Indonesia AI Regulation Overview

Overview

Indonesia's national approach to artificial intelligence regulation is evolving from high-level strategic guidance toward a comprehensive legal and supervisory framework. The initial vision for artificial intelligence was established by the Strategi Nasional Kecerdasan Artifisial (Stranas KA) 2020–2045, prepared by the Agency for the Assessment and Application of Technology (BPPT, now integrated into BRIN). Stranas KA framed artificial intelligence as a national development enabler focused on priority sector clusters such as healthcare, bureaucratic reform, education and research, food security, and smart cities.

In recent years, regulatory activity has intensified through both horizontal digital legislation and sector-specific instruments. Horizontal baseline governance for electronic systems is defined by Government Regulation No. 71 of 2019 (PP 71/2019) and Law No. 1 of 2024 (the Second Amendment to the Electronic Information and Transactions Law). Concurrently, financial regulators such as the Financial Services Authority (OJK) have introduced operational guidelines for commercial banks and fintech providers to address risk management, explainability, and human oversight in automated systems.

To unify these initiatives, the Ministry of Communication and Digital (Komdigi) introduced a strategic regulatory package in August 2025. This package includes the draft Buku Putih Peta Jalan Kecerdasan Artifisial Nasional (National AI Roadmap White Paper), the Konsep Pedoman Etika Kecerdasan Artifisial (Concept Draft of Ethical Guidelines), and a proposed Rancangan Peraturan Presiden tentang Kecerdasan Buatan (Draft Presidential Regulation), laying the foundation for an executive-led, risk-based AI governance regime.

Regulatory Approach

Indonesia employs a hybrid regulatory model that combines soft-law guidance, sector-specific directives, and foundational electronic transactions legislation, while preparing for a binding national executive decree. Under strategic instruments such as Stranas KA 2020–2045 and Komdigi's 2025 draft White Paper and Concept Ethical Guidelines, Indonesia advocates a values-led, risk-based philosophy designed to align artificial intelligence adoption with national values, privacy protections, and human rights.

The risk-based approach categorizes artificial intelligence systems by potential harm, applying heightened scrutiny to high-risk applications. Identified high-risk categories include biometric identification, public administration, critical infrastructure, law enforcement, and critical financial decisioning. High-risk systems are subject to requirements such as pre-deployment risk assessments, documentation standards (e.g., model cards), human oversight controls (human-in-the-loop), and potential mandatory registration or conformity assessments.

At the horizontal level, artificial intelligence systems operating as electronic systems are subject to electronic transaction laws (PP 71/2019 and Law No. 1/2024), which establish operational reliability, cybersecurity, and administrative enforcement mechanisms. Sectoral regulators, particularly OJK in the financial domain, complement this structure by embedding artificial intelligence risk management directly into existing corporate governance and prudential compliance workflows.

Key AI Legislation

• Strategi Nasional Kecerdasan Artifisial Indonesia (Stranas KA) 2020–2045: Adopted in 2020, this strategic roadmap outlines national AI goals, ethical principles, and cross-cutting priorities across five key sector clusters.
• Peraturan Pemerintah Nomor 71 Tahun 2019 (PP 71/2019): Executive regulation governing Electronic Systems and Transactions, setting operational obligations, system reliability mandates, data protection principles, and Electronic System Provider (PSE) registration requirements.
• Undang-Undang Nomor 1 Tahun 2024 (UU No. 1/2024): Second Amendment to the Electronic Information and Transactions Law, providing legal recognition for electronic certification services, imposing child protection duties on PSEs, and establishing administrative sanctions.
• Panduan Kode Etik AI di Industri Teknologi Finansial (2023): Non-binding sectoral guidance issued by OJK and fintech industry associations establishing core ethical principles (beneficial, fair/accountable, transparent/explicable, robust/secure) for fintech participants.
• Buku Panduan Tata Kelola AI Perbankan Indonesia (2025): Authoritative sectoral guidance published by OJK establishing end-to-end lifecycle governance, risk assessment, and human oversight standards for commercial banks.
• Buku Putih Peta Jalan Kecerdasan Artifisial Nasional (2025 Draft): Strategic policy draft issued by Komdigi outlining governance architecture, risk mitigation, and implementation phases for national AI deployment.
• Konsep Pedoman Etika Kecerdasan Artifisial (2025 Draft): Consultation draft produced by Komdigi setting out values-led principles, risk-based classifications, and transparency expectations to inform future binding regulations.
• Rancangan Peraturan Presiden tentang Kecerdasan Buatan (Draft Perpres): Executive decree initiative submitted by Komdigi to formalize national AI roadmap principles, establish high-risk governance, and streamline cross-agency oversight.

Governance & Enforcement Bodies

Governance of artificial intelligence in Indonesia is multi-tiered, involving central coordinating ministries, security authorities, research institutes, and sector regulators. Primary policy stewardship rests with the Ministry of Communication and Digital (Komdigi), which oversees digital infrastructure, manages Electronic System Provider (PSE) registrations, drafts national roadmaps and ethical guidelines, and coordinates the proposed Presidential Regulation on artificial intelligence.

Technical cybersecurity standards and operational resilience frameworks are overseen by the National Cyber and Crypto Agency (BSSN). BSSN collaborates with Komdigi to establish security indices, evaluate electronic system readiness, and handle incident responses across public and private electronic infrastructure. Research, innovation, and technical standards are coordinated by the National Research and Innovation Agency (BRIN), which absorbed the former Agency for the Assessment and Application of Technology (BPPT).

In the financial sector, enforcement and supervisory authority is held by the Financial Services Authority (OJK). OJK oversees commercial bank compliance with IT rules (e.g., POJK No. 11/POJK.03/2022) and enforces operational standards for AI-driven fintech and banking applications. Other line ministries, including the Ministry of Health and Ministry of Home Affairs, hold domain-specific oversight for AI deployments within their respective areas of authority.

Penalties & Enforcement

Enforcement mechanisms for electronic and artificial intelligence systems in Indonesia are predominantly administrative, backed by statutory powers under electronic transaction laws. Under PP 71/2019 and Law No. 1 of 2024, Penyelenggara Sistem Elektronik (PSE) that fail to meet system security, operational reliability, or child protection obligations are subject to a graduated scale of administrative sanctions. These include written warnings, administrative fines, temporary service suspensions, and access termination or removal from official registries.

In the financial domain, OJK incorporates AI governance checks into its regular supervisory examinations and dialogues. Although OJK's 2023 fintech ethics guidance and 2025 banking guidance operate as supervisory references, failure to maintain adequate risk management or governance can result in administrative directives, public admonitions, or statutory sanctions under financial sector laws. The draft Presidential Regulation on AI proposes expanding administrative enforcement tools specifically for high-risk AI deployments, incorporating corrective orders, administrative fines, operational suspensions, and public naming.

Data Protection Framework

Personal data handling within artificial intelligence applications is governed by foundational electronic system regulations and specialized data protection frameworks. PP 71/2019 establishes core data protection requirements, compelling electronic system providers to process data lawfully, maintain confidentiality, implement technical and organizational security controls, and notify data subjects and authorities in the event of security breaches. PP 71/2019 also distinguishes between public-scope PSEs (which must store and process data domestically) and private-scope PSEs (which may transfer data internationally subject to regulatory conditions).

Recent sector guidelines and draft AI policies explicitly harmonize artificial intelligence practices with Law No. 27 of 2022 on Personal Data Protection (UU PDP). OJK's 2025 banking guidance and Komdigi's draft ethical guidelines require data minimization, privacy-by-design, data provenance tracking, clear retention schedules, and mandatory Data Protection Impact Assessments (DPIAs) prior to deploying high-risk artificial intelligence applications.

Sector-Specific Rules

Sector-specific artificial intelligence rules are most structured within the financial and banking industries. OJK's 2025 AI Governance Guidance for Indonesian Banking requires commercial banks to establish an internal AI committee, implement end-to-end lifecycle controls, perform stress testing and model validation, and enforce human-in-the-loop oversight. Heightened requirements apply to high-impact applications such as credit scoring, automated onboarding (KYC), fraud detection, algorithmic pricing, and portfolio management. Similarly, the 2023 AI Code of Ethics for Fintech—developed by OJK alongside AFTECH, AFSI, AFPI, and ALUDI—sets standards for digital lending, P2P financing, and insurtech applications.

For other high-stakes domains, Stranas KA 2020–2045 and Komdigi's draft White Paper highlight health diagnostics, bureaucratic reform, education, food security, and smart cities as priority clusters. These policy instruments delegate the formulation of specific technical standards and risk mitigation measures to respective line ministries, such as the Ministry of Health for medical AI applications.

International Alignment

Indonesia's regulatory instruments explicitly reference global artificial intelligence frameworks to foster cross-border interoperability and supervisory compatibility. OJK's 2023 AI Ethics Code for Fintech and 2025 Banking Guidance explicitly incorporate principles from the OECD AI Principles, the NIST AI Risk Management Framework, and guidance from the Basel Committee on Banking Supervision (BCBS). OJK's banking manual also directly references the European Union AI Act for global benchmarking.

Strategic frameworks, including Stranas KA 2020–2045 and Komdigi's draft White Paper, advocate aligning domestic conformity standards and risk taxonomies with international norms while promoting domestic technological capabilities, including local language models and domestic research ecosystems.

Future Developments

The primary upcoming regulatory milestone in Indonesia is the finalization and promulgation of the Rancangan Peraturan Presiden tentang Kecerdasan Buatan (Draft Presidential Regulation on AI). Following public consultation on the draft White Paper and Concept Ethics Guidelines in August 2025, Komdigi submitted a formal initiative (izin prakarsa) to the State Secretariat to advance the Perpres through legal harmonization with the Ministry of Law and Human Rights.

Once enacted, the Presidential Regulation will provide a binding executive framework establishing national risk-classification criteria, registration protocols for high-risk systems, and coordinated inter-agency oversight mechanisms. In parallel, discussions regarding a comprehensive Draft Bill on Artificial Intelligence (RUU Kecerdasan Buatan) continue within legislative planning frameworks to provide permanent statutory oversight.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministry of Communication and Digital (Komdigi)	Central policy coordination for digital affairs, electronic systems governance, national AI roadmap, and AI ethics frameworks.	Issuing ministerial regulations, registering Penyelenggara Sistem Elektronik (PSE), imposing administrative sanctions (warnings, fines, service suspension, access termination).
Financial Services Authority (OJK)	Regulatory and supervisory oversight of commercial banking, fintech, and financial sector technological innovation.	Issuing regulatory guidance, conducting supervisory examinations, enforcing administrative sanctions and prudential directives.
National Cyber and Crypto Agency (BSSN)	National cybersecurity governance, technical security standards, and electronic system security assessments.	Establishing security index tools, setting technical resilience standards, inspecting electronic system security compliance.
National Research and Innovation Agency (BRIN)	National research coordination, technology assessment, and scientific standards development (incorporating former BPPT).	Formulating research strategies, supporting regulatory sandbox frameworks, evaluating technical innovation programs.