Thailand - AI Law Principles (2025)

Overview

The Electronic Transactions Development Agency (ETDA), working with the Ministry of Digital Economy and Society (MDES), circulated a consolidated set of 'Draft Principles of the AI Law' in May 2025 and held an explanatory session on 2 May 2025. The Draft Principles set out a risk‑based regulatory architecture—distinguishing prohibited‑risk and high‑risk AI—while retaining measures to promote innovation such as regulatory sandboxes and safe‑harbour protections. ETDA opened a public consultation that closed on 9 June 2025 via the national legal comment system (central submission link published during the hearing). The instrument is positioned as a principles level foundation for a subsequent Bill and subordinate rules that will be coordinated with sectoral regulators (for example, the Bank of Thailand and the Securities and Exchange Commission) and international standards. The English commentary and multiple legal firm briefings (e.g., Tilleke & Gibbins, Norton Rose Fulbright) summarise the Draft Principles' main thrust and timeline.

Definitions

The Draft Principles define key concepts to anchor duties and enforcement. Typical definitions include: 'AI system' (broad functional definition covering machine learning and other automated decision systems), 'AI provider' (entity that develops or supplies an AI system), 'AI deployer' (entity that integrates or uses an AI system in a service or product), 'high‑risk AI' (systems that may impact fundamental rights, safety or health), and 'prohibited‑risk AI' (uses with unacceptable risk). Other terms cover 'human oversight', 'technical documentation', 'serious incident', 'training data', and 'model card'. These definitions are drafted to enable delegation: the primary text sets the conceptual buckets and authorises sectoral regulators to give detailed, contextual definitions in subordinate instruments.

Governance and Institutional Framework

The Draft Principles create a two‑tier governance model. At the centre is a designated enforcement authority (ETDA is described as the coordinating regulator for digital services) with powers to oversee AI law implementation across sectors. Sectoral regulators (e.g., the Bank of Thailand, the Securities and Exchange Commission, health regulators) retain authority to issue sector‑specific lists, codes of practice and technical standards for high‑risk AI in their domains. The principles also propose creating supporting bodies (an AI Governance Center / Centers of Excellence) to provide technical guidance, testing facilities and capacity building. Coordination mechanisms—inter‑agency committees, a central registry or notification portal, and formal consultation loops—are included so decisions on classification, enforcement, and standard setting are harmonised. The governance design emphasises flexibility so that subordinate regulations and codes can evolve rapidly without requiring primary law amendments.

Key Focus Areas

The Draft Principles emphasise five core focus areas: (1) risk management (obligations to implement risk frameworks and documentation for high‑risk systems, referencing ISO/IEC 42001 and NIST approaches in explanatory notes); (2) transparency and user information (requirements for clear, accessible notices and the right to explanation/appeal for AI‑driven administrative or critical decisions); (3) human oversight and governance (obligations to retain human accountability and safeguards against undue automation); (4) data governance and privacy (data minimisation, lawful bases for training data, permitted Text & Data Mining and protections for personal data consistent with Thailand's PDPA); and (5) safety, testing and post‑market monitoring (pre‑deployment testing, conformity assessment for certain categories, incident reporting and continuous evaluation). The Draft Principles also address innovation policy—permitting regulatory sandboxes with a safe‑harbour for participants acting in good faith, while reserving civil liability for harms to third parties. The instrument contemplates administrative tools: registration/notification of certain AI systems, mandatory model documentation (model cards, risk assessments), and obligations to appoint a local representative where the provider is outside Thailand.

Implementation Framework

Implementation is staged: the Draft Principles provide the architecture and empower ETDA and sectoral regulators to issue detailed subordinate rules, lists of prohibited/high‑risk systems, technical standards, and conformity assessment procedures. The Draft Principles expect: (a) guidance and codes of practice from sectoral regulators tailored to domain risk profiles; (b) mandatory registration/notification for identified high‑risk systems; (c) conformity assessment and certification for some categories (self‑assessment for lower tiers; third‑party assessment for higher tiers); and (d) operational requirements for incident reporting, audits, data retention and transparency. To reduce compliance costs and support SMEs and startups, the Draft Principles formalise sandboxes, provide time‑limited tolerances for experimental testing, and indicate a staged enforcement approach that prioritises corrective measures before sanctions for first‑time or minor breaches.

Monitoring and Evaluation

Monitoring combines proactive and reactive elements: centralized logs/registries for notified systems, mandatory reporting of serious incidents to the enforcement authority, post‑market surveillance obligations for providers and deployers, and periodic audits. ETDA envisages using compliance metrics, sectoral surveillance, and co‑regulation arrangements to evaluate impact. The Draft Principles require providers to maintain technical documentation to support audits (data provenance, training sets, model versions, evaluation metrics, mitigation measures) and to cooperate with enforcement investigations. Annual reporting and review cycles are anticipated to identify gaps and trigger updates to the prohibited/high‑risk lists and subordinate rules.

Penalties, Liability, and Appeals

The Draft Principles create an administrative enforcement toolbox: orders to suspend or cease provisioning of AI services, platform takedown and blocking where non‑compliance persists, seizure of physical goods embedding prohibited systems, administrative fines (quantums and calculation bases left to subordinate rules), and coordination with criminal law where conduct violates other statutes. Civil liability for damages remains available to harmed parties; the Draft Principles clarify that safe‑harbour protections for sandbox participants do not eliminate civil liability to third parties. A formal appeals process against administrative measures is provided (internal review and judicial challenge), and sectoral regulators may retain parallel sanctioning powers for regulated entities.

Relationship to Other Instruments

The Draft Principles are designed to sit alongside Thailand's Personal Data Protection Act (PDPA), existing telecommunications and cybersecurity laws, consumer protection statutes, and sectoral regulatory frameworks (finance, securities, healthcare, insurance). It explicitly authorises subordinate regulations to coordinate with the PDPA and with sectoral regulators' supervisory frameworks. The instrument also supports alignment and mutual recognition with international conformity assessment where appropriate—enabling Thai certification to lean on recognised international test standards.

International Alignment

The Draft Principles explicitly reference international models (notably the EU AI Act architecture) and technical standards such as ISO/IEC 42001, and invites cross‑border cooperation. The approach seeks alignment where helpful (risk categories, terminology, standards) while reserving policy space for Thailand‑specific instruments (e.g., data‑sharing with public sector partners, local representative requirements). ETDA's explanatory materials and public consultations referenced comparative studies and legal firm analyses, acknowledging the value of harmonisation for trade, interoperability and investor certainty. Thailand also signals intent to participate in multilateral dialogues (APEC, UNESCO forum) on AI governance.

Implementation Timeline

Sources and References