Thailand - AI Risk Assessment Guidelines

Overview

The Draft Notification published by the Electronic Transactions Development Agency (ETDA) on 17 July 2023 sets out a harmonized methodology for AI risk assessment to be applied by organizations that develop, import, operate, or provide access to AI systems to users in Thailand. The document proposes a four‑pillar approach—governance, risk mapping, risk measurement, and risk management—intended to be proportionate to the potential impact of the AI system. The draft was opened for public consultation (closed 19 August 2023) and is intended to work together with other national AI initiatives, including the AI sandbox and proposed promotional legislation. For background and complementary materials, see ETDA’s AI governance resources such as the AI Governance Center and Readiness tools on the ETDA website (for example, ETDA AI Readiness Assessment).

Definitions

The draft includes working definitions to support consistent application across sectors. Key defined terms commonly used in the draft are: "AI system" (software or automated decision support that performs tasks that would otherwise require human intelligence); "AI provider" (entity that develops or supplies an AI system); "AI deployer" (entity that integrates or places the AI system into operation); "use‑case" (specific context of an AI system’s operation); "risk mapping" (systematic identification of scenarios and affected stakeholders); and "high‑risk AI" (systems whose malfunction or biased operation could cause significant physical, psychological, economic or societal harm). These definitions are aligned with the draft law and international practice but may be adapted as the regulatory process advances.

Governance and Institutional Framework

The draft places primary responsibility on AI providers and deployers to implement governance arrangements that support risk‑based oversight. This includes senior management accountability, designated roles (e.g., AI risk manager or coordinator), risk committees, and documented internal policies and processes. The ETDA is identified as the lead coordinating agency for technical guidance and review; ETDA’s AI Governance Center (AIGC) and other designated units are expected to publish checklists, templates and advisory materials. The institutional arrangements also contemplate coordination with sectoral supervisors (for example, banking, health, telecommunications) and other regulators for cross‑referrals. The draft contemplates that ETDA will maintain an updated set of guidance documents and may publish lists of AI systems subject to enhanced monitoring. For institutional resources and ETDA’s broader AI governance work see ETDA publications and AIGC resources.

Key Focus Areas

The draft centers on a set of operational requirements that map to identifiable harms. First, governance: organizations must document roles, escalation paths, and training for personnel involved in AI lifecycle activities. Second, risk mapping: organizations must identify scenarios where the AI system acts on or influences individuals, the types of input and training data, the data provenance, third‑party dependencies (e.g., pre‑trained models, APIs), and potential failure modes. Third, risk measurement: the draft asks for explicit measures and indicators—both qualitative (scenario narratives and likelihood/impact scoring) and quantitative (accuracy metrics, bias/fairness measurements, robustness tests, availability metrics, false positive/negative rates). Fourth, risk management: organizations must produce prioritized mitigation plans, detect/monitor residual risk, implement human oversight where necessary, and define incident reporting and remediation procedures. The draft also addresses data quality controls, provenance and access control measures, maintenance of model cards and documentation, and lifecycle update governance (including retraining and monitoring after deployment).

Implementation Framework

The draft expresses flexibility in methodology but establishes minimum content for risk assessment deliverables. Providers may adopt a use‑case approach (detailed assessment per distinct application) or a cross‑sectoral profiling approach (where many similar use cases share a common profile). Required deliverables include: (a) a risk assessment report describing scenarios, affected stakeholders, harm types, likelihood/impact scoring and residual risk; (b) a mitigation and monitoring plan specifying technical and organizational measures; (c) evidence of validation, testing and safety evaluation (e.g., test results, test sets); and (d) a documentation package including model description, data lineage, performance metrics and a human oversight plan. The draft signals ETDA will publish checklists and templates to promote consistent submissions and to reduce compliance costs for smaller providers. Organizations are expected to incorporate continuous monitoring and to update assessments when material changes occur.

Monitoring and Evaluation

Monitoring requirements described by the draft emphasize continuous and post‑deployment surveillance. Organizations must implement monitoring systems that capture model drift, performance degradation, bias emergence and evidence of real‑world harms. The draft recommends logging and traceability mechanisms—operational logs, decision records and data versioning—to facilitate audits and incident investigations. ETDA envisages periodic reporting and may conduct targeted audits or request documentation during supervisory reviews. The draft encourages use of metrics and KPIs to evaluate mitigation effectiveness and to inform revision cycles. ETDA also proposes to collect aggregate readiness data to refine sectoral guidance.

Penalties, Liability, and Appeals

While the draft focuses primarily on assessment and management obligations, it contemplates enforcement mechanisms administered by ETDA and coordination with other authorities. Proposed administrative measures can include corrective directions, requirements to suspend or limit deployment, registration or reporting requirements, and referrals to sectoral agencies for statutory sanctions. The draft anticipates liability may be pursued under existing legal regimes (consumer protection, data protection, civil liability) where harm occurs, and that failure to perform required risk assessments could be an evidentiary factor in civil or administrative proceedings. The draft also includes procedural elements for appeals or responses to ETDA findings to ensure due process for affected organizations.

Relationship to Other Instruments

The draft is intended to operate alongside a suite of complementary instruments: the Draft Artificial Intelligence Innovation Promotion Act (policy and promotional measures), the Draft ETDA Notification on AI Sandbox (testing and experimentation exemptions), Thailand’s Personal Data Protection Act (PDPA), sector‑specific rules (e.g., Bank of Thailand and Ministry of Public Health guidance), and the Royal Decree on Digital Platform Services. The draft explicitly cross‑references responsibilities under data protection and cybersecurity laws and envisages cooperation mechanisms for enforcement and technical assistance. It also seeks to avoid duplication by allowing documentation used for other sectoral compliance programs to satisfy ETDA requirements where appropriate.

International Alignment

The draft draws on international best practice and references standards and frameworks such as the EU AI Act principles, ISO/IEC guidance on AI risk management (including ISO/IEC 42001 family), and NIST risk management recommendations as non‑binding exemplars. ETDA signals an intent to maintain interoperability with global approaches to avoid fragmentation while tailoring requirements to Thailand’s legal and institutional context. The draft also anticipates special treatment for cross‑border provision of AI services, requiring local representation and notification for some offshore providers to ensure accountability for users in Thailand.

Implementation Timeline

Sources and References