Vietnam has taken a decisive step into the global artificial intelligence regulatory landscape with the promulgation of the Law on Artificial Intelligence No. 134/2025/QH15 (AI Law), adopted on December 10, 2025, and effective from March 1, 2026. As one of the earliest comprehensive, standalone AI statutes in Southeast Asia, the AI Law signals Vietnam’s ambition to position itself as both an innovation-friendly and governance-conscious AI market. In doing so, the legislature has also streamlined Vietnam’s AI regulatory architecture. The AI Law repeals most AI-related provisions previously embedded in the Law on Digital Technology Industry No. 71/2025/QH15, consolidating AI governance under a single, unified legal framework. This structural move underscores an intent to provide greater regulatory clarity and coherence for businesses operating across the AI value chain. Against this backdrop, the key question for AI developers, providers, deployers, and governance teams is how the new risk-based framework will shape compliance expectations, operational decisions, and governance design in practice. This article examines the new AI Law through that practical lens, focusing on what it means for AI businesses operating in or into Vietnam. Scope of Application The AI Law applies broadly to Vietnamese organizations and individuals, as well as foreign entities that participate in AI-related activities within Vietnam. The law expressly excludes AI activities conducted solely for national defense, security, and cryptography purposes. A defining feature of the AI Law is that it regulates by role, not by industry. It distinguishes between: Developers, who design, build, train, test, or fine-tune AI models and have direct control over the technical methods, training data, or model parameters; Providers, who place AI systems on the market or put them into use under their own names; Deployers, who use AI systems under their control in professional, commercial, or service-provision activities; Users, who interact with AI systems or rely on their outputs; and Affected persons, whose

Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices. The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape. Data Privacy and Cybersecurity Personal Data Protection Act B.E. 2562 (2019) Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA. Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources. Current status: The first round of public consultation has concluded. Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes. Cybersecurity Act B.E. 2562 (2019) Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority. Key issues: The amendments aim to clarify and strengthen the roles and duties of private entities, particularly

On January 7, 2026, the Central Bank of Myanmar (CBM) announced a further relaxation of foreign exchange regulations through Notification No. 2/2026, with an effective date of January 1, 2026. This notification reduces the mandatory conversion requirement for exporters’ earnings in foreign currency into Myanmar kyat (MMK). Under the new notification, exporters are required to convert only 15 percent of their foreign currency export earnings into MMK at official CBM reference exchange rates, down from the previous required minimum conversion level of 25 percent. The adjustment provides exporters with more flexibility to manage foreign currency, improving liquidity for international transactions and reducing cash flow pressure. However, companies must still comply with the foreign currency conversion procedures and timelines set out in the CBM’s Notification No. 12/2022.

Thailand’s Board of Investment (BOI) has tightened criteria for BOI-promoted companies to own land for residential use and introduced new procedures for land ownership applications under a new notification. Officially titled Notification of the Office of the Board of Investment No. Por. 9/2568 Re: Amended Criteria and Conditions for Permitting Foreign Juristic Persons Receiving Investment Promotion to Own Land for Office and Residence for Operational-Level Workers to Operate Business Granted Investment Promotion, dated July 18, 2025, the new notification was published in the Government Gazette on January 6, 2026, and is applicable to all applications submitted since the date of the notification (July 18, 2025). The new notification introduces an online application process for BOI-promoted companies seeking to own land for office use or residential purposes via the e-Land system, the BOI’s electronic system for land rights and benefits. Applications are reviewed virtually, and any requested amendments or additional documents must be submitted within seven business days. Failure to amend the application or submit any additional requested documents within this period will result in automatic rejection and removal of the application from the system. The new notification builds on the requirements specified in the previous notification on land ownership allowances for foreign companies, issued in 2024, by introducing additional qualification requirements for residences for operational-level workers (i.e., unskilled laborers). In this regard, such a residence must not be: Part of a land development project (housing estate), A condominium unit, or Classified as a house or commercial building.

Thailand’s Digital Government Development Agency (DGA) has proposed new standards that would require government agencies to select cloud services exclusively from a preapproved shortlist of providers. The draft Digital Government Standards re: Cloud Service Provider Standards aims to strengthen procurement confidence and reduce risks associated with selecting cloud service providers that do not meet the required standards. A public hearing period on these standards concluded on December 27, 2025. The DGA will now review submitted comments and consider revising the standards accordingly. Shortlisted Cloud Service Provider Tiers The draft standards establish three tiers of cloud service providers based on their assessed service capability levels, core qualifications, and certifications. The DGA sets qualification requirements for each tier, and it is at the discretion of each agency to select the tier of cloud service provider that best suits its operational needs, as follows: Tier 1 cloud service providers are suitable for providing services involving disclosable official data. Tier 2 cloud service providers are suitable for handling official data and protected data, such as personal data, which requires a high-security public cloud (e.g., virtual private cloud). Tier 3 cloud service providers are suitable for providing services to agencies with specific regulatory and security requirements that handle highly protected data, such as the national security system. These providers must offer sovereign or hybrid cloud as stipulated by the Ministry of Digital Economy and Society. All tiers of cloud service providers must be legal entities incorporated under Thai law and can be authorized distributors of offshore cloud service providers. However, each tier will be subject to different requirements, including infrastructure obligations. Government agencies are encouraged to select a cloud service provider appropriate for their intended use. For example, if a government agency intends to procure cloud services for operating applications that process personal data, it should select a tier 2

Thailand’s approach to cannabis regulation has moved quickly from broad access to a medical, prescription‑only system. The latest government regulation classifies the cannabis flower as a controlled herb under the Thai Traditional Medicine Wisdom Act. The latest rules ban advertising and recreational sales, allow sales only to patients with prescriptions (up to 30 days), and require flowers to come from GACP‑certified (Good Agricultural and Collection Practices) farms. More importantly, cannabis dispensaries can only sell to patients presenting valid prescriptions issued by one of seven professions—medical doctors, Thai traditional practitioners, applied Thai traditional practitioners, traditional Chinese medicine practitioners, pharmacists, dentists, and folk healers—consistent with approved clinical indications. Noncompliance risks license suspension or revocation, and criminal penalties of up to one year’s imprisonment or a THB 20,000 fine. The dispensary‑only model that proliferated in Thailand in recent years is expected to end soon, as the rules will push all cannabis dispensaries into medical settings or retail pharmacies. Dispensaries must convert into medical establishments—clinics, pharmacies, or traditional pharmacies—complete with on‑site licensed practitioners as well as budtenders; strong controls for storage, hygiene, odor, and smoke; and facilities for record-keeping. All flowers dispensed or exported must come from GACP‑certified farms. If the government ends dispensaries outright and forces a conversion to clinics or pharmacies, compensation will not be automatic at the outset. As a result, business operators should plan for compliance and repurposing under the Medical Facilities Act, Modern Drug Act, and Herbal Product Act, which regulate medical clinics, modern pharmacies, and traditional medicine pharmacies, respectively. The table below summarizes the required licenses for clinics, pharmacies, and traditional medicine pharmacies selling cannabis flowers in Thailand. Aside from the specific listed licenses, all three types of establishments must also obtain a license to sell a controlled herb (cannabis flowers) from the Department of Thai Traditional and Alternative Medicine.

Thailand has enacted comprehensive sexual harassment legislation that significantly expands criminal penalties and creates new compliance obligations for online platform operators. The Act Amending the Penal Code (No. 30) B.E. 2568 (2025), enacted on December 29, 2025, and taking effect the following day, introduces a comprehensive definition of sexual harassment, establishes new criminal offenses with graduated penalties, and imposes content removal obligations on social media platforms and computer system service providers. The amendment, which establishes a comprehensive framework for addressing sexual harassment in both physical and digital environments, significantly expands legal exposure for online service operators. It also grants courts authority to order takedowns of violating data accessible to the public. Definition of Sexual Harassment The law introduces “sexual harassment” as a distinct statutory concept covering physical conduct, verbal conduct, sounds, gestures, expressions, postures, communications, surveillance, stalking, and acts committed through computer systems or electronic devices. Conduct qualifies as sexual harassment when it is sexual in nature and likely to cause the victim distress, annoyance, embarrassment, humiliation, fear, or a sense of sexual insecurity. Criminal Offenses and Penalties The amended Penal Code establishes graduated penalties based on the severity and context of the harassment—including enhanced penalties for public or online conduct. For instance: Basic sexual harassment is punishable by imprisonment for up to one year, a fine of up to THB 20,000, or both. Continuous or repeated harassment that prevents normal life escalates penalties to imprisonment for up to two years, a fine of up to THB 40,000, or both. Critically for online operators, harassment committed in public places, in the presence of the public, or through computer systems accessible to the general public triggers imprisonment for up to three years, a fine of up to THB 60,000, or both. Acts of harassment committed by supervisors, employers, or others in positions of authority over victims are punishable by

Doing business in Thailand means operating under a strict regulatory framework. From time to time, companies may receive unexpected administrative orders from government authorities that restrict their operations, impose new compliance obligations, or levy fines and penalties. When this happens, a business may challenge the order under Thailand’s administrative law system. The primary concern in pursuing administrative litigation is timing, as strict statutory deadlines apply and missing them can permanently affect a company’s rights. First Step: Administrative Appeal Many companies assume the first step is to immediately bring the matter before the Administrative Court to seek revocation or suspension of the order. Some even attempt to request an interim injunction to stop the order from taking effect. However, Thai law generally requires that the company first challenge the order through an administrative appeal with the same agency that issued it. Only after this process is complete can the matter be taken to court. Seeking an interim injunction at this stage is also not possible. This is because Thai law does not allow a standalone application for an interim injunction; an injunction can only be requested together with the underlying complaint filed with the Administrative Court. Since a court complaint cannot be filed until the administrative appeal process has been exhausted, an injunction is usually not available at the early stage. What Are the Timeframes for Administrative Appeal? Thailand applies a two-stage administrative appeal process. The appeal must first be submitted to the same authority that issued the order, which will review its own decision. If that authority affirms its decision, the appeal is then escalated to the relevant higher authority for further review. In most cases, both stages must be completed before a company is allowed to proceed to court. The timeframe for filing an administrative appeal is very strict. Generally, an appeal must