Thailand AI Governance: Policy, Legislation & Sectoral Frameworks (2024)
Thailand’s Electronic Transactions Development Agency (ETDA) unveiled draft principles for a national law governing artificial intelligence in February 2026, signaling a significant step toward establishing a comprehensive regulatory framework for the rapidly evolving technology. The proposed legislation, currently under review following a public hearing, aims to balance innovation with risk management, mirroring aspects of the European Union’s AI Act while adapting to Thailand’s unique legal and technological landscape.
The draft principles, organized around five key areas, delegate authority to a central enforcement agency and sector-specific regulators to assess and categorize AI risks. Providers of high-risk AI systems would be required to implement internationally recognized risk management systems, such as ISO/IEC 42001:2023, and appoint local representatives if based outside of Thailand. Deployers of such systems would be obligated to ensure human oversight, maintain operational logs, and guarantee data quality, as well as notify individuals potentially affected by AI-driven decisions.
The ETDA’s approach emphasizes support for innovation through exceptions for text and data mining of online data and the establishment of regulatory sandboxes. Participants in these sandboxes, operating in good faith, would benefit from a safe harbor against penalties, though civil liability for damages would remain. The framework as well clarifies that AI-generated actions will be attributable to a human, and that contracts or administrative decisions assisted by AI will not be deemed legally invalid.
While the draft AI principles are still under consideration, several Thai regulators have already proactively issued guidelines for businesses within their respective jurisdictions. In September 2025, the Bank of Thailand released Guiding Principles for Artificial Intelligence Risk Management, applicable to financial institutions and payment service providers. The Securities and Exchange Commission of Thailand followed in the same year with a governance framework for AI and machine learning applicable to securities, derivatives, and digital asset operators, focusing on fairness, legal compliance, accountability, and transparency.
The Office of Insurance Commission also issued AI governance guidelines for insurance companies in 2025, addressing risk management, security, transparency, and consumer protection. The Personal Data Protection Committee released draft Guidelines on Personal Data Protection in AI Development and Use in February 2026, focusing on stakeholder roles, data processing agreements, data protection impact assessments, and security measures. The National Cyber Security Agency released AI security guidelines in September 2025, aligning with ISO/IEC 42001:2023 and the National Institute of Standards and Technology’s AI risk management framework.
These sector-specific guidelines, while not legally binding, signal a clear expectation of compliance from regulated entities. Athistha (Nop) Chitranukroh, a partner and director at Tilleke & Gibbins, specializes in corporate and commercial law in Thailand and Vietnam, and can be reached at [email protected]. The firm, located in Bangkok, can be contacted at +66 2056 5600.
The development of these principles follows the Thai cabinet’s approval of the Thailand National AI Strategy and Action Plan (2022-2027) in July 2022, which aims to establish a comprehensive AI ecosystem by 2027. The strategy is built around five pillars: preparing social, ethical, legal, and regulatory readiness; developing national infrastructure; increasing human capability and AI education; driving technology and innovation; and promoting AI adoption across public and private sectors. The ETDA acknowledged that earlier drafts of the AI legislation, modeled on the EU framework, required updating to reflect Thailand’s evolving legal and technological landscape.
The draft AI principles, once revised, will be transformed into a draft AI Act for further public hearing before proceeding through the legal enactment process. Without comprehensive AI legislation, existing laws, including the Civil and Commercial Code, the Personal Data Protection Act, and the Computer Related Crime Act, continue to apply to the design, development, and use of AI in Thailand.