'

Pakistan hosted its first-ever International Physical Protection Advisory Service mission between September 28 and October 9, 2026, and came out of it with the IAEA's public verdict that the country's nuclear security regime is robust — a notable data point for a nuclear-armed state whose weapons and material security has been the subject of outside speculation for decades, even though this particular review covered civilian regulatory and facility-level arrangements rather than the military programme.

What an IPPAS mission actually does

IPPAS is the IAEA's standard mechanism for independently checking how a member state protects its nuclear material and nuclear facilities against theft and sabotage. It is requested by the host government, not imposed, and Pakistan's Nuclear Regulatory Authority had been preparing for this one for roughly a year before the team arrived. Over 12 days, the visiting experts reviewed Pakistan's legislative and regulatory framework for physical protection on paper, then went to see how it works in practice at one site: the KANUPP Decommissioning Project, the shuttered former Karachi Nuclear Power Plant Unit-1, rather than any of the operating power reactors still generating electricity for the grid.

Who did the reviewing

The seven-member team was led by Khammar Mrabit, the former director-general of Morocco's nuclear safety and security agency, AMSSNuR. His team drew experts from China, Romania, Russia and Slovakia, plus two IAEA staff members — a composition that puts both a Gulf-adjacent security partner and strategic competitors of the United States inside Pakistan's nuclear-security perimeter for nearly two weeks, with Islamabad's consent. The mission was hosted by the Pakistan Nuclear Regulatory Authority in close coordination with the Pakistan Atomic Energy Commission and other national bodies, reflecting how tightly Pakistan's civilian nuclear regulatory and operating functions are run alongside each other.

The finding, and its limits

The IAEA's own language, echoed by PNRA, was that Pakistan "had established a robust nuclear security regime for the physical protection of nuclear materials and facilities," and that the arrangements observed at KANUPP specifically "were found to be appropriately implemented." The team also handed over a set of recommendations to further strengthen security arrangements and associated procedures, and separately flagged good practices worth keeping at both the regulatory and facility level — the standard, two-sided output of an IPPAS mission, which is designed to improve a system that passes, not simply certify it as finished. Because the visited site is a decommissioning project rather than a live reactor, the review speaks most directly to how Pakistan secures nuclear material that is being wound down, alongside the paper framework that would apply across its wider civilian fleet.

Why the timing matters

The mission closed on October 9, in the same week Pakistan's armed forces confirmed for the first time on the record that its troops are already deployed inside Saudi Arabia, and not long after the army's own corps commanders conference used unusually direct language about internal threats to state authority. A credible, independently verified nuclear-security review lands at a moment when Pakistan's international security posture is under scrutiny on several fronts simultaneously — Gulf deployments, an unresolved Afghan border conflict and domestic political unrest — making an externally validated "robust" assessment of the one domain where global anxiety about Pakistan has historically run highest a useful data point for Islamabad's diplomacy, independent of how the other fronts play out.

What happens with the recommendations

IPPAS missions are advisory, not enforcement actions — the IAEA has no power to compel Pakistan to adopt the recommendations, and neither the Agency nor PNRA has published the specific list of fixes the team proposed, consistent with how IPPAS findings are typically kept between the host regulator and the Agency rather than released in full. What is public is the overall verdict and the fact that a review happened at all: Pakistan's first since it began engaging more deeply with IAEA security-advisory services. Whether PNRA publishes any follow-up timeline, or whether a second IPPAS mission eventually covers an operating reactor rather than a decommissioning site, will be the next marker of how far Pakistan is willing to let outside assessment reach into its nuclear infrastructure.

Build Better Pakistan's Security Desk covers nuclear regulation, defence policy and the institutions that oversee them, and will update this piece if PNRA or the IAEA releases further detail on the mission's recommendations.