You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 19, 2025

Thailand Drafts AI Risk Management Guidelines for Financial Service Providers

Subscribe to Updates

The Bank of Thailand (BOT) has released draft guidelines establishing principles for managing artificial intelligence (AI) risks in the financial sector. The draft guidelines provide a structured framework for the responsible adoption of AI technologies. Financial service providers will be able to use the guidelines as a reference to appropriately manage their risks in a manner that aligns with internationally recognized best practices.

The BOT is accepting public comments on the draft guidelines until June 30, 2025.

Scope and Application

The draft guidelines apply to all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. These guidelines supplement existing BOT risk management guidelines covering IT risk management, third-party risk management, data governance, and market conduct.

The guidelines define AI systems as systems that mimic human intelligence, including machine learning, deep learning, generative AI (such as large language models), and agentic AI. This definition specifically excludes rule-based automation systems like robotic process automation and condition matching.

Key Risk Management Principles

The guidelines lay out two main principles in managing AI risk.

  1. Governance: Financial service providers should define and establish clear roles and responsibilities for their personnel and AI system supervision structures to uphold FEAT (fairness, ethics, accountability, and transparency) principles as follows:
    • Stakeholder roles and responsibilities. Financial service providers should define roles and responsibilities for boards and executives on AI risk oversight. Responsibilities include establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization.
    • AI system usage policy. The AI system usage policy should be aligned with organizational objectives, regulatory requirements, and FEAT principles. These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles.
    • Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. When AI systems are used in strategic functions or customer interactions (e.g., loan approval, account opening), human oversight must be integrated into decision-making processes. In customer interactions with AI systems, customers should be notified and have options to disable or bypass AI features.
  1. Development and security controls: Financial service providers should have risk controls covering the AI development and deployment lifecycle as follows:
    • Data risk. Financial service providers should have measures to assess and ensure the quality, accuracy, currency, volume, and diversity of data used in AI model training. They should also implement data leakage prevention measures.
    • Model development risk. Financial service providers should have (1) clear evaluation metrics for assessing model accuracy and reliability through ongoing testing and monitoring both before and after deployment and (2) measures to ensure the explainability of AI outcomes. For generative AI applications, there should be specific measures to reduce AI hallucination risks.
    • Cybersecurity risk. Financial service providers should have measures to prevent and detect emerging cyber threats targeting AI systems, based on established standards such as the OWASP Machine Learning Security Top 10.

For more details on any aspect of fintech, technology, and cybersecurity in Thailand, please contact Athistha Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Pornpan Wichawut at [email protected], Napassorn Lertussavavivat at [email protected], or Rujaporn Paritsantik at [email protected].

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

January 19, 2022
Thailand has completed the establishment of the Personal Data Protection Commission (PDPC), the regulator under the country’s Personal Data Protection Act B.E. 2562 (PDPA), strongly indicating that the planned full enforcement of the PDPA on June 1, 2022, is likely to proceed as scheduled. The establishment of the PDPC was finalized on January 18, 2022, when the Announcement of the Prime Minister’s Office on the Appointment of Chairperson and Honorary Members of the PDPC was published in the Government Gazette. As stipulated in the PDPA, the PDPC consists of: The chairperson, appointed based on knowledge, skills, and experience; The vice-chairperson, who is the permanent secretary of the Ministry of Digital Economy and Society; Five commission members, designated based on their positions in certain government agencies (as prescribed under the PDPA); and Nine honorary commission members appointed based on knowledge, skills, and experience in personal data protection, consumer protection, technology and telecommunication, social science, law, health, finance, or other relevant fields. As the vice-chairperson and the five commission members are appointed to the PDPC based on their positions, the January 18 announcement appointing the chairperson and the nine honorary commission members completes the formation of the PDPC. The full enforcement of the PDPA has been previously postponed, and many businesses had expressed concern that another extension would be forthcoming before the current enforcement date. However, the successful establishment of the PDPC is a fundamental prerequisite to enforcement and indicates that the effective date of the PDPA on June 1, 2022, is unlikely to be further postponed. In addition, the PDPA’s draft subordinate regulations that were the subject of a series of public hearings last year are likely to be issued in the near future. Companies and other organizations that are not yet compliant with the PDPA should now assess their
Read More
January 12, 2022
Thailand’s Board of Investment (BOI) recently published BOI Notification No. Sor. 8/2564, which extends the scope of investment promotion covering electronic vehicle (EV) industry manufacturers to include the production of “automotive platforms” for electric vehicles, and creates a new category of BOI promoted activities covering the manufacture of electric bicycles (E-bikes). Automotive Platforms The following investment promotion categories have been extended: 4.24 – Manufacture of Battery Electric Vehicles 4.26 – Manufacture of Electric Battery Tricycles 4.27 – Manufacture of Electric Battery Busses and Trucks These categories now include the manufacture of “automotive platforms”—which must include an energy storage system, charging module, and front and rear axle module—benefiting from similar tax incentives and subject to additional conditions, as detailed below. New BOI Promotional Category for E-Bike Production The BOI has also introduced a new category, No. 4.28, covering the manufacture of E-bikes. Projects under this category will be eligible for a three-year CIT exemption with an additional one-year exemption if certain criteria are met. Applications for this category must cover the manufacture of E-bikes, the manufacture or sourcing of electric batteries, and a management plan for used batteries. In addition to the general conditions for EV projects (industrial standards, manufacturing timelines, etc.), the BOI has also imposed the following conditions specific to E-bike projects: E-bike frames must be produced from light-weight materials such as aluminum alloy, chromium–molybdenum alloy steel (chrome moly), titanium alloy, and carbon fiber; and E-bike batteries must adopt environmentally-friendly technology. Interestingly the BOI allows E-bike production lines to jointly use manufacturing lines for ordinary bicycles. However, the sale of ordinary bicycles is regarded as non-BOI-promoted income and will not be entitled to BOI tax incentives. These new provisions, intended to stimulate both local and foreign investments in the electric automotive industry, seem to complete the BOI promotion
Read More
December 8, 2021
On February 9, 2021, Vietnam’s Ministry of Public Security (MPS) released the full text of the Draft Decree on Personal Data Protection (“Draft PDPD”) for public consultation, after having released an outline in December 2019, with an ambitious goal for the Draft PDPD to be promulgated and take effect on December 1, 2021. This date has now passed and the Draft PDPD remains unissued, with no concrete details on when the situation will change. Many new contents have been introduced in the Draft PDPD (please see our previous articles here and here). In this article, we take a deeper look at the issues that have attracted the most attention from national and international stakeholders as they wait for the draft to be finalized and promulgated. Please click below to read the full article.  
Read More
November 29, 2021
On November 25, 2021, the Myanmar Investment Commission (MIC) issued a list of investment sectors that will receive priority attention in order to encourage national development and state building. The investment activities that MIC will prioritize are the following: Fertilizer manufacturing Cement manufacturing Iron and steel manufacturing Agriculture and livestock farming and related industries Value-added manufacturing of foodstuffs Electric vehicle manufacturing Pharmaceutical and medical device manufacturing Public transportation services Both foreign investors and local investors may invest in these sectors, and the MIC, ministries, and relevant state and regional governments will provide necessary assistance to the investors under the Myanmar Investment Law 2016. For more details on the new requirements, please contact Tilleke & Gibbins at [email protected] or +95 9 772 440 001.
Read More