You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 2, 2026

Thailand Releases New Draft Artificial Intelligence Act

Subscribe to Updates

Thailand’s Electronic Transactions Development Agency (ETDA) released a new version of the draft Act on Artificial Intelligence on July 2, 2026, for a public hearing period expected to be approximately 30 days. The draft act adopts a risk-based regulatory approach modeled in part on international frameworks—particularly the EU’s AI Act—while incorporating provisions tailored to Thailand’s regulatory landscape and digital economy objectives. If enacted in its current form, the law would introduce extraterritorial obligations, a tiered risk classification system, strict liability for AI-related damages, and new transparency requirements for AI-generated content.

Scope and Extraterritorial Application

The draft act applies to AI development, deployment, or any other action affecting people in Thailand, even if the action occurs outside the country. Of note:

  • This extraterritorial reach creates compliance obligations for global AI companies whose systems impact Thai residents or consumers, even if the provider has no physical presence in Thailand.
  • Foreign AI providers serving Thai deployers or users must appoint a local coordinator or authorized representative. Depending on the type of AI system, the representative may need full authority to act on behalf of the provider without any limitation of liability.
  • Certain activities are exempt from the draft act’s oversight, including AI used by natural persons solely for personal or household activities, AI for educational research conducted by higher education institutions with ethics committee approval, research and development activities conducted prior to distribution or service provision, and other AI systems prescribed by royal decree.

Risk-Based Classification Framework

The draft act establishes a tiered risk classification system with three main categories:

  • Prohibited AI. The act outright prohibits AI systems employing cognitive-behavioral manipulation using subliminal techniques, AI systems causing unfair broad-scale discrimination from processing irrelevant data, and other categories of serious risk as determined by announcement of a forthcoming committee that will be responsible for national AI planning.
  • High-risk AI. High-risk AI systems are those designated by royal decree as affecting national security, health, environment, energy, telecommunications, transport, or public utilities.
  • Designated AI systems. A subsequent royal decree may additionally require regulator notification, registration, or licensing of certain AI systems before deployment.

Obligations for High-Risk AI System Providers and Deployers

Providers of high-risk AI must develop systems that are efficient and fit for purpose, transparent in operation, subject to meaningful human control, fair and nondiscriminatory, and aligned with foreseeable risks. The regulator may announce risk oversight guidelines covering 13 areas, including risk management, bias prevention, cybersecurity, human oversight, transparency, and complaint handling.

Deployers must implement risk management systems, follow provider instructions, assign capable oversight personnel, mitigate damage from AI-related incidents, retain operational logs for a minimum period (six months under the Thai text), and notify authorities of unforeseen risks.

Transparency Obligations for AI-Generated Content

The draft act introduces transparency requirements for content generation by AI systems:

  • Developers of AI systems capable of generating or modifying images, audio, or video must assess risks, implement mitigation measures, and embed machine-readable marks to identify AI-generated content.
  • Persons who introduce AI-generated content relating to national security, election-related content, investment credibility, food or drug properties, impersonation, or illegal acts into public systems must disclose that it is AI-generated or AI-modified content.
  • Platform providers face specific obligations, including risk assessment, providing reporting channels, verifying AI content, displaying labels, and preparing annual operational summaries.

Data Localization and Contract-Controlled AI Businesses

The draft act grants the forthcoming national AI planning committee authority over data and contracting requirements in sensitive sectors:

  • The committee may designate “contract-controlled AI businesses” applicable to services provided to government or critical infrastructure agencies, and may prescribe mandatory contract terms addressing data processing, risk management, security, modification and termination procedures, and post-termination obligations.
  • The committee may also require data processing within Thailand for AI services of national importance. This introduces uncertainty for cloud-based AI services and may require infrastructure investment in Thailand.

Strict Liability Regime

The draft act imposes joint liability for damages regardless of willful act or negligence—a strict liability standard. Defenses are limited to force majeure, the victim’s own act or omission, or compliance with an official order.

Enforcement and Penalties

The draft act establishes an enforcement framework, with escalating consequences for noncompliance:

  • The regulator may order providers and deployers to rectify insufficient measures.
  • With ministerial approval, the regulator may petition the court to order temporary service suspension, product recall, or deployment suspension.
  • If providers fail to comply, the regulator may petition the court to order ISPs to block AI system dissemination in Thailand.

Administrative fines range from THB 1 million to THB 5 million, depending on the nature of the violation.

AI Product Launches, Regulatory Sandbox, and Self-Regulation

The draft act also establishes a regulatory sandbox framework for testing AI systems in regulated sectors, data-sharing infrastructure through Thailand’s Big Data Institute (a national public organization), and frameworks for self-regulation and best practices. Compliance with self-regulatory best practices may also serve as selection criteria for government investment promotion programs.

Implementation Approach and Next Steps

There will be a phased implementation of the draft act’s measures. Core measures related to the launching of AI products take effect immediately upon publication. Risk control, supervision, and serious incident provisions take effect 180 days after publication, providing a compliance preparation window for affected businesses.

Organizations that develop, deploy, or rely on AI systems affecting persons in Thailand should begin assessing their compliance. They are also encouraged to submit comments on the draft act to the Ministry of Digital Economy and Society during the public hearing period.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
Read More
January 30, 2026
Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities. The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation. The following insights summarize the key takeaways from the Data Privacy Day 2026 event. PDPA in Real Life: What Happens to Your Data Today The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand. Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis. Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors. Case studies. The Office of the PDPC highlighted specific examples of violations: Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards) Vendors compromised systems due to inadequate password
Read More
January 29, 2026
Following the recent enactment of a comprehensive legal framework addressing sexual harassment, Thailand has launched a fast-track judicial process enabling victims of online sexual harassment to obtain court orders suspending and removing obscene content from the internet. On January 26, 2026, the Office of the Judiciary introduced the “Take It Down” procedure through the Court Integral Online Service (CIOS) platform, providing victims with their first direct, expedited pathway to halt the spread of online content that violates the new legal provisions against sexual harassment. This new remedy stems from section 284/4 of the Penal Code, introduced through the Act Amending the Penal Code (No. 30) B.E. 2568, which took effect on December 30, 2025. Under section 284/4, an injured person or a competent official may petition the court to suspend dissemination of violating data and remove the data from computer systems within a court-specified period. The court may also direct system controllers, service providers, or competent authorities to carry out the order and report back within 15 days. Filing through the CIOS Platform The CIOS platform serves as the primary electronic channel for these petitions. Key features include: Individuals can file online without appearing in person and may submit petitions at any time the system is available. Users must complete digital identity verification via the ThaID application to access the CIOS. Petitions under section 284/4 are limited to requests to suspend or remove violating content. Claims for monetary damages must be pursued separately, including via separate proceedings or prefiling mediation. Streamlined Review Process The submission workflow is end-to-end electronic, and the system provides step-by-step guidance. After submission, court staff review the petition before presenting it to a judge for consideration. The court may conduct an online inquiry to obtain additional information, and in-person attendance is required only if deemed
Read More
January 22, 2026
On January 20, 2026, Vietnam’s Ministry of Finance (MOF) issued Decision No. 96/QD-BTC to formally launch pilot administrative procedures for licensing crypto asset trading market services in Vietnam. The decision took immediate effect and implements the government’s pilot crypto asset market program under Resolution No. 05/2025/NQ-CP. Notably, competent authorities have now begun accepting license applications, marking the first time Vietnam has operationalized a licensing pathway for crypto trading market operators. Administrative Procedures and Applications The decision stipulates procedures for (i) granting, (ii) adjusting, and (iii) revoking licenses to provide services for organizing crypto asset trading markets. It provides detailed, step-by-step guidance for each procedure, including dossier composition, internal review stages, coordination mechanisms, and statutory timelines. These procedures apply specifically to entities seeking to organize and operate crypto asset trading markets within Vietnam’s pilot regulatory framework. The MOF is the authority responsible for reviewing and deciding on the above procedures, with the State Securities Commission acting as the receiving, coordinating, and procedural focal point. For licensing applications, the MOF will coordinate with multiple authorities, including the State Bank of Vietnam and the Ministry of Public Security, particularly in relation to anti-money laundering, cybersecurity, system safety, and risk control requirements. Applications may be submitted in person, by post, or electronically via the National Public Service Portal or the administrative procedure information system, in line with applicable regulations. Statutory processing timelines vary depending on the specific procedure and stage involved. For applications to obtain a license to organize a crypto asset trading market, the process is conducted in multiple phases: The MOF will issue an initial written response within 20 working days from receipt of a complete and valid initial dossier, following which, upon submission of the full set of required documents, the MOF will complete substantive review and issue the license
Read More