The draft Royal Decree on Artificial Intelligence System Service Business, which was introduced by the Office of the National Digital Economy and Society Commission earlier for public comment in October last year, focuses on potential risks from artificial intelligence (AI) systems to public health, safety, and freedoms. The framework emphasizes the importance of risk assessment, reporting requirements, and the establishment of specific measures and criteria deemed necessary to minimize AI risks. AI Systems Defined by the Decree Under the draft royal decree, an AI system is defined as a machine-based system that can make predictions, recommendations, or decisions that affect real or virtual environments pursuant to the objectives set by humans. The definition clarifies that artificial intelligence systems are designed to operate at different levels of autonomy, including: machine learning AI; logic-based and knowledge-based AI; statistical AI; Bayesian estimation AI; and search and optimization AI. Risk-based Approach The draft AI royal decree takes a risk-based approach to regulation and specifically identifies prohibited or high-risk AI services that could cause harm or engage in unethical practices to ensure that AI systems do not pose major risks to public health, safety, or freedoms. The extent of regulatory scrutiny applied to an AI system corresponds to the level of risk presented by the AI system. For example, AI systems that pose unacceptable risks are generally prohibited, AI systems considered to be high-risk are subject to a conformity assessment, and AI systems considered to be limited-risk are subject to transparency requirements. Compliance with specified criteria and procedures to minimize potential risks of each AI service would be further outlined in subregulations. Prohibited AI Systems The draft AI royal decree prohibits AI systems that: employ subliminal techniques to covertly influence human behavior (below the threshold of conscious awareness); utilize social scoring; access sensitive personal

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy. Current Frameworks in Southeast Asia This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations. Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm. Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles

On January 16, 2023, Thailand’s Securities and Exchange Commission (SEC) prescribed a set of security measures that digital asset business operators must implement if they provide custody of digital assets for their customers. The new security measures are prescribed in two notifications from the SEC and its office on digital asset wallet management systems and cryptographic key management systems, with the aim of safeguarding digital assets in custody against loss, fraud, and cybertheft. The notifications took immediate effect. The new security measures and the management systems are summarized below. Policy and guidelines for managing systems related to digital asset custody Digital asset business operators must have a written risk management policy for all systems relating to digital asset custody, approved by their board of directors and made accessible to all employees. The policy must be reviewed or revised at least once annually, or promptly if any potential risks are identified. Specific procedures must be implemented, such as establishment of a compliance team and internal controls. Management of systems for digital asset wallets and cryptographic keys Digital asset business operators must have policies and procedures for managing all systems relating to digital asset custody. This includes properly designing, developing, and managing digital asset wallets in a safe and secure manner. The same requirement on policies and procedures applies to cryptographic key management as well. Management of incidents that may affect systems related to digital asset custody Digital asset business operators must have measures in place to manage incidents that may impact systems related to digital asset custody. The measures include designating a person responsible for incident management, testing and reviewing the incident management policy annually, reporting any incidents affecting digital asset custody to the designated responsible person and the SEC immediately, and conducting a digital forensic investigation with an independent

The Federation of Thai Industries (FTI) announced on January 16, 2023, the opening of registration for carbon credit trading on its Renewable Energy and Carbon Credit Exchange Platform. This new online platform supports the domestic carbon market and provides Thai exporters with the ability to purchase carbon credits, allowing them to address demands from importing nations to conform to carbon emission reduction regulations. This is expected to be a positive step forward for the current practice in Thailand, in which the carbon market operates as a voluntary and unregulated buy-sell platform, free from government regulation. Developed in partnership with the Thailand Greenhouse Gas Management Organization (TGO), the FTI: CC/RE/REC X Platform, or FTIX, is intended to increase the promotion of national carbon credits, renewable energy, and renewable energy certificates, thus improving the country’s efforts to mitigate climate change. Entrepreneurs interested in registering for carbon credit trading on the FTIX can do so through the FTIX website at fti-cc.com. The platform initially supports carbon credit trading through over-the-counter methods. In the near future, the FTIX will be developed to support 100% renewable energy (i.e., RE100 energy) and renewable energy certificate trading. However, the related tax and carbon pricing policies have not yet been issued. The TGO is currently in discussions with the Fiscal Policy Office and the Ministry of Finance regarding fiscal policy for the FTIX. For more information on the FTIX, or on any aspect of renewable energy activities in Thailand, please contact Charuwan Charoonchitsathian at [email protected], Napassorn Lertussavavivat at [email protected], or Ratchapat Triteeyaputranonta at [email protected].