Thailand’s Securities and Exchange Commission (SEC) has established a comprehensive governance framework for the use of artificial intelligence and machine learning (AI/ML) in the capital markets. The framework provides guidance to capital market business operators on understanding the risks associated with AI/ML implementation and adopting appropriate practices to build public confidence in Thailand’s capital markets. While the guidelines are principle-based rather than prescriptive, they reflect the SEC’s expectations for responsible AI/ML governance and are likely to inform supervisory activities and industry standards going forward. Scope The framework applies to capital market business operators supervised by the SEC. This includes, for example, securities and derivatives firms, asset management companies, mutual fund and private fund managers, investment advisors and investment consultants (including robo-advisory service providers), derivatives intermediaries, and other licensed intermediaries and market operators in the Thai capital markets that deploy AI/ML in their operations. Core Principles of the Guidelines The framework is presented as a best-practice manual rather than prescriptive regulation, providing guidance that regulated entities may apply to their AI/ML governance and risk management as appropriate. While currently nonbinding, the guidelines signal the SEC’s expectations for the sector, particularly in relation to other binding SEC regulations such as those covering IT risk management and market conduct. The guidelines name four core principles for AI/ML deployment: Fairness: Design and develop AI/ML with consideration for fairness, equality, and social diversity to prevent discrimination against individuals or groups. Legal and ethical compliance: Ensure AI/ML use aligns with applicable laws, ethical standards, and organizational values and policies. Accountability: Establish clear responsibility—both internally and externally—for AI/ML activities and outcomes. Transparency: Provide adequate disclosure to users about AI/ML use, including explainability of decisions and traceability of activities. AI/ML Best Practices The guidelines prescribe best practices across four stages of the AI/ML lifecycle, as described below.

Thailand’s Personal Data Protection Act (PDPA) enforcement has entered a new phase, and the insurance industry is squarely in the regulatory spotlight. The Personal Data Protection Committee (PDPC) considers insurers “large-scale” processors of sensitive data—including health records, financial information, and biometric data—making the sector a focal point for enforcement action. In August 2025 alone, the PDPC issued administrative fines totaling THB 21.5 million, and fines for individual violations have ranged from THB 50,000 to THB 2 million. The PDPC has also deployed its “Eagle Eye Crawler,” an AI-driven surveillance tool that monitors websites around the clock for data leaks and noncompliant privacy notices. This article highlights the key regulatory developments directly affecting insurers and outlines practical steps toward compliance. What Has Changed: OIC and PDPC Alignment The Office of Insurance Commission (OIC) has synchronized its sector-specific rules with the PDPA through the Notification on Customer Personal Data Protection (No. 2) B.E. 2568 (2025). The combined effect of the PDPC’s general enforcement push and the OIC’s sectoral guidance creates four critical compliance areas for insurers. Consent unbundling. Consent for marketing must be strictly separated from the core insurance contract; bundling marketing consent into the policy application is no longer permissible. Agent and intermediary oversight. Insurance intermediaries are generally classified as data processors, meaning that insurers—as data controllers—must provide specific written instructions and security protocols to all agents and brokers. A 2026 enforcement trend shows controllers being held liable for the “weak security” of their vendors and downstream processors. Enhanced privacy notices. Insurers must provide a summary privacy notice alongside the full policy, plainly stating categories of data, purposes, lawful bases, disclosure recipients, cross-border transfers, retention periods, data subject rights, and easy marketing opt-out channels. DPO registration and ROPA. All organizations involved in “regular or systematic monitoring of data subjects on

On March 30, 2026, Thailand’s Customs Department announced a strategy to raise import duties on a broad range of consumer goods—including plastic items and electronics accessories—to their maximum statutory ceilings, which often sit at 30% or 40%. Many of these goods currently benefit from promotional or incentive rates as low as 5%. For importers, e-commerce platforms, and logistics providers, this development demands immediate attention. While these increases generally require cabinet approval, they do not require full parliamentary amendment of the Customs Tariff Decree B.E. 2530, as the Customs director-general and the finance minister hold delegated authority to adjust rates within existing statutory bounds. Businesses should not assume that the legislative process will provide significant lead time before higher rates take effect. Death of the De Minimis: Abolishing the THB 1,500 Loophole This “ceiling-rate” policy, which is designed to equalize the landed cost of foreign goods with the domestic production costs of Thai manufacturers, builds on a sweeping set of customs reforms that have already begun to reshape Thailand’s trade environment. The foundation of this new regime was laid on January 1, 2026, when Thailand formally abolished the longstanding THB 1,500 duty exemption for small imported parcels under Customs Notification No. 219/2568. Every imported item is now subject to VAT and applicable import duties for its declared value, regardless of parcel size or transaction amount. By narrowing the scope of exemptions previously granted to low-value goods under the Customs Tariff Decree B.E. 2530, the government has made clear that the era of tax-free cross-border micro-imports is over. Three-Phased Strategy and Legal Modernization The March 30 announcement is the second phase of a three-part regulatory roadmap: Immediate enforcement: The removal of the THB 1,500 loophole and the imposition of VAT on all parcels, effective January 1, 2026. Tariff realignment: The current

Thailand’s Office of the Consumer Protection Board has opened a public hearing period on draft regulations governing the transfer of direct sales and direct marketing businesses. The draft Notification of the Direct Sales and Direct Marketing Committee: Criteria and Procedures for Business Transfer and Amendment of Registration for Direct Sales or Direct Marketing Businesses establishes a compliance-focused process with strict documentation requirements and timelines for transferring direct sales and direct marketing businesses. The proposed framework also defines the roles of transferors and transferees and establishes application procedures with the Office of the Consumer Protection Board. Applications may be submitted in person or electronically and will be examined to confirm they are complete, authentic, and compliant with legal requirements. This includes verification that: The transferee meets all required qualifications; No disqualifying factors apply; and The applicant is not subject to legal restrictions. The public hearing period is open until April 29, 2026. Direct sales and direct marketing business operators should prepare for these proposed requirements to ensure compliant implementation once the regulations are finalized.