Thailand AI Regulation Overview

Overview

Thailand's governance approach to artificial intelligence relies on a foundation of national policy planning, institutional guidance, and risk-based regulatory development. The country formally launched its strategy through the Thailand National AI Strategy and Action Plan (2022–2027), approved by Cabinet in July 2022. Strategic leadership is provided by a Prime Minister-chaired National AI Committee, supported by technical secretariats at the National Science and Technology Development Agency (NSTDA) and the National Electronics and Computer Technology Center (NECTEC). Alongside strategic policies, non-binding soft-law instruments—such as the Digital Thailand AI Ethics Guideline and the NSTDA AI Ethics Guideline—were introduced in 2022 to guide public and private sector actors on legal, social, and ethical principles.

In parallel with soft-law frameworks, Thailand's policy landscape has increasingly progressed toward a structured regulatory architecture led by the Electronic Transactions Development Agency (ETDA) and the Ministry of Digital Economy and Society (MDES). Through major regulatory initiatives including the Draft Principles of the AI Law (2025), the Draft Royal Decree on Business Operations Using Artificial Intelligence Systems (2022), and ETDA draft notifications on risk assessment and sandboxes, Thailand is establishing explicit risk categories—prohibited-risk, high-risk, and lower-risk—to balance market innovation with fundamental rights, public safety, and economic stability.

Regulatory Approach

Thailand operates a hybrid regulatory model transitioning from soft-law principles toward binding horizontal legal frameworks. Initial national efforts focused on ethical principles set out in the Digital Thailand AI Ethics Guideline (2022) and NSTDA AI Ethics Guideline (2022). These documents establish six core ethical tenets: competitiveness and sustainability, legal and ethical compliance, transparency and accountability, security and privacy, equality and fairness, and reliability. They encourage voluntary institutional arrangements, internal ethics oversight boards, and impact assessments without establishing statutory penalties.

To formalize governance, recent initiatives have introduced a horizontal, risk-based architecture influenced by international models. The Draft Principles of the AI Law (2025) and Draft Royal Decree on Business Operations Using AI Systems (2022) propose categorizing AI into prohibited, high-risk, and limited-risk applications. Providers and deployers of high-risk systems face mandatory risk management, human oversight, pre-deployment testing, and registration duties. Concurrently, sectoral regulators such as the Bank of Thailand (BOT) develop domain-specific rules aligned with institutional risk profiles.

Key AI Legislation

• Thailand National AI Strategy and Action Plan (2022–2027): Adopted in July 2022, this central policy framework establishes five strategic pillars covering ELSI readiness, infrastructure, human capability, R&D innovation, and sectoral adoption.
• Digital Thailand – AI Ethics Guideline (2022): Non-binding national guidelines establishing six foundational ethical principles and recommendations for regulators, developers, providers, and users.
• NSTDA AI Ethics Guideline (2022): Practical ethics guidance for public research, developers, and institutions, detailing lifecycle risk screening, validation, data governance, and transparency practices.
• Draft Act on the Promotion and Support of Artificial Intelligence Innovation (2023): Proposed legislation establishing risk classification, promotional incentives, regulatory sandboxes, and administrative governance.
• Draft Royal Decree on Business Operations Using Artificial Intelligence Systems (2022): Proposed regulatory baseline establishing prohibited, high-risk, and limited-risk classes alongside registration and risk-management duties for commercial actors.
• Draft Principles for AI Legislation (2025): Consolidated principles framework published by ETDA and MDES proposing prohibited-risk bans, high-risk governance duties, sandbox safe harbours, and administrative enforcement.
• Bank of Thailand Draft Policy on AI Risk Management (2025): Sectoral draft policy establishing expectations for financial service providers regarding board oversight, FEAT principles, model validation, prompt injection defenses, and consumer protections.
• Draft ETDA Notifications on AI Risk Assessment & AI Sandbox (2023): Procedural draft notifications defining a four-pillar risk assessment methodology and operational rules for an AI Innovation Testing Center.

Governance & Enforcement Bodies

Top-level political oversight of Thailand's AI landscape is held by the National AI Committee, chaired by the Prime Minister. Technical and operational secretariat functions are executed by NECTEC and NSTDA. These secretariats coordinate inter-ministerial implementation, track strategic goals, and maintain foundational R&D infrastructure, including the National AI Service Platform and high-performance computing platforms.

The Electronic Transactions Development Agency (ETDA), under MDES, functions as the central coordinating authority for digital economy regulation and AI legal frameworks. ETDA houses the AI Governance Center (AIGC), administers regulatory sandbox programs, and drafts standardized risk assessment guidelines. Sectoral authorities, including the Bank of Thailand for financial institutions and payment providers, maintain supervisory jurisdiction to issue domain-specific requirements and enforce compliance within their regulated sectors.

Penalties & Enforcement

Under current adopted policy frameworks and soft-law guidelines—including the Thailand National AI Strategy 2022-2027 and national AI ethics guidelines—there are no statutory legal fines or criminal penalties directly attached. Compliance with soft-law instruments is primarily encouraged through public procurement standards, research grant conditions, and internal institutional governance policies.

In contrast, proposed regulatory frameworks set out formal administrative enforcement mechanisms. The Draft Principles of the AI Law and Draft Royal Decree empower competent authorities to issue administrative orders (including cease-and-desist mandates), instruct platforms to block noncompliant software, order the physical seizure of prohibited AI hardware, revoke system registrations, and impose administrative fines defined under subordinate rules. Sectoral regulators like the Bank of Thailand exercise existing supervisory and administrative powers under the Financial Institutions Business Act and Payment Systems Act.

Data Protection Framework

AI deployment and governance in Thailand explicitly align with the Personal Data Protection Act (PDPA), which was promulgated in May 2019. National ethics guidelines, ETDA notifications, and draft legislation require AI lifecycle activities—including dataset collection, algorithmic training, model profiling, and automated decision-making—to conform with PDPA mandates governing lawful processing bases, purpose limitation, and data subject rights.

Draft regulatory frameworks and risk assessment standards incorporate explicit data governance requirements for high-risk systems. Organizations must establish data provenance, implement privacy-preserving techniques (such as anonymization and pseudonymization), enforce cross-border data transfer safeguards, and respect statutory exemptions, such as proposed text and data mining provisions intended to facilitate R&D.

Sector-Specific Rules

In the financial domain, the Bank of Thailand published draft guiding principles on AI risk management in June 2025, applying to financial institutions and payment service providers under the Financial Institutions Business Act and Payment Systems Act. The guidance requires board acceptance of AI risk appetite, alignment with FEAT principles (fairness, ethics, accountability, transparency), maintenance of model registries, mitigations against generative AI hallucinations (e.g., RAG and output checks), prompt injection cybersecurity defenses, disclosure of AI usage, and mandatory human review options for material decisions.

Additional high-impact sectors highlighted across national guidelines and draft regulatory notifications include healthcare diagnostics, public administration, law enforcement, critical infrastructure, and digital commerce. Applications in these sensitive domains are subject to heightened risk screening, mandatory pre-deployment testing, enhanced logging, and potential sector-specific subordinate regulations developed jointly by line regulators and ETDA.

International Alignment

Thailand's policy and legislative proposals demonstrate strong alignment with international AI governance benchmarks. The Draft Principles of the AI Law and Draft Royal Decree draw heavily on the architecture of the European Union AI Act, utilizing risk-based tiers (prohibited and high-risk) and formal pre-market conformity principles.

Furthermore, ethics guidelines issued by ETDA and NSTDA incorporate recommendations from the OECD AI Principles and the UNESCO Recommendation on the Ethics of Artificial Intelligence. Technical standards referenced in draft notifications—such as ISO/IEC 42001 and the NIST Risk Management Framework—underscore Thailand's commitment to international interoperability, safe-harbour mechanisms, and global technical compliance.

Future Developments

Thailand is advancing toward the formalization of its primary AI legislation. Following public consultations on the Draft Principles of the AI Law in mid-2025, ETDA targeted submitting a consolidated legislative draft to Cabinet. Enactment of primary legislation will trigger the issuance of subordinate regulations, designated lists of high-risk AI applications, and requirements for foreign providers to designate local legal representatives.

Concurrently, sectoral regulators and technical agencies are progressing with operational implementation. The Bank of Thailand is moving to finalize its AI risk management guidelines following public feedback. ETDA also continues to operationalize its AI Innovation Testing Center (sandbox) and AI risk assessment templates to provide supervised testing tracks for novel commercial AI applications.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
National AI Committee	Chaired by the Prime Minister to provide high-level political oversight and coordinate the Thailand National AI Strategy and Action Plan (2022–2027).	National policy alignment, inter-agency coordination, strategic oversight.
National Electronics and Computer Technology Center (NECTEC) / National Science and Technology Development Agency (NSTDA)	Technical secretariats to the National AI Committee responsible for standard-setting and infrastructure execution.	Publish technical guidance, maintain R&D infrastructure, track strategic metrics.
Electronic Transactions Development Agency (ETDA)	Lead digital economy agency under MDES coordinating national AI policy, sandbox management, and legal drafting.	Issue risk assessment guidelines, manage AI Innovation Testing Center, draft subordinate rules and central regulations.
Bank of Thailand (BOT)	Central bank and supervisory authority for financial institutions and payment service providers.	Supervisory oversight, issuing sectoral AI risk management guidelines, enforcement under Financial Institutions Business Act and Payment Systems Act.