Philippines - AI Governance Framework

Overview

The Philippines has adopted a proactive and multi-stakeholder approach to artificial intelligence regulation, transitioning from early research roadmaps to a high-level national strategy. The cornerstone of the current regime is the National AI Strategy for the Philippines (NAIS-PH), approved by President Ferdinand Marcos Jr. in May 2025. This strategy provides a whole-of-government framework through 2028, focusing on five core pillars: infrastructure development, workforce capacity building, an innovation ecosystem, ethical policy frameworks, and strategic deployment in priority sectors like healthcare and agriculture. The philosophy is centered on "inclusive innovation," ensuring that AI serves as a tool for national development while mitigating systemic risks to human rights and social equity. The maturity of the Philippine AI landscape is reflected in its rising global readiness scores and the establishment of dedicated institutions like the Center for AI Research (CAIR). Historically, the country relied on the National AI Strategy Roadmap (NAISR 1.0) launched in 2021, which focused on industrial competitiveness. However, the rapid emergence of generative AI led to the adoption of NAISR 2.0 in 2024 and the subsequent 2025 presidential strategy. These frameworks emphasize that AI development must be human-centric and aligned with the Philippines' broader development goals, such as poverty reduction and disaster resilience. The government maintains a balance between fostering a competitive environment for the Business Process Outsourcing (BPO) sector and protecting the 1.3 million workers within that industry from unregulated automation. This strategic vision is integrated into the Philippine Development Plan 2023-2028, which identifies AI as a key driver for the "Digital Philippines" initiative, aiming to transform the nation into a regional hub for high-value AI services and research.

Regulatory Approach

The Philippine regulatory approach is currently a hybrid of horizontal policy frameworks and sector-specific binding regulations. At the horizontal level, the governance is largely "soft law," driven by strategic roadmaps and ethical guidelines that encourage responsible adoption without imposing rigid technological barriers. However, this is underpinned by the Data Privacy Act of 2012 (RA 10173), which provides a legally binding foundation for all AI systems processing personal data. The National Privacy Commission (NPC) has further solidified this through Advisory No. 2024-04, which explicitly applies data protection principles—transparency, legitimate purpose, and proportionality—to the entire AI lifecycle, from training to deployment. This "rights-based" approach ensures that technological advancement does not come at the expense of individual privacy or autonomy. In specific sectors, the approach becomes more prescriptive and binding. For example, the Commission on Elections (COMELEC) has issued Resolution No. 11064, which imposes strict prohibitions on deepfakes and mandates the registration of all AI-generated campaign content for the 2025 elections. This reflects a risk-based philosophy where high-stakes applications, such as democratic processes and labor relations, receive targeted intervention. Meanwhile, the legislature is considering several "hard law" proposals, such as House Bill 7396 and House Bill 7913, which aim to create a centralized Artificial Intelligence Development Authority (AIDA) and an AI Bill of Rights. These pending bills suggest a move toward a more formal, European-style risk-based classification system for AI applications in the near future, where high-risk systems will be subject to mandatory audits and registration.

Key AI Legislation

The legislative landscape in the Philippines is characterized by a mix of established statutes and a surge of new proposals aimed at addressing the specific challenges of generative AI. The foundational law remains the Data Privacy Act of 2012 (RA 10173), which governs how AI systems collect and process personal information. This is supplemented by the Cybercrime Prevention Act of 2012 (RA 10175), which provides the legal basis for prosecuting AI-enabled fraud and identity theft. In 2024 and 2025, the executive branch introduced the National AI Strategy Roadmap 2.0 and the NAIS-PH, which serve as the primary policy instruments for government-wide AI coordination. On the legislative front, several key bills are currently under review in the 19th Congress. House Bill No. 7396, also known as the Artificial Intelligence Development Act, seeks to establish the Artificial Intelligence Development Authority (AIDA) to oversee the development and deployment of AI technologies. House Bill No. 7913, the AI Bill of Rights, focuses on protecting citizens from algorithmic bias and ensuring transparency in automated decision-making. Additionally, House Bill No. 9448 (Protection of Labor Against AI Automation Act) and House Bill No. 10567 (Deepfake Accountability and Transparency Act) target specific risks in the labor market and digital media, respectively. These bills collectively represent a comprehensive effort to create a robust legal framework that can adapt to the rapid pace of AI innovation while safeguarding public interest.

Governance & Enforcement Bodies

The governance of AI in the Philippines is distributed across several key agencies, each managing a specific dimension of the technology. The Department of Science and Technology (DOST) serves as the lead technical agency, overseeing the National Center for AI Research (CAIR) and managing the country's high-performance computing (HPC) infrastructure. The DOST is responsible for setting technical standards and providing the R&D support necessary for local AI startups. The Department of Trade and Industry (DTI) focuses on the economic and industrial aspects of AI, promoting the Philippines as a regional hub for AI-enabled services and supporting the digital transformation of Micro, Small, and Medium Enterprises (MSMEs). The Department of Information and Communications Technology (DICT) provides the foundational digital infrastructure and cybersecurity oversight necessary for secure AI deployment, including the management of the national cloud and data center projects. Enforcement and oversight are primarily handled by the National Privacy Commission (NPC) and the Commission on Elections (COMELEC). The NPC has the mandate to audit AI systems for data privacy compliance and can investigate complaints regarding algorithmic bias or unauthorized profiling. For the 2025 election cycle, COMELEC’s Task Force KKK sa Halalan serves as a specialized enforcement unit to monitor digital campaigns and coordinate with social media platforms for the removal of non-compliant AI content. If pending legislation like HB 7396 is passed, the proposed Artificial Intelligence Development Authority (AIDA) would become the central regulator, consolidating these various mandates into a single body under the Office of the President to ensure a unified national approach.

Penalties & Enforcement

Penalties for AI-related violations currently stem from existing statutes, most notably the Data Privacy Act and the Omnibus Election Code. Under RA 10173, unauthorized processing of personal data or security breaches involving AI systems can lead to imprisonment for up to seven years and administrative fines ranging from PHP 500,000 to PHP 5 million. The NPC Advisory 2024-04 reinforces these penalties, noting that personal information controllers are held strictly accountable for the outcomes of their AI systems, regardless of whether the processing was performed by a third-party AI provider. Furthermore, the NPC has the power to issue cease-and-desist orders, effectively shutting down AI applications that pose an immediate threat to data subject rights. In the electoral context, COMELEC Resolution No. 11064 introduces severe sanctions for the use of prohibited deepfakes or unregistered AI campaign tools. Violators face criminal charges under the Omnibus Election Code, which can result in the disqualification of candidates from seeking or holding public office and the deprivation of their right to vote. Influencers and content creators who fail to disclose paid AI-generated content also face legal liability under consumer protection and election laws. Proposed legislation, such as the Deepfake Accountability and Transparency Act (HB 10567), seeks to expand these penalties, suggesting fines of up to PHP 5 million for first-time offenses related to the distribution of non-disclosed deepfakes targeting public officials or the general public. The government is also exploring the use of "reputational penalties," such as public registries of non-compliant AI developers, to encourage ethical behavior in the private sector.

Data Protection Framework

The Philippine data protection framework is highly robust and serves as the primary check on AI development. The Data Privacy Act of 2012 (DPA) is often cited as being closely aligned with the EU's General Data Protection Regulation (GDPR), providing a high standard of protection for Filipino citizens. It mandates that any AI system processing personal data must implement Privacy-Enhancing Technologies (PETs) and conduct regular Privacy Impact Assessments (PIAs) to identify and mitigate potential risks. The law emphasizes the "right to object," allowing Filipinos to opt-out of automated processing and profiling, especially when such processing produces legal effects or significantly affects the individual. Recent guidance from the National Privacy Commission (NPC Advisory 2024-04) has clarified that these protections apply throughout the AI lifecycle, from the initial data collection for training sets to the final deployment of the model. Developers must ensure "explainability," meaning they must be able to describe the logic and anticipated consequences of an AI's decision-making process to the data subject in a clear and understandable manner. There is also a strong emphasis on data minimization, requiring that only the strictly necessary data be used for training AI models, and that such data be anonymized or pseudonymized whenever possible. While the Philippines encourages the free flow of data for innovation, the NPC maintains strict oversight of cross-border data transfers, ensuring that Filipino data processed by foreign AI providers remains protected under Philippine standards. The NPC also promotes the "Privacy by Design" principle, encouraging developers to integrate data protection features into the very architecture of their AI systems.

Sector-Specific Rules

Sector-specific AI regulation in the Philippines is most advanced in the fields of elections, labor, and finance. The 2025 election cycle is governed by COMELEC Resolution No. 11064, which is one of the most comprehensive electoral AI regulations in Southeast Asia. It specifically bans the use of bots, fake accounts, and coordinated inauthentic behavior to manipulate public opinion. It also requires that any AI-generated content—including text, images, and video—be clearly labeled with a persistent disclaimer that identifies it as AI-generated. This proactive stance is designed to protect the integrity of the democratic process in a country with extremely high social media penetration. In the labor sector, the Protection of Labor Against Artificial Intelligence Automation Act (HB 9448) is currently under review. This bill addresses the unique vulnerability of the Philippine workforce to automation, particularly in the BPO and manufacturing sectors. It proposes a prohibition on replacing human workers with AI if it leads to displacement without providing "equivalent alternative employment" or adequate retraining programs. Additionally, it seeks to ban employment decisions (hiring, firing, promotion) made solely by AI without meaningful human oversight. In the financial sector, the Bangko Sentral ng Pilipinas (BSP) has issued guidelines on Model Risk Management, which require banks to validate the algorithms used for credit scoring and fraud detection. These sector-specific rules ensure that the risks of AI are managed in a way that is tailored to the unique needs and vulnerabilities of different parts of Philippine society, preventing a "one-size-fits-all" approach that might stifle innovation or leave certain groups unprotected.

International Alignment

The Philippines actively aligns its AI governance with international standards to ensure interoperability and attract foreign investment. The National AI Strategy Roadmap 2.0 explicitly references the OECD Principles on Artificial Intelligence and the UNESCO Recommendation on the Ethics of AI. By adopting these global benchmarks, the Philippines aims to position itself as a "trusted" destination for AI R&D and high-value digital services. The country also participated in the development of the ASEAN Guide on AI Governance and Ethics, which promotes a regional approach to AI safety and innovation, focusing on cultural sensitivity, economic inclusivity, and the needs of developing economies. Furthermore, the Philippine legal framework is designed to be compatible with major international data regimes. The DPA's alignment with the GDPR allows for smoother data flows with European partners, while the country’s participation in the APEC Cross-Border Privacy Rules (CBPR) system facilitates data exchange within the Asia-Pacific region. In 2025, the government emphasized its commitment to international alignment by hosting regional high-performance computing (HPC) sites and seeking partnerships with global tech leaders to bridge the digital divide. This strategy ensures that Philippine AI regulations are not isolated but are part of a broader global effort to establish responsible AI norms. The government also engages in bilateral cooperation with countries like Japan and the United States on AI safety research and workforce development, ensuring that the Philippines remains at the forefront of international discussions on AI governance.

Future Developments

The next 24 months are expected to be a transformative period for Philippine AI law. The most significant anticipated development is the potential consolidation and passage of the various AI bills pending in the 19th Congress. Lawmakers are working to harmonize the Artificial Intelligence Development Act (HB 7396) with the AI Bill of Rights (HB 7913) to create a comprehensive "Philippine AI Act." This legislation would likely formalize the creation of the Artificial Intelligence Development Authority (AIDA) and establish a clear registry for high-risk AI systems, similar to the tiered approach seen in the EU AI Act. Additionally, the 2025 midterm elections will serve as a critical test case for the enforcement of COMELEC’s AI resolutions. The success or failure of Task Force KKK in managing deepfakes and misinformation will likely inform future permanent legislation regarding digital content and AI transparency. On the technical side, the expansion of the Center for AI Research (CAIR) and the 26-fold increase in high-performance computing capacity promised by the NAIS-PH strategy will likely lead to new technical standards and certification regimes for AI systems. As the Philippines moves toward 2028, the focus will shift from foundational policy-making to the rigorous enforcement of ethical standards across all sectors of the digital economy. There is also an increasing focus on "AI for Good" initiatives, with the government planning to launch large-scale AI projects in disaster response and climate change adaptation, which will require new regulatory frameworks for data sharing and public-private partnerships. The evolution of the Philippine AI landscape will be characterized by a shift from reactive measures to a proactive, integrated governance system that supports both innovation and social protection.

Key Regulations

Enforcement Bodies