Thailand’s Office of Insurance Commission (OIC) has opened a public hearing on proposed amendments to the OIC Notification on Criteria for Information Technology Risk Governance and Management for Life Insurance and Non-Life Insurance Companies B.E. 2563 (2020) via the centralized Law platform. The public consultation period runs from May 8, 2026, to June 9, 2026. The proposed amendments aim to elevate the IT risk governance and cybersecurity risk management framework to be more modern and aligned with international standards, with a focus on strengthening cyber resilience, enhancing the role of IT audits, and establishing data governance and data quality controls. The parties affected by these amendments include life insurance companies, non-life insurance companies, and external IT auditors. Key Changes Elevated Role of Board of Directors The proposed notification requires the company’s board of directors to oversee data governance, cybersecurity, and the responsible use of AI. Additionally, the board should include at least one director with IT knowledge or experience. Companies are also required to designate a head of security responsible for information security. The board’s duties are expanded to include oversight of data governance and AI usage, including establishing relevant policies and committees. Enhanced IT Security and Cybersecurity The revised notification consolidates the existing chapters on IT project management, IT security and cybersecurity to reduce redundancy, and introduces significant new measures. These include mandatory multi-factor authentication for material systems, enhanced data security measures such as data masking and data leakage prevention, security hardening requirements, web filtering, and mandatory vulnerability assessment and penetration testing at least annually. New requirements are also introduced for mobile application security, API security, and security measures for emerging technologies such as cloud computing and post quantum cryptography. The cybersecurity framework now encompasses identification, protection, detection, response, and recovery. The draft also introduces source code review

Indonesia’s Minister of Health has issued Decree No. HK.01.07/MENKES/301/2026 on the Affixation of Nutritional Labels and Health Information to Ready-to-Eat Processed Food Products. The decree came into force on April 14, 2026, and was issued to implement the Health Law and Minister of Health Regulation No. 3 of 2026 on Disease Control. The decree requires the inclusion of Nutri-Level labeling on the front-of-pack nutrition labeling (FOPNL) to indicate the product’s nutritional level based on the content of sugar, salt, and fat (“gula, garam dan lemak (GGL)”). Changes from 2024 Draft Regulation The Nutri-Level labeling was previously proposed in 2024 by the Indonesian FDA (BPOM) through a draft regulation concerning nutrition information. While the categories of Nutri-Level labeling remain the same in the issued decree, the content requirements of sugar, salt and fat in the decree are different from the earlier proposal introduced in the 2024 draft BPOM regulation. In addition, the decree has further specified that the content of fat in the Nutri-Level labeling is the content of saturated fat, not total fat as previously proposed in the 2024 draft. The decree requires Nutri-Level labeling to be implemented in beverage products, which is the same as previously proposed in the 2024 draft BPOM regulation. Other food products may gradually become subject to mandatory Nutri-Level labeling under future implementing regulations. Nutri-Level Labeling Food levels as shown by the Nutri-Level labeling are classified into four color-coded categories from A to D: Level A (lowest amount) in dark green Level B in light green Level C in yellow Level D (highest amount) in red The Nutri-Level labeling is represented by the following image. The requirements for each level for sugar, salt, and fat content, based on amounts per 100 milliliters of product in beverage form, are as follows. Nutri-Level information must be

Indonesia’s Food and Drug Authority (BPOM) has issued Regulation No. 7 of 2026 on Drug Promotion and Advertising, establishing an updated framework for promotional activities involving medicinal products in Indonesia. The regulation took effect on April 16, 2026, and supersedes BPOM Regulation No. 2 of 2021 on Drug Advertising Supervision. The new regulation maintains general principles for advertising content, including requirements that advertisements be objective, complete, and not misleading, as further detailed in its annex. It also confirms that advertisements for nonprescription drugs directed to the public must obtain prior approval from BPOM before publication and must be in Bahasa Indonesia. The regulation provides a more comprehensive framework governing how drug promotion is conducted, introducing several notable additions and changes, as described below. Procedure and Requirements for Drug Advertisement Approval To apply for a drug advertisement approval, applicants must create an online account through the dedicated portal SIAPIK. Advertisement approval is available only for registered drugs; unregistered drugs are not eligible for advertisement approval with BPOM. The application must include the advertisement design, along with a translation if the design contains any wording in a foreign language. The submission format varies by media type, requiring, for example, copies in the form of print advertisements for visual media, scripts for audio media, and storyboards for audiovisual media. For online media—including social media—submissions should include any captions, descriptions, and hashtags that form an integral part of the advertising material. The approval timeline takes approximately 3–4 months, as BPOM will generally request additional information or revisions during the verification and evaluation process. Applicants have 20 days to submit any such requested documents. BPOM may also conduct a reevaluation of advertisements that have already received approval, based on monitoring results or new information regarding the safety and quality of the advertised drug. This

After several years of policy discussion and continued efforts led by the Ministry of Commerce (MOC) to relax the list of reserved businesses under the Foreign Business Act B.E. 2542 (1999) (FBA), the reform process has now reached a significant milestone. On May 12, 2026, the Thai cabinet approved in principle two draft subordinate legislative instruments aimed at delisting certain reserved business activities under the FBA and reducing licensing requirements for foreign business operators. These developments signal a renewed and concrete effort by the government to modernize Thailand’s business regulatory framework in order to attract foreign investment and boost Thailand’s competitiveness in the global market. Nine Businesses Set for FBA Delisting Below is a list of the nine businesses that are being targeted for delisting from the FBA’s restrictions. A draft ministerial regulation would delist the first eight reserved businesses, while a royal decree has been drafted to delist the ninth business: Telecommunications services (Type 1 license only, covering operators without their own telecommunications infrastructure), under the supervision of the Office of the National Broadcasting and Telecommunications Commission. Treasury center services subject to the Foreign Exchange Control Act B.E. 2485 and under the supervision of the Bank of Thailand. Securities-collateralized lending, pursuant to the laws governing securities and exchange and derivatives regulated by the Securities and Exchange Commission. Agency, dealer, advisory, or fund management services relating to derivatives where the underlying assets fall outside the scope of the Derivatives Act B.E. 2546 (2003) Intra-group shared services, including administrative, human resources, and IT functions Intra-group domestic debt guarantee services Leasing of partial space for installation of financial service machines and automatic vending machines for employee use Petroleum drilling services Trading of agricultural product derivatives through a futures exchange, with physical delivery or receipt of agricultural products at a futures exchange–designated