Indonesia - Draft AI Bill

Overview

The Draft Bill on Artificial Intelligence ("RUU AI") would establish a national, risk-based legal framework for the development, deployment, and oversight of AI systems across public and private sectors in Indonesia. It is intended to operationalize priorities defined in the national strategic framework "Strategi Nasional untuk Kecerdasan Artifisial 2020–2045" and to be coordinated with ministries and agencies responsible for communications, cybersecurity, research, health, and economic coordination. Official statements and government roadmaps indicate the Government planned to publish a more detailed AI roadmap during 2025 while broader strategic direction stems from the 2020–2045 national strategy. For context and ongoing public materials see the national strategy and government announcements. Setkab: International Cooperation on AI. (setkab.go.id)

Definitions

The draft would define core terms: "artificial intelligence" and "AI system" (likely as software or systems that produce outputs such as predictions, recommendations, content or decisions); "provider" (entity that develops or supplies an AI model or service); "deployer" (entity that integrates or uses the AI system in a specific context); "high-risk AI" (systems whose failure, misuse, or bias presents serious harm to health, safety, fundamental rights, or public order); and "training data". Definitions would be calibrated to align with existing Indonesian law (e.g., electronic systems law, personal data protection law) and international norms to maintain interoperability.

Governance and Institutional Framework

The bill would establish a multi-agency governance model with lead coordination by the Ministry of Communication and Digital (Kominfo) or a dedicated national AI coordination unit, supported by the National Cyber and Crypto Agency (BSSN) for cybersecurity, BRIN for research standards, Kemenkes for health-related AI, and the Ministry of Home Affairs for local government deployment. The DPR's Badan Legislasi (Baleg) and parliamentary committees would retain legislative oversight. The law would likely create mechanisms for interministerial coordination, technical advisory boards (including civil society and industry representatives), and a registration / catalogue system for high-risk AI systems to support market surveillance and transparency. See Kominfo statements and national strategy documents for roles and priorities. Kementerian Komunikasi dan Informatika (Kominfo).

Key Focus Areas

The RUU would be expected to emphasize: (1) risk-based categorization (prohibited, unacceptable, high, limited, minimal risk); (2) mandatory risk assessments and mitigation for high-risk systems; (3) requirements for transparency and human oversight (including model documentation, "model cards", and user-facing disclosures when decisions significantly affect individuals); (4) data governance and mandatory alignment with Indonesia's Personal Data Protection law; (5) cybersecurity and model security controls to prevent poisoning, leakage, or misuse; (6) conformity assessment and registration for systems that impact safety or rights; (7) sector-specific safeguards for healthcare, finance, public services and broadcasting; and (8) research and innovation safeguards enabling safe experimentation (sandbox regimes). These focus areas reflect the national strategy and Kominfo roadmap priorities. Strategi Nasional untuk Kecerdasan Artifisial 2020–2045.

Implementation Framework

Implementation would combine primary legislation with delegated regulation: ministerial regulations (Peraturan Menteri), government regulations (Peraturan Pemerintah), and sectoral technical standards. The law would empower regulators to set conformity assessment procedures, require pre-deployment safety testing for high-risk AI, define notification or registration thresholds, and mandate incident reporting and post-market monitoring. It would also foreclose certain prohibited uses (e.g., unregulated biometric mass surveillance) and outline sandbox pathways for innovators. Regulatory coordination with the Personal Data Protection Act and existing electronic systems legislation is anticipated.

Monitoring and Evaluation

Monitoring would rely on market surveillance authorities, periodic audits, mandatory reporting from providers and deployers, and public registries for high-risk systems. The law would require impact metrics (safety, fairness, transparency) and periodic public evaluation to permit updates in response to rapid technical change. A national AI observatory or registry may be used to collect usage statistics and incidents, guiding updates to the risk taxonomy and enforcement priorities.

Penalties, Liability, and Appeals

The draft would create a layered enforcement scheme: administrative sanctions (warnings, fines scaled to turnover or impact), corrective orders (recalls, suspension), civil liability provisions (for harms caused by systems), and criminal sanctions for deliberate wrongdoing where applicable (e.g., severe negligence or fraud). It would also institute appeal mechanisms and judicial review for enforcement actions. The bill would coordinate liability regimes with existing Indonesian civil and consumer protection laws.

Relationship to Other Instruments

The RUU AI would be designed to operate alongside: Law on Electronic Information and Transactions (ITE law and related government regulations), the Personal Data Protection Act (UU No. 27/2022), sectoral laws (health, finance, broadcasting), and national data governance policies such as One Data Indonesia. The draft must ensure consistency and avoid conflicts with existing statutes while providing AI-specific obligations where gaps exist. Officials have indicated AI provisions may also appear in sector-specific laws and RUU revisions (e.g., copyright, broadcasting, education).

International Alignment

Indonesia seeks to align its approach with international standards (OECD, EU AI Act principles, G20 outcomes) while advocating positions for developing countries in global fora. The national strategy and government statements emphasize international cooperation, capacity building, and alignment that preserves technological sovereignty and inclusive development. The law would therefore incorporate internationally recognized principles such as human-centric AI, proportionality, transparency, and accountability. Setkab: International Cooperation on AI. (setkab.go.id)

Implementation Timeline

Sources and References