Thailand - AI Business Operations (2022)

Overview

The Draft Royal Decree on Business Operations Using Artificial Intelligence Systems is a cross-sectoral regulatory proposal published as a draft in October 2022 by Thailand's national digital policy authority (Office of the National Digital Economy and Society Commission / related national digital policy bodies). The instrument seeks to establish a national, risk-based regulatory baseline for commercial uses of artificial intelligence (AI) in Thailand. It is presented as a draft (status: Draft) for the Kingdom of Thailand (year: 2022) and aims to balance innovation and public protection by setting minimum obligations for AI activities that affect public safety, fundamental rights, or access to essential services. The draft follows international trends in risk-based regulation (notably alignment with approaches such as the EU AI Act model) and proposes categorising AI uses into prohibited/unacceptable, high-risk, and limited-risk classes with corresponding duties.

The draft was circulated for consultation in October 2022 and related material and announcements were made publicly (announcement/draft hosted on a third-party site): Draft Royal Decree on Business Operations that Use Artificial Intelligence Systems — announcement / draft (Digital Policy Alert).

Definitions

The draft sets out operational definitions intended to capture the scope of regulated activity. Key defined concepts include:

- "AI system" and "AI service": systems that produce automated outputs (predictions, recommendations, decisions, or other content) through algorithmic processing, including machine learning, statistical methods and other automated decision-making techniques.

- "Provider": entities that develop, supply, place on the market, or make available an AI system or AI service within Thailand or to persons in Thailand.

- "User": entities or persons who deploy or operate an AI system in the course of business operations or who rely upon the system's outputs for decision-making or service delivery.

- "Importer" and "Distributor": commercial actors that import AI systems into Thailand or distribute systems within Thailand, who carry responsibilities to ensure conformity with the decree's requirements.

- "High-risk AI": classes of AI systems identified by the draft as posing significant risks to safety, fundamental rights, access to essential services or other critical public interests; these systems are subject to mandatory registration and enhanced controls.

- "Unacceptable (prohibited) risk AI": categories of AI uses that are forbidden except under strictly limited exceptions (for example where harms cannot be sufficiently mitigated or where core rights or safety are undermined).

Definitions are structured to capture systems used in decision-making, profiling, biometric identification, critical infrastructure management, health, finance, employment, education, public safety and other domains likely to materially affect individuals or the public interest.

Governance and Institutional Framework

The draft envisages a central supervisory role for the national digital economy/society authority (the national digital policy authority that prepared the draft) as the primary coordinator for cross-sectoral AI regulation. It anticipates coordination and cooperation with sectoral regulators that have statutory competence over specific domains such as finance, healthcare, transport and telecommunications. The draft provides for the designation of competent authorities with responsibilities for registration, conformity assessment, supervision and enforcement within their respective domains.

The governance structure in the draft contemplates the national authority establishing rules and implementing instruments (guidelines, technical standards and subordinate rules) to operationalise the decree, with sectoral regulators permitted to issue additional sector-specific rules provided they meet or exceed the decree's baseline protections. The draft also anticipates mechanisms for interagency coordination, stakeholder consultation and the potential use of regulatory sandboxes and staged implementation where appropriate.

Key Focus Areas

• Risk categorisation: Establishes three primary risk classes—prohibited/unacceptable-risk systems, high-risk systems, and limited-/low-risk systems—each subject to different regulatory duties.
• Registration and prior authorisation: Requires prior registration of high-risk AI systems with the competent authority before market placement or deployment in Thailand.
• Risk management frameworks: Imposes mandatory risk-management processes for high-risk systems, including identification, assessment, mitigation and documentation of risks throughout a system’s lifecycle.
• Data governance and PDPA alignment: Requires data-governance measures, including safeguards for personal data and alignment with Thailand’s Personal Data Protection Act (PDPA) where applicable.
• Transparency and user information obligations: Mandates disclosures to end-users and impacted persons (for example where synthetic content is used or automated decisions are made) and measures to ensure explainability and human-understandable information on system operation.
• Human oversight and explainability: Requires implementation of human oversight measures and explainability safeguards where necessary to mitigate risks to rights and safety.
• Incident notification and reporting: Establishes duties to report incidents, malfunctions or breaches affecting safety, rights or operation to competent authorities and to cooperate in remedial actions.
• Obligations for importers and distributors: Extends compliance duties to importers and distributors to ensure that systems placed on the Thai market conform with the decree.
• Conformity assessment and certification: Contemplates mechanisms for conformity assessment, testing, possible certification and technical assurance measures for high-risk systems.
• Enforcement measures: Provides for administrative enforcement powers including corrective orders, suspensions, fines and revocation of registrations for non-compliance.

Implementation Framework

Scope and applicability: The draft is intended to apply to business operations that deploy, offer, sell or otherwise provide AI systems within Thailand or to services and offerings that target persons in Thailand. The target audience includes providers, users, importers and distributors of AI systems and services. The decree is drafted to act as a national, cross-sectoral baseline; sectoral regulators can issue additional implementing rules that supplement or specify obligations in sectoral contexts (finance, health, transport, telecommunications, etc.).

Phased implementation: The draft contemplates phased duties based on system categorisation. Registration and full compliance obligations for high-risk systems are expected to follow finalisation of implementing rules and designation of competent authorities; transitional arrangements or staging (including sandboxes or temporary derogations) may be provided to allow businesses time to meet requirements after final adoption.

Operational obligations: Providers of high-risk AI would be required to register systems, maintain documented risk-management and mitigation processes, conduct data-governance checks (including personal-data protections where applicable), ensure transparency and explainability measures, implement human oversight where necessary, and sustain technical and organisational measures to ensure robustness and cybersecurity. Users, importers and distributors have complementary duties to follow usage instructions, report incidents, cooperate with regulators and ensure conformity in their commercial chains.

Monitoring and Evaluation

The draft outlines monitoring mechanisms oriented around documented compliance, internal audit and reporting. High-risk systems would be subject to ongoing compliance obligations including documentation, internal audit and periodic reassessment. Competent authorities would be empowered to supervise compliance through audits, requests for information, conformity assessments and technical inspections. The draft anticipates cooperation between the central supervisory authority and sectoral regulators for monitoring sector-specific risks and for coordinating enforcement actions.

Evaluation is expected to be iterative and tied to the designation of competent authorities and the development of implementing rules. The draft foresees that regulators will periodically reassess risk categorizations, technical standards and guidance, and that businesses may be required to update risk-management documentation and reassess system categorisation as technologies evolve or new harms are identified.

Penalties, Liability, and Appeals

Enforcement and penalties: The draft establishes administrative enforcement powers for competent authorities, including the authority to issue orders to suspend services, require corrective measures, impose fines, revoke registrations and take other administrative actions to address non-compliance. The draft contemplates the possibility of civil or criminal enforcement through coordination with existing legal frameworks where appropriate.

Liability: The draft contemplates potential liability measures for non-compliance, and indicates interaction with Thailand's existing legal remedies and statutory liability regimes. It anticipates that existing sectoral statutes, consumer-protection law and the Electronic Transactions Act may be used to support enforcement in relevant cases.

Appeals and review: The draft does not specify a comprehensive appeals framework within the text published for consultation; judicial or administrative review processes would likely be governed by existing administrative procedure and judicial review mechanisms in Thailand, and by any appeal procedures established by competent authorities in implementing rules.

Relationship to Other Instruments

The draft is designed to operate alongside Thailand's existing legal framework. It explicitly references interaction with the Personal Data Protection Act (PDPA) for personal-data matters, sectoral safety and product regulations, consumer-protection law, and cybersecurity measures. The decree is intended as a cross-cutting baseline that sectoral authorities can supplement with sector-specific technical or safety rules. The draft also signals coordination with other domestic AI governance workstreams and draft instruments prepared by bodies such as the Electronic Transactions Development Agency (ETDA) and related agencies.

International Alignment

The draft follows international trends toward risk-based AI governance and notes alignment with approaches such as the EU AI Act model. It seeks to adopt internationally informed principles for categorising risk and calibrating obligations across prohibited, high-risk and limited-risk uses. Subsequent workstreams and consultations (noted below for 2024–2025) aimed to align multiple draft texts and consolidate Thailand's AI regulatory approach in ways that draw on international best practice and interoperability with other jurisdictions' frameworks.

Implementation Timeline

Sources and References