You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 15, 2023

Patenting AI Technology and Software in Southeast Asia

Subscribe to Updates

Southeast Asia’s remarkable growth as a destination for foreign investment—including a 42 percent increase in 2021, according to a joint ASEAN-UNCTAD report—has brought with it innovation as well as the desire to protect that innovation. Investors are increasingly seeking to patent the proprietary technology that is a crucial component of so many businesses today, and a burning question for patent applicants is whether artificial intelligence (AI) technology and software are patentable in Southeast Asia. The short answer is that it depends, as the patent laws in Southeast Asia are not uniform.

Is it Patentable?

While AI tools tend to be newer, the older and more familiar question is whether computer software is patentable, and many jurisdictions do have specific rules on this issue. Pure software, or software characterized only by source code, may not be patentable, but it can be protected under copyright laws.

AI-related software may involve complex algorithms, datasets, and training methodologies that can be challenging to disclose in a manner that satisfies the enablement requirement in practice. Algorithms, mathematical methods, and abstract ideas are often considered non-patentable subject matter in many jurisdictions. While software implementing AI may involve innovative algorithms, securing patents for algorithms alone can be challenging in some jurisdictions.

Also, the patent laws of Indonesia, Myanmar, Thailand, and Vietnam specifically list computer programs as unpatentable subject matter. However, a possible workaround would be to describe the software as connected to a tangible medium. This method could overcome an unpatentable subject matter rejection during substantive examination. Furthermore, in Indonesia, a computer program can be patentable if its characteristics (i.e., instructions) have a technical effect and function to solve a tangible or intangible problem.

The most liberal of Southeast Asia’s patent regimes—Singapore’s—even addresses AI innovations. The country has a special fast-track scheme for examining AI patent applications called Accelerated Initiative for Artificial Intelligence. Under this scheme, a patent application can be granted six months from the filing date.

Patent Drafting

Drafters of patent applications in Southeast Asia need to be aware of the patentability requirements specific to AI technology and software inventions in each Southeast Asian country. When drafting AI technology and software patent applications, one option for the drafter to keep in mind is that the description should mention the connection between the software and the tangible medium. If the software can be linked to a tangible medium, the invention could be patentable.

Even if the claims of the patent application in other regions (such as the United States) do not have to show a connection with a tangible medium, when the application enters Southeast Asia, the claims can be amended to include this connection without expanding the scope of the application if the information already exists in the description.

This means that AI technology and software could be patentable as a part of a wider patentable invention.

Prosecution Strategy

In looking to patent AI innovations—or any other tools—applicants should explore possibilities for speeding up the prosecution process. For instance, ASEAN member countries have agreed to accept one another’s examination results in a scheme called the ASEAN Patent Examination Cooperation, and many Southeast Asian countries have an agreement to accept patent examination results from another country, through arrangements referred to as “patent prosecution highways” (PPHs). Cambodia has a special agreement to validate European patents without further examination. Indonesia, Thailand, and Vietnam have a PPH with Japan. Under this PPH, patent applicants can use the examination result of a corresponding patent application in Japan that has already been granted to speed up the examination process in Indonesia, Thailand, or Vietnam. Although the examiner in the other country will still examine the application to make sure it does not violate that country’s patent laws, the examination result from Japan should help speed up the examination process.

Outlook

Patenting AI technology and software in Southeast Asia requires a nuanced approach that takes into account both existing laws and procedures, as well as new considerations that arise with the advent of cutting-edge technology. As businesses continue to innovate and create proprietary technology, it is critical to develop a comprehensive strategy for protecting these valuable assets through patents. By staying up to date with the latest developments in the field and working closely with experienced legal professionals, businesses in Southeast Asia can navigate the complex patenting process and secure the protection they need in order to maintain a competitive edge in the rapidly evolving global marketplace.

Related Professionals

Industries

Technology

Practices

Intellectual Property

Locations

RELATED INSIGHTS​ 

June 19, 2024
On June 14, 2024, the Personal Data Protection Committee (PDPC) released a draft notification under the Personal Data Protection Act 2019 (PDPA), setting out criteria for how data controllers must delete, destroy, and de-identify personal data. According to the PDPA, a data subject can request that a data controller delete, destroy, or de-identify their personal data in any of the following circumstances: The personal data is no longer necessary for the purposes for which it was collected, used, or disclosed. The data subject has withdrawn their consent for the processing of the personal data, and no other lawful basis for processing remains. The data subject has objected to the processing of their personal data on grounds of legitimate interests or official tasks, the data controller has no other compelling grounds to refuse the request, and the data is not needed for legal claims. The data subject objects to the processing of their personal data for direct marketing purposes. The processing of personal data is unlawful. The draft stipulates that data controllers respond to a data subject’s request to delete, destroy, or de-identify personal data immediately, and within 60 days of receiving the request. If the data controller cannot fulfill the request immediately, they must take interim measures to ensure that the personal data is made difficult to collect, use, or disclose. This includes implementing measures such as preventing access to the data and applying appropriate security measures to protect the data from unauthorized use or disclosure. De-identification or Anonymization of Personal Data In certain circumstances, a data controller may opt to de-identify or anonymize personal data, rather than delete or destroy it. If doing so, the data controller must satisfy the following criteria: There must be a structured process to remove or eliminate all direct identifiers linked to the
Read More
May 15, 2024
On May 1, 2024, Thailand’s National Cyber Security Committee (NCSC) published the draft NCSC Notification Re: Cloud Cybersecurity Standards for a public hearing period, which was open until May 14, 2024. These standards have been drafted to drive the country’s cloud-first policy with the aim of minimizing risks from cyber threats to cloud services utilized by government agencies, supervising or regulating organizations, and critical information infrastructure (CII) organizations. The key points of the draft Cloud Cybersecurity Standards are below. Scope The standards apply to government agencies, supervising or regulating organizations, and CII organizations under the Cybersecurity Act B.E. 2562 (2019), as well as cloud service providers (defined below). The standards prescribe cloud system cybersecurity measures for cloud service customers (defined below) and providers only to the extent that the service is provided to the in-scope organizations outlined above. Definitions Cloud service customers (CSCs): In-scope organizations that have a formal contractual agreement to use cloud services provided by a cloud service provider. Cloud service providers (CSPs): Persons who enable cloud services to be used by a cloud service customer, responsible for maintaining infrastructure, platforms, and software that enable provision of the cloud services and for managing these resources to ensure their accessibility, security, and scalability for their cloud service customers. Application In-scope organizations that will use or have been using cloud services must comply with the Cloud Cybersecurity Standards by taking into account their data or technology information systems’ level of impact, as specified in the previously issued Notification of the NCSC Re: Standards for Defining the Security Category for Data and Information Systems B.E. 2566 (2023). The impact level related to personal data is to be rated as being at least at the medium level, and the minimum standards for that level specified in the draft Cloud Cybersecurity Standards
Read More
May 13, 2024
On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative
Read More
May 9, 2024
As non-cash payments continue to surge in Vietnam, the requirement for strong security standards and a clear legislative framework for intermediary payment services (“IPS”) is becoming more and more critical. Recognizing this, the State Bank of Vietnam (“SBV”) has been working on a draft decree to supersede the outdated Decree No. 101/2012/ND-CP dated November 22, 2012, on non-cash payments (“Draft Non-Cash Payment Decree”), which will lay the groundwork for non-cash payments in general and the provision of IPS in particular. Building upon this, the SBV recently issued a draft circular to replace Circular No. 39/2014/TT-NHNN dated December 11, 2014, on IPS (“Circular 39”) (“Draft IPS Circular”), which will offer more detailed guidance on the provision of IPS in Vietnam on top of the Draft Non-Cash Payment Decree. The Draft IPS Circular will be applicable to (i) IPS providers; (ii) foreign organizations providing IPS in Vietnam; and (iii) organizations and individuals involved in the provision of IPS. Some key updates regarding the Draft IPS Circular are as follows: Scope of Application The Draft IPS Circular sets out further guidance for the provision of IPS as listed under the Draft Non-Cash Payment Decree, including: (i) electronic clearing services; (ii) electronic wallet (“e-wallet”) services; (iii) collection and payment support services; (iv) financial switching services; (v) international financial switching services; and (vi) electronic payment gateway services. Notably, the Draft IPS Circular has explicitly excluded from its scope of application the provision of accounts by goods/service providers to their customers solely for the purpose of payment within the systems of such providers (e.g., cards/coupons or service/transaction accounts of online game service providers, transportation service providers, or securities companies, etc.). Requirements on the Provision of IPS Electronic Clearing Services: The Draft IPS Circular introduces regulations to cover certain elements of electronic clearing services that have
Read More