Thailand’s AI Policy: Keeping Pace with Adoption

Across Southeast Asia, AI governance is moving from principles to rules, though at different speeds and in different forms. Some governments have passed or are consulting on comprehensive AI laws, others rely on voluntary frameworks and testing tools, and several have started with rules for their own public sectors. Thailand sits between these models: a comprehensive draft law is in preparation, while most of the rules in force today come from sectoral guidance.

This transitional regulatory posture comes as AI rapidly embeds itself into everyday work across the country. According to PwC’s 2025 survey, 72% of Thai respondents reported using AI at work over the preceding year, compared with 54% globally. Against this backdrop of fast-paced adoption, the core policy challenge is to equip organisations with the skills and oversight needed to use AI responsibly, while establishing clear obligations for those developing and supplying these systems.

Thailand is addressing this challenge across three interconnected fronts: enacting proposed statutory legislation, providing practical governance support for deployers, and building domestic technical capacity through investment in Thai-language models. While these initiatives establish a solid foundation, their ultimate effectiveness will depend on how seamlessly legal requirements, implementation support, and local technical capabilities operate together.

1. Proposed Legislation: Timelines, Sectoral Guidance and Draft Law

The Legislative Timeline

Thailand has been methodically working towards dedicated AI legislation for several years.

• 2022: The Office of the National Digital Economy and Society Commission circulates an initial draft Royal Decree on AI-based services.
• 2023: The Electronic Transactions Development Agency (ETDA) proposes a bill aimed at promoting AI innovation.
• 2024: Parliament establishes a dedicated House committee on AI to examine legislative options.
• 2025: ETDA conducts public consultations on core AI regulatory principles.
• 9 July 2026: ETDA releases the full draft AI Act for public consultation (which closed on 14 August 2026), establishing a statutory framework covering developers, providers, and deploying organisations, including overseas entities.

However, the bill still faces a lengthy journey; as of 29 September, ETDA was processing public submissions, after which the draft must clear both Cabinet and Parliament prior to enactment.

While ETDA spent late September processing public submissions ahead of Cabinet and Parliamentary review, policy momentum continued across national planning. On 7 September, the national AI steering committee convened under the current administration to endorse a refreshed vision: “Intelligent Nation: Sovereignty, Trust and Value Creation“. Supported by 12 new working groups, the strategy focuses on four key pillars—infrastructure, trust, workforce development, and economic value creation. Ultimately, translating this renewed vision into tangible outcomes will depend on effective cross-agency execution, aligned funding, and sustained policy continuity.

Sectoral Guidance Fills the Gap

While the draft bill navigates the legislative process, sectoral guidance has progressed far more rapidly. Several agencies have proactively released their own frameworks to provide immediate direction. Three notable examples stand out:

• The Bank of Thailand’s AI Risk Management Guidelines (September 2025): Apply to banks, specialised financial institutions and payment service providers. Boards and senior management are accountable for AI use, and human oversight is scaled to risk, particularly in areas such as loan approval. Customers must be told when they are dealing with AI and given the option to reach a staff member.
• The OIC’s AI Governance Guideline for Insurance Companies (November 2025): Sets governance, security, explainability and fairness requirements for insurers, with the closest scrutiny on underwriting, premium setting and claims handling. High-risk decisions must keep a human in the loop, and customers must be informed when AI is used.
• ETDA’s AI Governance Guideline for Executives (June 2026): A voluntary guide that turns Thailand’s AI ethics principles into practical steps for organisational leaders deploying AI.

Thailand Draft AI Law & Key Challenges

The draft Act is organised into seven chapters covering definitions, promotion and testing programmes, risk control, enforcement, serious incidents, the regulator, and penalties. It follows a risk-based approach:

• Prohibited AI: Systems that use subliminal manipulation or cause unfair, broad-scale discrimination, along with other risks the AI committee may later announce.
• High-risk AI: Designated by Royal Decree in sectors including national security, health, energy, telecommunications, transport and public utilities. Foreign providers of high-risk AI must appoint a coordinator in Thailand, and deployers must keep logs for at least six months.
• Transparency obligations: AI-generated content must carry machine-readable marks, and chatbots and deepfakes are subject to disclosure requirements.

State agencies would conduct ethical impact assessments and list their AI systems in a public registry. Administrative fines range from THB 1 million to 5 million, and authorities may suspend, recall or block non-compliant systems. The Act also applies to conduct abroad that affects people in Thailand (draft AI Act).

However, as the draft Act moves closer to reality, it presents distinct challenges for the industry:

• Contentious Statutory Rules: The draft empowers authorities to mandate that certain government bodies and operators of Critical Information Infrastructure (CII) use AI systems that process data locally within Thailand. Furthermore, it introduces joint liability for harm caused by violations of the Act. This holds organisations liable even in the absence of intent or negligence, unless they can successfully prove one of a limited set of statutory defences.
• The Risk of Technological Obsolescence: The Act proposes a staggered rollout, with risk-control, enforcement, and incident management chapters taking effect 180 days after publication in the Royal Gazette, while other obligations await secondary rules. Thailand’s experience with the Personal Data Protection Act (PDPA)—which took effect in June 2022 after two postponements—underscores the friction of phased regulatory implementation. Should the AI Act follow the PDPA’s trajectory, full enforcement might only commence three to five years post-enactment. In the fast-paced AI domain, this spans several technological generations, raising the risk that by the time the rules are enforced, the systems they were designed to regulate may already be obsolete.
• Overlapping Rulebooks: The draft does not designate a single regulator; sector regulators would write the detailed rules. Banks and insurers already follow AI guidelines from the Bank of Thailand and the OIC covering board accountability, human oversight, logging and customer disclosure, and the Act would add a second set of duties on the same issues. Unless the Act’s secondary rules recognise compliance with existing sectoral guidance, firms may face duplicate assessments and inconsistent definitions of “high-risk”.

2. Governance support for everyday use

To bridge the gap while formal legislation remains pending, policy focus has shifted towards practical governance support. ETDA’s AI Governance Practice Centre (AIGPC) offers governance tools and training, having engaged over 140 organisations and built a network of 89 certified trainers to train 3,000 executives by 2027.

The demand for operational support is clear. NECTEC’s 2026 readiness survey of 574 organisations revealed that while 53.7% use AI, average readiness remains at the rudimentary “awareness” stage, with governance scoring as the weakest dimension. This highlights an urgent need for guidance on risk assessment, human oversight, and internal procedures.

While ETDA has proposed mandatory AI governance for the public sector, binding rules alone are insufficient. Public agencies require explicit implementation guidance, staff training, and clear protocols for reviewing AI-assisted decisions and responding to inaccurate or harmful outputs.

3. Building Domestic Capability: Sovereign Language Models

Effective governance relies not only on policy frameworks, but also on technical capability—making domestic models a crucial third pillar. ThaiLLM, an open-source model developed by the Big Data Institute, NECTEC, and partners, addresses a vital structural gap: Thai accounts for only 0.4% of global AI training data, leaving a nation reliant solely on foreign models with minimal control over its context and data.

Widespread consumer adoption, however, presents a challenge. In August 2026, ChatGPT held 69% of Thai chatbot usage and Gemini 25%, while ThaiLLM’s testing platform recorded approximately 10,000 users by late September. For most citizens, global commercial models remain the default choice.

Consequently, ThaiLLM’s primary value lies in downstream public-sector applications. NECTEC’s Pathumma model, built on ThaiLLM, currently powers government chatbots piloted across the Land and Revenue Departments. Success in its next phase will depend on expanding public service integration, ensuring operational cost-efficiency, and enabling local developers to maintain and adapt the technology over time.

Different Timelines, One Goal

Thailand is advancing its AI strategy across multiple fronts simultaneously: statutory legislation, national strategic planning, practical governance support, and a sovereign language model. While each pillar possesses distinct strengths, they operate on mismatched timelines. Practical guidance and executive training are accessible today, sovereign model integration is taking root in public administration, and statutory enforcement under the AI Act remains years away.

Ultimately, how effectively these disparate strands are integrated—and how rapidly support reaches organisations actively deploying AI—will determine the true success of Thailand’s governance landscape.

Disclaimer: The views and recommendations expressed in this article published in October 2026 are solely those of the author and do not necessarily reflect the official position or views of the Tech for Good Institute.