Indonesia - AI Ethics Guidelines

Overview

The "Panduan Kode Etik Kecerdasan Buatan (AI) yang Bertanggung Jawab dan Terpercaya di Industri Teknologi Finansial" is a sectoral guidance published jointly by OJK and four fintech associations to promote trustworthy AI use in Indonesia's fintech ecosystem. Launched at the 5th Indonesia Fintech Summit & Expo (IFSE) on 24 November 2023 and published on the OJK publications portal in early December 2023, the document sets out high-level principles and recommended governance, operational and monitoring arrangements for fintech firms that develop, deploy or procure AI systems. The guidance draws upon and references international instruments such as the OECD AI Principles and the NIST AI Risk Management Framework, tailoring those concepts to the Indonesian fintech context. The guidance is designed as a code of conduct that associations can convert into member standards, and as an industry reference point that OJK may use in supervisory dialogue. The official OJK announcement and publication are available on the OJK site: OJK publication: Panduan Kode Etik AI (Dec 4, 2023).

Definitions

The guidance defines key terms to ensure common understanding across the fintech sector, including "Artificial Intelligence/AI" (systems that perform tasks typically requiring human intelligence), "AI lifecycle" (design, development, testing, deployment, monitoring, and retirement), "operator/owner" (entities responsible for model decisions), "human oversight" (procedures ensuring meaningful human control), and "high-impact use-cases" (AI applications that significantly affect customers' rights or access to financial services). It clarifies that AI in fintech includes predictive credit scoring models, automated underwriting, fraud detection engines, personalized recommendations, conversational agents (chatbots), and algorithmic decisioning for onboarding or pricing. Definitions reference internationally accepted conceptions to enable alignment with cross-border guidance.

Governance and Institutional Framework

The guidance emphasizes senior management and board-level accountability for AI adoption and risk oversight. Firms are expected to incorporate AI governance into existing Governance-Risk-Compliance (GRC) frameworks, appoint designated AI owners or committees, maintain documented AI policies, and align incentives to promote responsible AI behaviour. Associations are encouraged to develop member codes of conduct and training programs. OJK positions itself as a convenor and supervisory partner rather than an immediate rulemaking authority in this publication; nevertheless, the guidance signals that OJK supervisory assessments will consider adherence to these governance expectations. The guidance also cross-references OJK's broader supervisory architecture for ITSK and sandboxing (see related OJK publications and POJK developments) and provides a framework for institutional roles across product teams, risk/compliance functions, internal audit, and external vendors. For the official OJK press release see: OJK press release (Nov 24, 2023).

Key Focus Areas

The guidance organizes operational expectations into distinct focus areas: 1) Principles and ethics (beneficial outcomes, fairness/accountability, transparency/explainability, robustness/security); 2) Risk assessment (identifying, classifying and prioritizing AI risk across the lifecycle); 3) Data governance (privacy-by-design, consent, provenance, minimization, retention limits and quality); 4) Model development and validation (testing, bias detection, performance metrics, stress and adversarial testing); 5) Human oversight and appeals (mechanisms for human review and dispute resolution); 6) Cybersecurity and resilience (secure development lifecycle, access controls, incident response); 7) Vendor and third-party management (assurance clauses, audits and SLAs); 8) Consumer protections and disclosures (clear information to customers on AI-driven decisions and channels for redress); and 9) Documentation & audit trails (complete development, testing, versioning and deployment records). The guidance provides practical illustrations for fintech-relevant use-cases such as credit scoring, pricing, onboarding automation, and fraud detection, emphasizing especially those use-cases that affect access to essential financial services.

Implementation Framework

The implementation section recommends a staged approach: initial gap assessment and policy adoption; classification of AI use-cases by risk and materiality; design and deployment of governance structures (AI committee, AI owner, risk sign-off gates); pre-deployment testing and third-party assurance for high-risk models; customer-facing disclosures and complaint handling; continuous monitoring with performance and fairness metrics; and formal periodic review (including trigger-based re-validation). The guidance provides templates and checklists for associations to adopt as their own member codes of conduct and encourages capacity building (training for boards, risk teams, and product developers). It also encourages firms to leverage regulatory sandboxes for controlled testing where appropriate and notes that existing OJK sandbox and registration mechanisms under the evolving ITSK regulatory framework may be relevant for certain AI-enabled innovations.

Monitoring and Evaluation

Monitoring requirements are oriented to both technical performance and governance effectiveness. Firms should implement automated monitoring signals (data drift, model accuracy, false positive/negative rates across demographic segments), periodic fairness audits, and incident logbooks. The guidance recommends establishing KPIs for AI risks and governance maturity, and setting escalation triggers for supervisory reporting or rollback. Associations are expected to collect anonymized industry-level insights to inform sector risk intelligence sharing and capacity building. OJK indicates that it will monitor industry adoption and may incorporate key elements into future supervisory expectations or formal rulemaking.

Penalties, Liability, and Appeals

As a voluntary code of ethics, the guidance itself does not create new statutory penalties; however non-compliance with the principles may be relevant to OJK's supervisory judgment under existing laws and regulations governing licensing, consumer protection, market integrity and prudential standards. The guidance explicitly recommends that firms maintain consumer-facing appeals and redress channels, keep records to support liability and remediation decisions, and ensure contracts with third parties allocate liability and incident response obligations. While the guidance does not prescribe monetary fines, it foresees supervisory actions under existing OJK powers (e.g., warnings, orders to remediate, license restrictions, or referrals where statutory breaches are identified).

Relationship to Other Instruments

The guidance is positioned as complementary to OJK’s regulatory program for ITSK (Financial Sector Technological Innovation) and the regulatory sandbox regime. It references international standards (OECD and NIST) as intellectual inputs, while remaining explicitly aligned with Indonesian law (including data protection, consumer protection, and prudential regulation). The guidance anticipates interaction with POJK No. 3 of 2024 (Penyelenggaraan ITSK) and subsequent SEOJK/SEOJK rulemaking on registration, sandbox mechanisms and cybersecurity guidance. Associations and firms are encouraged to align their codes with this guidance and to incorporate any sector-specific legal obligations that already apply to licensed financial services firms.

International Alignment

The code explicitly cites international frameworks to ensure interoperability and to avoid regulatory fragmentation. By referencing the OECD AI Principles and the NIST AI RMF, OJK signals an intention to harmonize domestic fintech practices with global best practice while retaining flexibility to address local market and legal conditions. The guidance supports cross-border fintech activities by advocating for transparency on model provenance, data sharing constraints and vendor oversight, which are critical for multi-jurisdictional operations and international cooperation on AI risk management.

Implementation Timeline

Sources and References