AI regulation in Thailand (2026)

Thailand's Personal Data Protection Committee released non-binding draft Guidelines on Personal Data Protection in the Development and Use of AI, clarifying Controller/Processor roles in AI chains, mandating DPIAs for high-risk AI, and restricting unauthorised use of data to train models. They signal how PDPA obligations will be interpreted as AI adoption accelerates, with public comment accepted until 25 February 2026.

The NCSA (under MDES) published the 'AI Security Guidelines', providing lifecycle-based best practices for protecting AI systems aligned with ISO/IEC 42001:2023, ISO/IEC 23894:2023, NIST AI RMF, and ENISA frameworks. The guidelines establish roles and responsibilities, mandate AI security assessments, and require data-disposal procedures in line with ISO/IEC 27002:2022.

The Bank of Thailand officially released its Guiding Principles for AI Risk Management, applicable to all banks, special financial institutions, and payment-service providers. The voluntary guidelines—built on a June 2025 draft—cover AI lifecycle governance, fairness, cybersecurity, transparency, human oversight, and customer opt-out rights, marking Thailand's first sector-specific AI regulatory instrument.

ETDA and MDES published unified Draft Principles of the Law on Artificial Intelligence, merging the 2022 ONDE Draft Royal Decree and the 2023 ETDA Draft Act. The text adopts an EU AI Act-style risk hierarchy (prohibited, high-risk, limited-risk), bans social-scoring, subliminal manipulation, and real-time biometric surveillance in public spaces, and introduces regulatory sandboxes and safe-harbour protections. Public consultation closed 9 June 2025.

The Electronic Transactions Development Agency published the Draft Act on the Promotion and Support for National AI Innovation, proposing government-backed AI Innovation Testing Centres, public-private data-sharing frameworks, and contractual-risk templates. A second consultation round followed in July 2023; the draft was later merged into the 2025 consolidated principles.

The Thai Cabinet formally adopted the National AI Strategy and Action Plan (2022–2027), developed by the National Artificial Intelligence Committee under MDES. The five-pillar strategy—covering ELSI/regulation, infrastructure, human capability, R&D, and adoption—established the institutional architecture and five-year roadmap for Thailand's AI ecosystem, assigning operational functions to NSTDA/NECTEC.

Thailand's Personal Data Protection Act B.E. 2562 became fully enforceable on 1 June 2022 after pandemic-related delays. Modelled on GDPR, the PDPA immediately imposed consent, data-minimisation, DPIA, and cross-border transfer obligations on all AI systems processing personal data, with administrative fines up to THB 5 million per violation and criminal fines up to THB 1 million.

The Office of the National Digital Economy and Society Commission released the Draft Royal Decree on Business Operations Using AI Systems for public consultation. Introducing Thailand's first three-tier risk classification (prohibited, high-risk, limited-risk), it imposed registration, risk-management, transparency, and local-representative obligations on commercial AI operators—the first risk-based AI regulatory proposal in Thailand.

The National Science and Technology Development Agency published a non-binding AI Ethics Guideline establishing a multi-layered governance model: organisational AI ethics committees, technical standards for testing and documentation, and cross-agency national coordination. Aligned with OECD AI Principles, it provided the ethical bedrock referenced in all subsequent regulatory instruments.

The Ministry of Digital Economy and Society drafted Thailand's inaugural national AI ethics guidelines, which received Cabinet approval in February 2021. The document articulated core principles—transparency, fairness, accountability, and privacy—establishing a normative foundation for responsible AI before any binding regulation was in place.