Asia - AI Regulation Overview

Overview

As of September 19, 2026, Asia presents a highly dynamic, multi-speed regulatory landscape for artificial intelligence. Over recent years, the region has rapidly evolved from reliance on foundational ethical guidelines and high-level national roadmaps toward binding statutory frameworks, risk-tiered operational mandates, and targeted sectoral legislation. Rather than adopting a single unified regional approach, Asian jurisdictions have developed distinct regulatory tracks shaped by local economic priorities, state governance models, and digital sovereignty goals. The overarching environment in 2026 is characterized by the coexistence of proactive omnibus legislation in pioneering East and Central Asian economies alongside agile, soft-law, and sandbox-driven models in Southeast Asia and Oceania.

East Asian economies have taken decisive steps to institutionalize statutory AI governance. South Korea established a historic statutory marker with the Framework Act on the Development of Artificial Intelligence and Establishment of Trust (enacted in 2025 and fully effective January 22, 2026), alongside the presidential-level Republic of Korea AI Action Plan (AI Basic Plan (2026~2028)). Japan finalized its statutory architecture through the Act on Promotion of Research, Development and Utilization of Artificial Intelligence‑Related Technologies (AI Promotion Act) (enforced September 1, 2025) and its updated Artificial Intelligence Basic Plan (adopted July 2026). Taiwan enacted the Taiwan Artificial Intelligence Basic Act in 2026, while China continues to enforce specialized rules including the Interim Measures for the Administration of Generative AI Services, the Provisions on the Administration of Deep Synthesis of Internet-based Information Services, the Measures for the Identification of AI-Generated (Synthetic) Content (effective September 1, 2025), the Administrative Measures for the Labeling of AI-Generated Content, and the Interim Measures for the Administration of Personified Interactive Services Powered by Artificial Intelligence, complemented by local frameworks such as the Shanghai Regulations on Promoting the Development of AI Industry, the Shenzhen Special Economic Zone Artificial Intelligence Industry Promotion Regulation, and the Beijing Measures for Promoting the Innovative Development of General Artificial Intelligence.

In Southeast and South Asia, governance architectures balance innovation promotion with domain-specific enforcement. Singapore maintains a pragmatic model combining voluntary frameworks like the Updated Model AI Governance Framework for Agentic AI with targeted statutes such as the Elections (Integrity of Online Advertising) (Amendment) Act 2024 (effective January 22, 2025) and the Workplace Fairness Bill (adopted in 2025). Malaysia has structured its trajectory around the Pelan Tindakan AI Kebangsaan 2026-2030 (effective July 28, 2026), the National Guidelines on AI Governance & Ethics (AIGE), and statutory enforcement via the Cyber Security Act 2024. Vietnam has introduced hard-law measures through the Law on Digital Technology Industry (effective January 1, 2026) and the Law on Artificial Intelligence (effective March 1, 2026). Meanwhile, Central and South Asian states—including Kazakhstan with its Digital Code of the Republic of Kazakhstan (adopted 2026) and Draft Law 'On Artificial Intelligence' (2025), Uzbekistan with its Strategy for the Development of Artificial Intelligence Technologies until 2030 and Draft Law on Artificial Intelligence, and Pakistan with its Digital Nation Pakistan Act, 2025 and National Artificial Intelligence Policy (National AI Policy) 2025—are rapidly formalizing state-led digital controls.

Key Trends and Focus Areas

Across the diverse legal traditions of the region, several dominant regulatory themes and operational focus areas have emerged as central pillars of Asian AI governance in 2026:

• Tiered Risk-Based Frameworks and High-Impact Classifications: A primary trend across Asian statutory regimes is the adoption of risk-based system classifications. South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust distinguishes general-purpose AI from "High-Impact AI" (systems affecting human life, physical safety, or fundamental rights in domains like healthcare, hiring, and energy), imposing mandatory risk assessments and lifecycle oversight. Similarly, Kazakhstan's Draft Law 'On Artificial Intelligence' and Digital Code of the Republic of Kazakhstan establish a three-tier risk model imposing pre-deployment testing and technical documentation on high-risk deployers. Thailand's proposed Draft Royal Decree on Business Operations Using Artificial Intelligence Systems and draft principles under the Draft Act on the Promotion and Support of Artificial Intelligence Innovation follow a comparable risk categorization structure.
• Electoral Integrity, Deepfakes, and Synthetic Content Transparency: Managing the risks of manipulated synthetic media and online deception during elections has driven immediate binding intervention. Singapore enacted the Elections (Integrity of Online Advertising) (Amendment) Act 2024 to prohibit undeclared deepfakes depicting candidates during election periods. In the Philippines, the Commission on Elections enforced COMELEC Resolution No. 11064 (Prohibition of AI-Generated Campaign Content) alongside pending legislative proposals like House Bill No. 10567 (Regulation of AI Use in 2025 Elections). Pakistan introduced criminal sanctions for deceptive online information under the Prevention of Electronic Crimes (Amendment) Act, 2025, while China enforces labeling rules via the Measures for the Identification of AI-Generated (Synthetic) Content and the Administrative Measures for the Labeling of AI-Generated Content.
• Financial Sector Risk Management and Operational Resilience: Financial regulators across Asia have moved ahead of horizontal lawmakers to establish binding AI risk controls within banking and capital markets. In Malaysia, Bank Negara Malaysia updated its Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated) in November 2025, complemented by the Securities Commission Malaysia's Securities Commission Malaysia — Guidelines on Technology Risk Management (GTRM) (revised). Indonesia's Financial Services Authority published the OJK Guidance on AI Governance for Indonesian Banking (effective April 29, 2025). In Singapore, the Monetary Authority of Singapore issued Artificial Intelligence Model Risk Management – Observations from a Thematic Review (effective December 2024), while India's central bank introduced the FREE‑AI Framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence.
• Data Protection Integration and Automated Decision Governance: National privacy commissions are actively enforcing data protection mandates across AI training and deployment lifecycles. South Korea updated its privacy framework via the Personal Information Protection Act (amendment including provisions on automated decision-making/AI) (effective March 2024), supported by the Notice on Personal Information Impact Assessment (effective September 5, 2025), the AI Privacy Risk Management Model, and the Guide on Processing Publicly Available Personal Data for AI Development and Services. In Singapore, the Personal Data Protection Commission issued the Advisory Guidelines on Use of Personal Data in Generative AI (2026) and the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (PDPC). Japan enforces the Amendment to the Act on the Protection of Personal Information, while the Philippines established lifecycle privacy duties under NPC Advisory No. 2024-04: Guidelines on the Application of the Data Privacy Act to AI Systems Processing Personal Data.
• Sandboxes, Testing Environments, and Frontier AI Governance: To balance compliance with innovation, jurisdictions are expanding controlled testing environments and guidelines for autonomous agentic systems. Singapore released the Updated Model AI Governance Framework for Agentic AI (2026) and established cross-sectoral testing sandboxes. Malaysia operates the AI Sandbox 2024, while Russia relies on statutory sandboxes under the Federal Law on Experimental Legal Regimes in the Sphere of Digital Innovations (Federal Law № 258-FZ) and the Federal Law No. 169-FZ of July 8, 2024 "On Amendments to the Federal Law "On Experimental Legal Regimes in the Sphere of Digital Innovations in the Russian Federation"", alongside regional regimes such as the Tatarstan Autonomous Vehicle Experimental Legal Regime (ELR) Program and Federal Law No. 123-FZ of April 24, 2020 "On carrying out experiment on establishment of special regulation...".

Regulatory Status

The regulatory status of AI across Asia in September 2026 reflects a tri-furcated continuum: economies with enacted statutory horizontal regimes, economies transitioning through draft legislation and targeted sector rules, and economies relying on soft-law guidelines and public sector frameworks.

1. Enacted Statutory Frameworks and Comprehensive Basic Laws:

Several major Asian jurisdictions have fully enacted primary statutory frameworks governing AI technologies:

• South Korea: Enacted the Framework Act on the Development of Artificial Intelligence and Establishment of Trust (effective January 22, 2026), supported by the Act on the Development and Supply (Distribution) of Intelligent Robots and the Republic of Korea AI Action Plan (AI Basic Plan (2026~2028)).
• Japan: Enacted the Act on Promotion of Research, Development and Utilization of Artificial Intelligence‑Related Technologies (AI Promotion Act) (effective September 1, 2025), anchored by the Cabinet-approved Artificial Intelligence Basic Plan.
• Taiwan: Enacted the Taiwan Artificial Intelligence Basic Act (in force 2026), supported by municipal initiatives including the Kaohsiung Smart Lighthouse AI Program and the Taipei Smart City AI Initiative.
• Vietnam: Enacted the Law on Digital Technology Industry (effective January 1, 2026) and the Law on Artificial Intelligence (effective March 1, 2026), supported by the Principles on Research and Development of Responsible AI Systems, the Decision No. 127/QĐ-TTg Approving the National Strategy on Research, Development and Application of Artificial Intelligence until 2030, and Resolution No. 57-NQ/TW on Breakthroughs in the Development of Science, Technology, Innovation and National Digital Transformation.
• Kazakhstan: Enacted the Draft Law 'On Artificial Intelligence' (2025) and adopted the Digital Code of the Republic of Kazakhstan (2026), supported by the Law of the Republic of Kazakhstan on Amendments and Additions to the Code of Administrative Offences (effective November 17, 2025), the Concept for the Development of Artificial Intelligence for 2024–2029, and the National Ethical Code in the Field of Artificial Intelligence.
• Pakistan: Enacted the Digital Nation Pakistan Act, 2025 (effective January 29, 2025) and the Prevention of Electronic Crimes (Amendment) Act, 2025 (effective January 29, 2025), alongside the executive adoption of the National Artificial Intelligence Policy (National AI Policy) 2025.

2. Transitioning Regimes with Draft Legislation and Binding Sectoral Rules:

A second group of states combines active sectoral regulations with pending primary bills under parliamentary review:

• Indonesia: Governed horizontally by the Law of the Republic of Indonesia Number 1 of 2024 on the Second Amendment to Law Number 11 of 2008 on Electronic Information and Transactions and Government Regulation No.71/2019 on Electronic Systems and Transactions, while currently drafting the Draft Bill on Artificial Intelligence and the Draft Presidential Regulation on Artificial Intelligence.
• Thailand: Formulating horizontal legislation via the Draft Act on the Promotion and Support of Artificial Intelligence Innovation and the Draft Royal Decree on Business Operations Using Artificial Intelligence Systems, supported by technical rules like the Draft ETDA Notification regarding AI Risk Assessment and the Draft ETDA Notification regarding Artificial Intelligence Sandbox (AI Innovation Testing Center).
• Uzbekistan: Operating under the Law of the Republic of Uzbekistan "On Cybersecurity" and the Strategy for the Development of Artificial Intelligence Technologies until 2030, while progressing the Draft Law on Artificial Intelligence through parliament.
• Philippines: Enforcing binding domain rules via COMELEC Resolution No. 11064 (Prohibition of AI-Generated Campaign Content) and NPC Advisory No. 2024-04: Guidelines on the Application of the Data Privacy Act to AI Systems Processing Personal Data, while considering legislative proposals including House Bill No. 7396 (Artificial Intelligence Development and Regulation Act), House Bill No. 9448 (Protection of Labor Against Artificial Intelligence Automation Act), and House Bill No. 7983 (National Center for AI Research Establishment Act).
• India: Enforcing digital governance through The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the national policy guidance India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (effective November 5, 2025), while considering the proposed Artificial Intelligence (Ethics & Accountability) Bill, 2025 alongside state-level policies such as the Tamil Nadu Safe and Ethical AI Policy, the Maharashtra MahaAgri-AI Policy 2025-29, and the Karnataka IT Policy 2025-2030 AI Mission.

3. Pragmatic, Soft-Law, and Public Sector Assurance Regimes:

A third cluster prioritizes agile frameworks, sector guidelines, and public administration standards over omnibus statutory bans:

• Singapore: Combines targeted statutory enforcement—such as the Elections (Integrity of Online Advertising) (Amendment) Act 2024, the adopted Workplace Fairness Bill, the procedural Guide on the Use of Generative Artificial Intelligence Tools by Court Users, and the pending Online Safety (Relief and Accountability) Bill (OSRA Bill)—with soft-law toolkits like the Updated Model AI Governance Framework for Agentic AI.
• Malaysia: Operates an ecosystem model anchored by the Pelan Tindakan AI Kebangsaan 2026-2030, the National Guidelines on AI Governance & Ethics (AIGE), the Pejabat Kecerdasan Buatan Kebangsaan (NAIO), the AI Talent Roadmap for Malaysia 2024–2030, the Selangor AI White Paper, and public outreach via AI for the People, backed by statutory cyber rules under the Cyber Security Act 2024.
• Australia & New Zealand: Rely on technology-neutral statutes and detailed government administration frameworks. Australia enforces the Australia National AI Plan 2025 (effective December 2025), the Policy for the responsible use of AI in government, the Standard for AI transparency statements, the Standard for accountable officials (Policy for responsible use of AI in government), the National Framework for the Assurance of Artificial Intelligence in Government, the DTA AI Policy Update - Impact Assessment Tool and Procurement Guidance, and state standards like the NSW Artificial Intelligence Assessment Framework (AIAF). New Zealand governs via New Zealand’s Strategy for Artificial Intelligence: Investing with Confidence (effective July 2025), the Public Service AI Framework, the Responsible AI Guidance for the Public Service: GenAI, the Responsible Artificial Intelligence guidance for businesses, the Responsible AI in action: Guidance for Regulators (effective May 2026), and targeted statutes including the Digital Identity Services Trust Framework Act 2023 (and Digital Identity Services Trust Framework Rules 2024) and the Social Security (Modernisation) Amendment Bill (2026).
• Other Regional Actors: Hong Kong guides deployment through the Hong Kong Generative Artificial Intelligence Technical and Application Guideline (effective April 15, 2025). Bangladesh utilizes the statutory Agency to Innovate Act 2023 alongside the draft Bangladesh Telecommunication Regulatory Commission Regulation for Digital, Social Media and OTT Platforms (draft). The Maldives relies on the UNESCO AI Readiness Assessment Report (effective July 31, 2025), supported by the Cyber Security Act, the Electronic Transactions Act (Law No. 2/2022), and the Communications Authority of Maldives Act (Law No. 42/2015).

Notable Differences

The Asian AI regulatory landscape displays pronounced divergence in philosophy, institutional architecture, enforcement mechanisms, and regulatory scope across jurisdictions:

Promotional Soft Law vs. Prescriptive Hard Law: A key contrast exists between promotional, soft-law-oriented regimes and highly prescriptive statutory models. Japan's Act on Promotion of Research, Development and Utilization of Artificial Intelligence‑Related Technologies (AI Promotion Act) explicitly rejects centralized licensing or broad criminal prohibitions, favoring soft-law guidelines, cross-ministerial alignment, and voluntary business compliance. In contrast, South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust and Kazakhstan's Draft Law 'On Artificial Intelligence' impose mandatory statutory obligations, lifecycle documentation duties, and administrative fines for high-impact or non-compliant systems.

Centralized Presidential Control Towers vs. Decentralized Sectoral Oversight: Jurisdictions vary significantly in their institutional design. South Korea, Pakistan, and Malaysia have established centralized apex control towers—such as South Korea's presidential-level National AI Strategy Committee under the Framework Act on the Development of Artificial Intelligence and Establishment of Trust, Pakistan's National Digital Commission under the Digital Nation Pakistan Act, 2025, and Malaysia's Pejabat Kecerdasan Buatan Kebangsaan (NAIO). Conversely, Singapore, Australia, and New Zealand maintain decentralized governance models that distribute supervisory authority across domain-specific regulators (e.g., privacy commissioners, financial authorities, and market regulators) operating under existing, technology-neutral legal mandates.

Targeted Deepfake Restrictions vs. Systemic Algorithmic Governance: Legislative priorities differ based on specific societal risk perceptions. Jurisdictions like the Philippines and Singapore have introduced highly specific, fast-acting legal interventions targeting deepfakes and political manipulation—exemplified by COMELEC Resolution No. 11064 (Prohibition of AI-Generated Campaign Content) and the Elections (Integrity of Online Advertising) (Amendment) Act 2024. On the other hand, jurisdictions like Kazakhstan, Vietnam, and South Korea focus heavily on systemic software lifecycle governance, requiring pre-deployment safety evaluations, technical source-code audits, and automated decision-making impact reviews.

Data Sovereignty and Localization vs. Global Interoperability: Central Asian regimes, including Kazakhstan under the Law of the Republic of Kazakhstan dated November 24, 2015, No. 418-V 'On Informatization' and the Digital Code of the Republic of Kazakhstan, mandate strict physical data localization within state borders for systems processing personal data. In contrast, trading hubs like Singapore, Japan, and New Zealand prioritize international data interoperability, cross-border testing frameworks, and alignment with OECD principles to facilitate global commercial integration.

Regional Outlook

Looking ahead past late 2026, Asia's AI governance environment is set to enter a key phase of statutory enforcement, technical standard-setting, and operational maturity. Key statutory implementation dates will reshape compliance requirements across the region:

• In South Korea, the grace period following the January 22, 2026 effective date of the Framework Act on the Development of Artificial Intelligence and Establishment of Trust will transition toward full administrative fine enforcement by early 2027, compelling operators of High-Impact AI to complete formal risk management protocols.
• In Vietnam, deployers and developers face mandatory compliance deadlines as the Law on Digital Technology Industry takes effect on January 1, 2026, followed closely by the full enforcement of the landmark Law on Artificial Intelligence on March 1, 2026.
• In Kazakhstan, the comprehensive Digital Code of the Republic of Kazakhstan will enter into full force on July 1, 2026, establishing legal rules for the National AI Platform and digital sovereignty requirements.
• In Malaysia, federal agencies and industry partners will execute the initial phases of the 14 sectoral impact engines outlined in the Pelan Tindakan AI Kebangsaan 2026-2030 (launched July 28, 2026) under the oversight of the Pejabat Kecerdasan Buatan Kebangsaan (NAIO).

Concurrently, institutional capacity for AI safety evaluation is expanding across Asia. Dedicated national testing bodies—such as Japan's AI Safety Institute established under the Cabinet framework, Malaysia's Malaysia AI Safety Institute housed within Pejabat Kecerdasan Buatan Kebangsaan (NAIO), South Korea's AI Safety Research Institute, and Singapore's expanded cross-sectoral testing sandboxes—are becoming the primary hubs for developing technical evaluation standards, red-teaming methodologies, and model traceability metrics. However, significant fragmentation remains a major structural challenge. The divergence between hard-law statutory regimes (South Korea, Vietnam, Kazakhstan) and soft-law pragmatic regimes (Singapore, Japan, Australia, New Zealand) means that multinational entities operating across Asia must navigate a complex mosaic of distinct compliance mandates, local data storage rules, and synthetic content disclosure duties through 2026 and beyond.