The Second-Mover Advantage: What the Philippines Can Learn from Vietnam’s AI Law

While the Philippines currently lacks an AI-specific statute, regulatory activity has not stalled. Individual government agencies have independently introduced domain-specific policies, resulting in a growing patchwork of differing scopes, compliance standards, and regulatory triggers.

As Congress develops the Artificial Intelligence Development and Regulation Act (AIDRA)—a substitute bill consolidating these various measures—the country faces a pivotal transition. The key challenge is not merely passing a comprehensive law, but ensuring it delivers coherence rather than added administrative friction. By drawing from regional benchmarks across ASEAN, the Philippines can turn its status as a second mover into a strategic advantage.

The Philippine Context: A Patchwork of Sectoral Initiatives

In the absence of an overarching statute, Philippine regulators have independently asserted jurisdiction over AI deployments:

• Public Sector Governance: The Department of Information and Communications Technology (DICT) and the Civil Service Commission (CSC) issued Joint Memorandum Circular No. 003, s. 2026, establishing principles for responsible AI use across government agencies.
• Financial Services: The Bangko Sentral ng Pilipinas (BSP) issued Memorandum No. M-2026-031, establishing voluntary AI governance principles for BSP-supervised financial institutions.
• Judiciary: The Supreme Court adopted a framework governing “human-centered augmented intelligence,” introducing safeguards for court users, litigants, and legal AI providers.
• Education: The Department of Education (DepEd) released its Foundational Guidelines on Artificial Intelligence in Basic Education, establishing a risk-based approach for primary and secondary schooling.
• Data Protection Baseline: The National Privacy Commission (NPC) applied the Data Privacy Act of 2012 to AI processing, providing cross-sectoral coverage tied specifically to personal data.

While these initiatives demonstrate regulatory responsiveness, their uncoordinated implementation could create severe operational challenges. Without a reconciliation mechanism, the structure produces overlapping regulation at its intersections and under-regulation at its margins. Consequently, multi-domain AI applications may face conflicting compliance demands from competing agencies. For example, a bank’s AI credit-scoring tool can pass under the BSP’s AI governance principles, but because it processes personal data, it must also pass muster under NPC’s guidance on AI read with all applicable circulars and issuances applicable to the processing of personal information, automated decision-making and automated profiling.

Meanwhile, domain-specific harms—such as algorithmic job displacement—risk remaining unaddressed due to agency inertia and a lack of clear triggers for action (e.g., within the Department of Labor and Employment).

To address regulatory fragmentation, the Philippine Congress is developing the Artificial Intelligence Development and Regulation Act (AIDRA) as a substitute bill consolidating multiple AI-related measures. The draft (Version 4, as of July 2026) seeks to establish the Philippine AI Commission as the lead national regulatory body. However, Section 9 explicitly preserves the existing mandates and independent jurisdictions of current regulatory agencies. Consequently, rather than creating a fully centralised authority, AIDRA places an overarching statutory layer atop established institutions, leaving open the risk of jurisdictional friction.

Regional Comparisons: Vietnam and the ASEAN Landscape

Vietnam serves as a useful comparator, having transitioned from soft policy to a binding statute through Law No. 134/2025/QH15 (effective March 2026). While not a template for wholesale copying given its distinct administrative structure, three features warrant close consideration in the Philippine context:

1. Lifecycle Role Definition: Vietnam explicitly categorizes actors as developers, providers, deployers, or users before assigning legal duties, drawing inspiration from the EU AI Act to clarify accountability across the value chain.
2. Risk-Based Obligations: Rather than imposing uniform compliance burdens across all AI systems, Vietnam applies a risk classification model where regulatory duties correspond directly to the level of risk presented by the application. AIDRA has moved in a similar direction by proposing risk-tier categories.
3. A Live, In-Force Comparator: As an active, in-force framework, Vietnam provides a real-world reference point for Philippine lawmakers adapting governance choices to local institutional capacity.

Vietnam’s law is part of a broader shift across Southeast Asia towards a formal AI regulation, though the region is not converging on a single legislative template:

• Formal Legislative Movements: Malaysia and Thailand are transitioning from soft-law guidelines toward binding statutes, with AI Malaysia issuing a public consultation paper for its landmark AI Governance Bill and Thailand releasing its draft AI Act. Indonesia is similarly working to codify its National AI Strategy into a legally binding presidential regulation.
• Soft-Law and Sectoral Alternatives: Conversely, Singapore continues to rely on soft-law governance frameworks, voluntary testing sandboxes (such as AI Verify), and active enforcement of existing baseline laws (like data protection and cybersecurity) rather than an omnibus AI statute.

This regional divergence reinforces that comprehensive legislation is not inherently superior on its own. The critical test for the Philippines is whether its chosen regulatory structure can clearly allocate responsibility among AI actors, reconcile overlapping agency mandates, and lead to more effective administration.

Key Issues of AIDRA

1. Four-Tiered Risk Classification and Boundary Ambiguities: Like Vietnam’s law and the EU AI Act, AIDRA adopts four risk tiers (prohibited, high, limited, and minimal risk) with varying compliance burdens. While AIDRA supplies statutory criteria for high-risk systems and empowers the Commission to make classification determinations, an operational challenge remains: where boundaries depend heavily on subsequent regulatory interpretation, covered entities such as government agencies and organisations in critical sectors such as education and healthcare may struggle to identify their obligations prior to official guidance.
2. Enforceable Rights via an AI ‘Bill of Rights’: The redraft moves beyond general aspirational principles by translating governance standards into enforceable individual rights through an explicit “Bill of Rights” in the use of AI.
3. Consequential-Decision Safety Net: In what appears to be a first in ASEAN, AIDRA presumptively classifies systems as high-risk if they substantially factor into decisions producing material legal or significant effects on individuals or industries. This consequence-based trigger captures systems by practical impact rather than rigid industry lists. However, terms like “substantial factor” and “material legal effect” require clear, objective operational standards to function predictably.
4. Targeted Rules for Agentic AI and LAWS: AIDRA introduces express regulations for agentic AI systems operating in high-risk domains, as well as provisions governing Lethal Autonomous Weapons Systems (LAWS). While regulating agentic AI addresses immediate autonomous risks directly, it introduces a deliberate trade-off: highly technology-specific rules risk aging rapidly as AI architectures and system designs evolve.
5. Institutional Bottlenecks and Preserved Sectoral Mandates: The draft’s central challenge is institutional. AIDRA explicitly preserves existing agency mandates (such as the BSP, NPC, SEC, IPOPHL, DOLE, and Supreme Court). While preserving domain expertise, maintaining jurisdiction without establishing regulatory primacy creates friction. Crucially, the bill contains no statutory mechanism to resolve conflicting positions between regulators, risking further fragmentation.

Policy Recommendations 

The Philippines’ second-mover advantage allows lawmakers to observe early regulatory friction across ASEAN and distinguish between issues requiring national uniformity and those best served by domain expertise. Preserving sectoral authority—such as the Bangko Sentral ng Pilipinas (BSP) in finance, the National Privacy Commission (NPC) in data privacy, the Department of Education (DepEd) in basic education, and the Supreme Court in judicial administration—is sound, as a single regulator cannot replicate all technical knowledge. However, preserving these mandates requires clear statutory rules for inter-agency interaction.

To convert timing into operational coherence, Philippine policymakers should prioritize three key actions before enacting AIDRA:

• Codify Rules for Regulatory Primacy and Conflict Resolution: Move beyond general directives to “coordinate” by establishing statutory rules to assign lead-agency authority for overlapping deployments, reconcile conflicting regulations, and recognize equivalent cross-agency compliance approvals.
• Define Predictable, Pre-Deployment Risk Thresholds: Anchor subjective high-risk triggers—such as whether a system “substantially factors into” a decision or causes a “material legal or similarly significant effect”—in clear, pre-defined operational criteria issued by the Philippine AI Commission prior to enforcement.
• Align Regional Insights with Local Capacity: Draw from ASEAN movements—such as Vietnam’s Law No. 134/2025/QH15, Malaysia’s draft AI Governance Bill, Thailand’s draft AI Act, and Indonesia’s strategy codification—without assuming a centralised “AI super body” can replace domain-specific oversight or overcome capacity constraints.

Conclusion

Comprehensiveness alone does not guarantee regulatory success. An omnibus statute that simply overlays existing agency mandates without clear hierarchy risks compounding administrative friction rather than resolving it.

Ultimately, the practical success of AIDRA rests on three key questions: Before an AI system is deployed, can regulated stakeholders determine which rules apply to them and which regulator has authority? When an AI user is affected, can that person identify the available rights and remedies? And when regulatory mandates collide, does the law determine whose rules prevail? If AIDRA can answer these questions, the Philippines will succeed not just in enacting a comprehensive AI law, but in building a coherent one.

The views and recommendations expressed in this article published in October 2026 are solely of the authors and do not necessarily reflect the views and position of the Tech for Good Institute.

The authors thank Alexandra Palacio and Bea Abarquez, legal interns at Gorriceta Africa Cauton & Saavedra, for their research assistance. Alexandra is a fourth-year Juris Doctor student at the University of the Philippines College of Law, and Bea a third-year Juris Doctor student at the Ateneo de Manila University School of Law.