By Anont Tanaset, Senior Policy Specialist, Office of the National Higher Education Science Research and Innovation Policy Council (NXPO)
Thailand spent 2025 setting the direction for its digital economy: committees formed, guidelines issued, and frameworks drafted across AI, cybersecurity and digital finance. By-mid 2026, the Thai government has begun to angle towards results through implementing key initiatives. However, progress has advanced at different speeds across sectors. Several initiatives have already yielded concrete, measurable outcomes. Other parts, mostly the legislation meant to formalise existing regulatory practice, remain in the drafting and consultation stages.
Key Policy Trends
AI Governance: From Committee to Code
AI governance is moving from voluntary, high-level strategy towards operational implementation and the development of more binding regulation. Formed in 2025 under the Prime Minister to position Thailand as an ASEAN AI hub by 2027, the National AI Committee sets the country’s high-level AI strategic direction. Building on this direction in 2026, the National Digital Economy and Society Committee, chaired by the digital economy minister, led implementation efforts, approving the AI Governance Guideline for Executives and reviewing the core structure of the draft AI Act at its 29 June meeting.
That draft AI Act is where the bigger shift is happening. Out for public consultation from 9 July through 14 August, it proposes a risk-based framework built around a new, legally empowered National AI Committee. This includes risk-based classifications with restrictions on discriminatory profiling and covert manipulation, mandatory disclosure of AI-generated content and deepfakes, ethical impact assessments and a public registry for government AI systems. Additionally, it gives enforcement powers to Electronic Transactions Development Agency (ETDA) to order corrective action, suspend a service, or block a system outright. It would turn what has run as informal guidance under a Prime Minister’s committee into statute, backed by an agency that can act on it.
Alongside this shift, ETDA’s AI Governance Practice Centre spent the first half of the year building the practical side of that same shift. Its second AI Governance Week, held in Bangkok from 29 June to 3 July 2026, released a 12-toolkit ethical impact assessment playbook and ran the country’s first AI red-teaming exercise, testing the banking sector against adversarial AI attacks. The Office of the National Higher Education, Science, Research and Innovation Policy Council (NXPO), AIS Academy and IRIS Consulting followed on 2 July with the Thailand AI Readiness Index, a benchmarking tool aiming to assess 5,000 organisations in its first year. These initiatives aim to help organisations evaluate their AI capabilities, strengthen internal governance and prepare for responsible AI adoption, even in the absence of a comprehensive and overarching legislation.
Cybersecurity and Data Protection: Enforcement Ahead of Law
Cybersecurity and data-protection governance is increasingly being shaped by operational enforcement and implementation mechanisms, while broader legislative reform continues at a steadier pace. 2026 produced results from the enforcement approaches of Thailand policymakers. The “United Thailand Against Scammer” campaign, launched in 2025, was barely three months old at the start of the year, but by mid-2026 it had delivered concrete, verifiable metrics. About USD 719,6 million (equivalent to THB24 billion) had been seized or frozen, 29,233 suspects arrested, roughly 300,000 numbers blocked, and reported cases and losses down 69.2% and 87.3% respectively. These figures indicate that the government’s efforts in prevention, interception and coordination mechanisms have become more effective in protecting the public.
The country also accelerated support for victims of scams. A regulation gazetted in May lets the Transaction Committee return frozen funds directly to victims without a court order once it takes effect in mid-August, building on the 2025 Royal Decree’s framework.
In parallel, cross-border collaboration was strengthened. On 3 July, SHIELD, a data-sharing hub, was launched with 10 founding countries, aimed at disrupting cross-border cybercrime and fraudulent financial networks. Thai officials described it as the first platform of its kind designed to support real-time international intelligence-sharing.
On the legislative side, the pace has progressed gradually. The Cybersecurity Act amendment remains under public consultation as stakeholders refine the regulatory text prior to its next legislative stage. In parallel, data protection authorities established practical mechanisms without delay: the Office of the Personal Data Protection Committee (PDPC) built a Binding Corporate Rules certification regime for cross-border data transfers from scratch, gazetted in February, and was already approving live applications by April.
Digital Platforms: Rules With Teeth
The country has tightened oversight of how marketplaces treat sellers. The clearest new rule came from a competition regulator: the Trade Competition Commission of Thailand (TCCT)’s e-commerce guideline. Following consultation since September 2025, it was finalised in the Royal Gazette on 24 March and took effect the next day. The guideline sets out how the TCCT will assess conduct between platforms and their sellers: below-cost pricing, self-preferencing, ranking discrimination, misuse of third-party data, with an exemption for conduct that has a genuine economic justification and doesn’t materially harm competition.
Eight days earlier, ETDA had addressed a narrower complaint. Its 16 March notification encourages platforms to consolidate merchant fees into a single schedule, disclose how those fees are calculated, and give 15 days’ notice before any change, a response to sustained merchant feedback that commission structures were hard to predict or compare across platforms.
Together these measures provide clearer expectations for platform conduct while improving transparency for merchants.
Digital Finance: Towards Market Implementation
The launch of CLICX marks the transition from regulatory approval to market implementation, testing Thailand’s supervisory framework as digital-only banking expands. Following initial approvals in June 2025, CLICX, a Krungthai Bank, AIS and OR consortium, launched on schedule in June as Thailand’s first virtual bank. SCBX’s BankX and CP Group/Ascend Money’s Ascend Bank are still working through final regulatory requirements ahead of launch.
Cross-cutting Governance Trends
Digital Sovereignty: Building National AI Capability
Alongside efforts to regulate AI, the country is also strengthening its domestic technological capability. National Science and Technology Development Agency (NSTDA), Ministry of Higher Education, Science, Research and Innovation (MHESI), National Electronics and Computer Technology Center (NECTEC) and Digital Economy and Society Development Fund (DEF) unveiled ThaiLLM on 20 April. The national large language model was trained on more than 100 billion tokens, offered in 8B and 30B parameter sizes, and run entirely on the domestic ThaiSC supercomputer, enabling data to be processed domestically. It’s OpenAI-SDK-compatible and already being tested by finance, technology and healthcare organisations. This reflects a broader effort to strengthen control over critical AI infrastructure by supporting Thai-language applications.
Structural Change: Expanding Regional AI Governance Capacity
The country’s AI governance institution is expanding beyond domestic implementation towards regional capacity-building. ETDA’s AI Governance Center, running since 2025, formally became the AI Governance Practice Centre during AI Governance Week in late June. ETDA is now pursuing UNESCO Category 2 Centre status, with recognition targeted for early 2028. This transition signals an effort to establish the centre as a regional hub for AI governance capacity-building, supporting the country’s broader ambition to become an ASEAN AI hub by 2027.
Regional Coordination: Chairing the Region’s Digital Rulebook
Alongside developing its domestic regulatory framework, Thailand is taking on a more proactive role in regional coordination. As chair of the ASEAN Digital Economy Framework Agreement (DEFA) Negotiating Committee, Thailand helped steer regional negotiations toward a conclusion at the 57th ASEAN Senior Economic Officials’ Meeting in Manila in late May, with formal signing targeted for the ASEAN Summit in November. It’s a coordinating role spanning ten ASEAN member states, built on the same domestic groundwork now moving through consultation: platform, cybersecurity, and AI rules that Thailand’s own agencies are still finalising. This role reflects its growing engagement in regional digital governance.
Moving Forward
The regulatory frameworks Thailand established in 2025 underwent significant practical testing throughout mid- 2026. The period produced clear results across multiple fronts, even in areas where formal legislation is still being developed. In addition, Thailand also saw high-impact enforcement operations, the launch of the country’s first operational virtual bank (CLICX), and strong regional leadership in concluding the ASEAN DEFA negotiations.
Looking ahead to the second half of the year, maintaining this momentum will depend on bridging remaining administrative targets with domestic execution. Key priorities include guiding the draft AI Act through its public consultation window toward Cabinet review, as well as advancing the operational rollouts for the remaining virtual bank applicants.
The views and recommendations expressed in this article, published in August 2026, are solely of the author and do not necessarily reflect the views and position of the Tech for Good Institute.
