Verified September 29, 2026
ASEAN has no binding AI instrument; everything AI-specific is soft law endorsed by digital ministers, and even the 2016 data protection framework disclaims legal effect. DEFA will be the first binding text touching AI, but until signature (targeted 2026-11) and publication its AI provisions are known only from the SEOM chair's statement and law-firm summaries, which describe cooperation-style commitments rather than obligations. Name variants: the successor masterplan is styled both 'ASEAN Digital Masterplan 2030' and 'ASEAN Digital Masterplan 2026-2030' in official documents; the AI Safety Network is abbreviated 'ASEAN AI Safe'; the Working Group on AI Governance appears as WG-AI. The Responsible AI Roadmap PDF carries a USAID/DAI disclaimer and is dated on asean.org to February 2025 while Digital Policy Alert lists adoption on 2025-03-05. ASEAN admitted Timor-Leste as its eleventh member on 2025-10-26, so 'ASEAN' instruments from 2026 onward cover eleven states, though the 2016 PDP Framework names ten. The 7th ADGMIN is scheduled for Bandar Seri Begawan in January 2027 and the Philippines chairs ASEAN in 2026; a chair-led AI-for-MSMEs declaration was reported as a planned November 2026 summit deliverable but is unverified. Timor-Leste is not yet reflected in the 2024 and 2025 AI guides. Sector-level AI rules do not exist at ASEAN level.
Verified September 29, 2026
- AI law
- None
- Sector rules
- GenAI Guidance for Education, Handbook Edition2025A handbook for teachers and students on safe and ethical generative AI use covering digital safety, academic integrity, responsible use and personal data protection, aligned with AITI's AI guide, the PDPO and Malay Islamic Monarchy values, as described by the Minister of Education at the Legislative Council on 2026-03-26 (the handbook itself was not found on moe.gov.bn).
Posture: Brunei is a guidance-first jurisdiction. Nothing AI-specific has legal force; the only binding instrument that bears on AI is the PDPO 2025, which applies to private organisations only. Name variants: AITI is spelled both 'Authority for Info-communications Technology Industry' and 'Authority for Infocommunications Technology Industry' in official documents; the PDPO is 'Personal Data Protection Order, 2025' (with the comma) in the gazette and often 'PDPO 2025' elsewhere. Strategy status: until 2026-06 Brunei had no national AI strategy (ISEAS counted it among the four ASEAN members without one as of early 2026); the Data and AI Strategy is a chapter of Digital Brunei 2030, not a standalone document, and the booklet PDF is image-based with little extractable text, so details were taken from the digitalbrunei.bn strategy page. The launch date is reported as 2026-06-03 (The Star) with Borneo Bulletin coverage on 2026-06-04; the booklet PDF metadata is dated 2026-06-02. Separately, MTIC launched its own Strategic Plan 2026-2030 on 2026-01-30. PDPO commencement: section 1(1) of the Order leaves commencement to a ministerial notification; the 2026-01-01 date rests on DLA Piper (updated 2026-03-18) and Rajah & Tann, both citing a one-year transition, and the AGC document page (posted 2026-08-27) lists no subsidiary legislation, so the commencement notification's gazette number is unconfirmed. AI guide editions: the first edition PDF is dated 2025-04 (news release 2025-04-11); the second edition is hosted only as a FlowPaper flipbook with no visible date on the cover page, and press reports (The Star, 2026-05-01) date its publication to around 2026-04/05 after a 2025-11 consultation paper. The AITI guide references 'Second Edition' of Singapore's Model AI Governance Framework in its text, which should not be confused with AITI's own second edition. AMRO's labour-exposure note is analysis, not policy. No em dashes were used.
Verified September 29, 2026
- AI law
- None
Naming: the strategy is 'National Artificial Intelligence Strategy 2025-2030' (Khmer: yuttheasastr cheat sdeipi panha sippanimmit 2025-2030); MPTC still labels it 'Draft'. The only public English text is the June 2025 consultation version (v5), mirrored by Open Development Cambodia and OECD.AI; no PDF was found on mptc.gov.kh or ai.gov.kh. MPTC's April 2025 press release targeted approval by the National Digital Economy and Society Council in August 2025 and a National AI Governance Framework by December 2025; neither had appeared by September 2026, and the PM's 17 July 2026 speech and CADT's 22 September 2026 UNESCO forum report both describe adoption as still ahead. Lead agency is contested in secondary sources: Lex Mundi and some trackers name MISTI, but the government's own documents give MPTC the drafting and coordination role, with MISTI as co-owner of the ai.gov.kh portal and author of the April 2026 ESCAP report. Two further bills matter for AI but are not AI laws: the draft Law on Cybersecurity was in technical review with the Ministry of Justice in July 2026 (MPTC page dated 2026-07-08), and a separate Interior-ministry Cybercrime Law has been in draft since 2020 with no 2026 movement found. The Law on Combating Technology-Based Fraud is variously translated as Anti-Technology Fraud Law, Anti-Online Fraud Law or Law on Combating Online Scams; the Royal Kram number was not located, and the AKP (state news agency) page was used in place of a gazette. The Digital Economy and Society Policy Framework 2021-2035 (2021, MEF/Supreme National Economic Council) and Digital Government Policy 2022-2035 (2022, MPTC) are the umbrella policies the AI strategy sits under; their PDFs were unreachable, so they are not entered as separate rows. No AI-specific instruments from the National Bank of Cambodia, the health ministry, the election commission or the telecoms regulator were found; the sectorRules entries are adjacent instruments and are labelled as such. Web search budget was exhausted before a final sweep of September 2026 news, so a very recent adoption announcement cannot be fully excluded; the MPTC English news archive for August and September 2026 showed none.
Verified September 29, 2026
- Sector rules
- Tata Kelola Kecerdasan Artifisial Perbankan Indonesia (AI Governance for Indonesian Banking)2025Launched 2025-04-29 (press release SP 67/GKPB/OJK/IV/2025) as a minimum benchmark for commercial banks covering the whole AI lifecycle around the principles of accountability, human oversight and reliability, building on POJK 11/2022 on bank IT.
- Panduan Kode Etik Kecerdasan Artifisial yang Bertanggung Jawab dan Terpercaya di Industri Teknologi Finansial (AI code of ethics for fintech, 2023, updated edition announced 2025-12-01)Voluntary code for fintech and financial-sector AI use first issued in late 2023; OJK's Hasan Fawzi announced a revised edition at the OECD Asia Roundtable on Digital Finance in Bali on 2025-12-01 (primary OJK page not located).
- Putusan Nomor 166/PUU-XXI/2023 (reinterpreting 'citra diri' in Article 1(35) of Law 7/2017 on Elections)2025Pronounced 2025-01-02, the Court held that campaign images must be original and recent and not excessively engineered or manipulated with AI, the only AI-specific election rule; KPU's campaign regulations for the 2024 elections (PKPU 15/2023, 20/2023, 13/2024) contain no AI clause, and Bawaslu has publicly called for a PKPU and an Election Law amendment on AI.
- Komite AI Kemenkes and Responsible AI in Health governance work (with HealthAI Global Regulatory Network); Keputusan Menteri Kesehatan HK.01.07/MENKES/951/2026 on marketing authorisation guidance for software-based medical devices2026The Ministry set up an internal AI committee, held a Responsible AI in Health workshop on 2026-07-29/30 to map governance priorities for the next 9 to 24 months, and on 2026-09-07 issued a ministerial decision on software-as-medical-device licensing that captures AI-based devices; a Good AI Medical Practice guideline with BPOM is still in preparation.
Naming: Indonesian official texts use 'kecerdasan artifisial' (KA), while press and older texts use 'kecerdasan buatan' or 'AI'; 'Stranas KA' is the standard short form of the 2020 strategy. The lead ministry was renamed from Kementerian Komunikasi dan Informatika (Kominfo) to Kementerian Komunikasi dan Digital (Komdigi) in October 2024, so the 2023 circular carries the old ministry name and JDIH still serves it under both domains. The 'law' row is deliberately Draft, not Announced: the two Perpres are executive regulations, not statutes; Komdigi has said an AI Law will come later and no bill exists in the DPR. Slippage is real: targets moved from Q1 2026 to May 2026 to July 2026 and the instruments were still unsigned on 2026-09-03; editors should re-check jdih.setneg.go.id for a Perpres number before publishing. The OECD.AI entry for the roadmap is dated 2025 but the roadmap period is given variously as 2025-2029, 2026-2029 (JDIH Komdigi, February 2026) and 2026-2030 (Antara); the JDIH Komdigi framing of 2026-2029 is used here. Stranas KA has no legal instrument behind it; a January 2026 report that it would itself be formalised as a Perpres could not be confirmed at a primary source and appears to be a conflation with the roadmap Perpres. Data protection: UU PDP's two-year transition ended 2024-10-17, PP 33/2026 (set 2026-07-16, effective 2027-01-16 under Article 225) has been promulgated, but the independent Lembaga PDP has not been established, so OJK-style sectoral supervision and Komdigi fill the gap. Elections: the AI constraint comes from a Constitutional Court reading of the Election Law, not from a KPU regulation; KPU campaign regulations for the 2024 general election and regional elections were text-searched and contain no AI provision. Health: KMK 951/2026 is a general software-medical-device licensing guide rather than an AI-specific rule; treat it as adjacent. BSSN and Bank Indonesia have not issued AI-specific instruments that could be confirmed. All URLs marked verified were opened on 2026-09-29; the MK decision and Stranas KA were verified from the PDF text itself.
Verified September 29, 2026
- AI law
- None
- Guidance
- None
- Sector rules
- ICT-AI Competency Standards for Teachers2025Competency benchmarks (December 2025) for teachers' use of ICT and AI, tied to the National STI Strategy 2026-2040 and National Teacher Policy launched 2026-06-05; guidance for the education sector, not a binding rule.
Posture: Laos is at the pre-strategy stage. There is no AI law, no government-issued AI ethics framework and no sector AI rules; the only AI instrument with any status is a draft ten-year National AI Strategy (2026-2035) that the cabinet approved in principle on 2026-09-23 and returned to MTC for revision, so it is not yet adopted and its text is not public. Name variants: MTC was the Ministry of Post and Telecommunications (MPT) until 2021 and its website still carries MPT branding; the Brookings profile calls it MOTC. The digital roadmap is one bundled document (Vision 2021-2040, Strategy 2021-2030, Plan 2021-2025) dated December 2021 and posted 2023-01-16 on mtc.gov.la; the government said in January 2026 it is finalising a National Digital Transformation Plan 2026-2030 for the National Assembly, which is separate from the AI strategy. The data protection law is a 2017 statute limited to electronic data; the in-force date is quoted by law firms as 2017-05-12 (the adoption date) but Lao laws take effect on presidential promulgation, so treat the exact date as unconfirmed; a Law on Cybersecurity was before the National Assembly in June 2025 (KPL id 92111) and its final status was not confirmed. UNESCO wording ('sets course for National AI Strategy', January 2026) has been misread by some outlets as a launch of the strategy itself; what was launched was the RAM report. The July 2025 Prime Minister's order on digital ID integration and the 2023 presidential decree creating the National Digital Transformation Committee are digital-government measures with no AI provisions. The LaoAI assistant (April 2026) is a government product, not a policy. Web search budget was exhausted mid-audit, so trackers (OECD.AI, IAPP, Digital Policy Alert) were not directly checked; ISEAS 2026 and Brookings 2025 served as the tracker layer, and both list Laos among the ASEAN members with no AI strategy or AI-specific law.
Verified September 29, 2026
- Sector rules
- Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector2025Published 2025-08-05 with feedback due 2025-10-17, the paper sets out BNM's proposed supervisory expectations for AI use by financial institutions (governance, risk, consumer outcomes) and will inform future policy; BNM's revised Risk Management in Technology policy document (reported effective 2025-11-28) is said to extend binding tech-risk duties to AI but that revision was not opened at the source.
- Online Safety Act 2025 (Act 866): Risk Mitigation Code2026Issued 2026-05-22 and enforced from 2026-06-01 under the Online Safety Act 2025 (assented 2025-05-06, gazetted 2025-05-22, in force 2026-01-01), the code requires licensed large platforms to test their recommender algorithms for harm and to label AI-generated or manipulated images, audio and video that could pass as authentic.
- Johor State Data Centre Development Planning Guidelines2024Approved by the State Planning Committee and Johor Executive Council in April 2024, the guidelines set siting, power, water and connectivity requirements plus a Data Centre Development Coordinating Committee approval route; in November 2025 the state additionally stopped approving Tier 1 and Tier 2 (high water use) data centres, per state assembly statements reported in the press.
- MMC Guideline on the Ethical Use of Artificial Intelligence (AI) in Medical Practice, Version 1/20252025Professional guidance for registered doctors built on five principles (autonomy, well-being and safety, transparency and explainability, responsibility and accountability, privacy) that keeps the practitioner accountable for AI-assisted clinical decisions.
Naming: the Malay title of the bill is Rang Undang-Undang Tadbir Urus Kecerdasan Buatan; press often calls it the AI Act or AI Governance Act, but no bill has been tabled in Parliament, so the status is Draft (post-consultation, pre-Cabinet). The National AI Office was first a unit inside the Ministry of Digital (2024-12-12) and is now a company limited by guarantee, AI Malaysia Berhad; ai.gov.my still carries both names. The Action Plan PDF is served from a Strapi host (strapi.naio.okie.my) linked from ai.gov.my, not from a gov.my domain. The 2021-2025 roadmap belongs to MOSTI and its PDF is not linked on the MOSTI news page; the new plan's Part 1 contains a Lessons from AI Roadmap 2021-2025 section. AIGE is voluntary; the ai.gov.my governance page also lists an AI Code of Ethics (AICE), the ASEAN Guide on AI Governance and Ethics, and MY-AI Standards (aistandards.my) developed with SIRIM, which the minister described as the standards layer of a three-tier standards, regulations, law approach. The PDPA phased commencement is set by P.U. (B) 522 (dated 2024-12-19, gazetted 2024-12-24), which lists section numbers rather than topics; JPDP guidelines on DPO appointment, breach notification and cross-border transfer were issued in 2025. The Cybercrimes Bill 2026 is the operative deepfake instrument but its royal assent and gazettal were not confirmed at a primary source; treat as Passed, not Enacted. The MCMC Act page URL slug reads communications-and-multimedia-amendment-act-20-1 but is the official Online Safety Act 2025 page. Two web searches on BNM RMiT and further September 2026 news were cut off when the session's search budget was exhausted, so the latest row is anchored on the 2026-09-10 ministerial statement (news source) and the 2026-09-11 AI Malaysia board statement (primary).
Verified September 29, 2026
- AI law
- None
- Guidance
- None
Legitimacy: every instrument since 2021-02-01 was issued by the military administration. The State Administration Council (SAC) enacted laws by decree under article 419 of the 2008 Constitution until it was dissolved on 2025-07-31, when the National Defence and Security Council took over and created the State Security and Peace Commission; after the 2025-12 to 2026-01 election Min Aung Hlaing was sworn in as president on 2026-04-10. The sacoffice.gov.mm domain now carries the National Defence and Security Council Office name. The opposition National Unity Government and much of the international community do not recognise these bodies, so an editor should describe them as the military administration rather than the government of Myanmar, and note that the same officials have been issuing policy across the SAC, SSPC and presidential phases. Lead ministry: contrary to the audit lead, the AI strategy is being drafted by the Ministry of Science and Technology (Union Minister Dr Myo Thein Kyaw), not the Ministry of Transport and Communications; MoTC leads cybersecurity, e-government and the Cybersecurity Law, and the Digital Economy Development Committee is chaired by the Minister of Commerce with MoTC as patron. Strategy status: the Myanmar Computer Federation (an industry body working with MoST on an AI taskforce) published two decks (2025-01-16 and later in 2025) listing a National AI Strategy 2025-2030 and a National AI Development Policy as under drafting, with a six-pillar structure and a 2025-2026 policy alignment phase; the ai-gov.world tracker (2026) also records the strategy as still in draft. Cybersecurity Law: the English text read is the Lincoln Legal Services convenience translation hosted by ICNL (also at lincolnmyanmar.com), not an official translation; the Burmese text is the authoritative one. Different sources give the platform registration threshold as 100,000 users (law text section 30) versus 10,000 (one MCF slide, which appears to be a typo). The commencement date of 2025-07-30 is reported by law firms and not confirmed from a gazette. Data: the Cybersecurity Law's three-year retention rule (section 33) and the ETL 2021 privacy chapter are the only statutory data rules of general application; no data protection authority exists. Surveillance context: Human Rights Myanmar's August 2025 submission to the UN Special Rapporteur on counter-terrorism and its 2026-01-20 civic-space report document AI facial recognition under Safe City projects in Naypyidaw, Mandalay and Yangon (Huawei, Dahua, Hikvision hardware, first reported by Human Rights Watch on 2021-03-12), the Person Scrutinisation and Monitoring System with 1,657 arrests claimed between 2025-03-07 and 2025-05-21, and AI-assisted deep packet inspection; the Myanmar Internet Project has criticised the Cybersecurity Law's surveillance effects but its site (myanmarelectionwatch.org) did not resolve. These are civil-society claims, not government instruments. International: WAICO founding membership (2026-07-16) is reported by secondary sources only; the ai-gov.world tracker also lists a China-Myanmar joint statement of 2026-06-17 that was not located. Name variants: the strategy is referred to as National Artificial Intelligence Strategy (NAS), National AI Policy (NAP) and National Artificial Intelligence Development Policy; Digital Economy Roadmap 2030 is also written Digital Economy Roadmap 2024-2030; the e-Governance Master Plan 2030 is sometimes called the Digital Governance Master Plan 2030. Web search budget was exhausted mid-audit, so 2026 items after February rely on the NDSC office site search only.
Verified September 29, 2026
- Sector rules
- NPC Advisory No. 2024-04: Guidelines on the Application of RA 10173 (Data Privacy Act), its IRR and NPC Issuances to Artificial Intelligence Systems Processing Personal DataDecember 19, 2024Applies the existing data protection law to every phase of an AI system's life cycle, requiring controllers to disclose AI processing, run privacy impact assessments, keep humans able to intervene, address bias and honour objection, rectification and erasure rights.
- Memorandum No. M-2026-031: Guidance Paper on Governance Principles for Artificial Intelligence (AI) in Financial ServicesJune 23, 2026Sets supervisory expectations, framed around the STARS principles (sustainability, transparency, accountability, responsibility, security), for BSP-supervised institutions to build proportionate AI governance and risk management, including accountability for third-party AI.
- Memorandum No. M-2026-034: Recommendations for Managing Emerging Risks Arising from Frontier Artificial Intelligence SystemsJuly 5, 2026Companion memorandum on cybersecurity and operational risks that frontier AI systems create for supervised financial institutions.
- Resolution No. 11064: Guidelines on the Use of Social Media, Artificial Intelligence, and Internet Technology for Digital Election Campaign, and the Prohibition and Punishment of Its Misuse for Disinformation and Misinformation, for the 2025 National and Local Elections and the BARMM Parliamentary ElectionsSeptember 17, 2024Required candidates to register social media accounts and label AI-generated campaign material with conspicuous disclaimers, and treated deepfakes, cheapfakes, bots and coordinated inauthentic behaviour as election offences for the 2025-05-12 midterms.
Lead-agency question: three departments share AI policy and the answer has shifted. DTI owned the 2021 NAISR and the July 2024 NAISR 2.0 plus CAIR; since the President approved DOST's NAIS-PH in May 2025 the strategy has been DOST-led (NAICRI launched 2026-02-26), while DICT owns AI infrastructure (PAIIM 2026-2033), public-sector AI governance (JMC 003 with CSC) and data residency (EO 119), and the House substitute bill would seat a Philippine AI Commission under DICT whereas SB 852 would put a council under DOST. Editors should not describe NAISR 2.0 as the current national strategy without qualification; the CAIR site itself calls it superseded, though no DTI page formally withdraws it. No dedicated AI statute exists and none has passed either chamber; bill counts (about 40 House and 7 Senate measures per Rappler, 2026-06-06) change weekly and the 20th Congress runs to mid-2028. HB 7396 cited by some trackers is a 19th Congress number and is not the live vehicle. The DICT-CSC JMC is binding on government bodies even though it is listed here under framework, because it is the closest thing to cross-cutting AI governance guidance and its reach into private vendors is only contractual. BSP memoranda are guidance (non-binding) rather than circulars. DOH has issued no AI rule; its activity is advisory (2025-10-21 warning on AI for mental health) and membership of the HealthAI GRN (2026-03-18). The Data Privacy Act took effect 15 days after publication; 2012-09-08 is the commonly cited date and the full text was read on lawphil.net because the Official Gazette is behind Cloudflare. Local name for NAIS-PH is a pun on 'nais' (Filipino for 'wish'). A draft cross-cutting 'AI Governance Framework' was reported in early 2026 as in finalization but no official document was found. Do not cite the naisr.cair.ph site as DTI's own domain; it is a CAIR reference page. Web search budget was exhausted mid-audit; later checks used Google through the built-in browser.
Verified September 29, 2026
- AI law
- None
- Sector rules
- FEAT Principles (2018-11-12), Veritas initiative (2019 onward), Project MindForge AI Risk Management Toolkit (2026-03-20), and proposed Guidelines on AI Risk Management (consulted 2025-11-13 to 2026-01-31)2026MAS moved from principles-based FEAT guidance and the Veritas toolkit toward supervisory expectations: a consultation on binding-style Guidelines on AI Risk Management for all financial institutions closed 2026-01-31 (not yet finalised as of 2026-09-29), and an industry Operationalisation Handbook covering traditional, generative and agentic AI was published 2026-03-20.
- Artificial Intelligence in Healthcare Guidelines (AIHGle) 2.02026Non-binding guidance, first issued in 2021 and reissued as AIHGle 2.0 in 2026, that clarifies developer, deployer and clinical-user responsibilities, transparency expectations and risk assessment for AI used in care; regulated AI medical devices remain subject to HSA's Health Products Act regime.
- Elections (Integrity of Online Advertising) (Amendment) Act 2024 (deepfakes of candidates)2024Binding law introduced 2024-09-09 and passed 2024-10-15 that bans publishing, sharing or boosting digitally generated or manipulated online election advertising depicting a candidate saying or doing something they did not, empowers the Returning Officer to issue corrective directions, and penalises non-compliance; trackers report commencement on 2025-01-22 ahead of the 2025 general election.
- Online Safety (Miscellaneous Amendments) Act 2022 (in force 2023-02-01) and Online Safety (Relief and Accountability) Act 2025 (Act 23 of 2025, passed 2025-11-05, first phase in force 2026-06-29 with the Online Safety Commission)2026Binding platform-regulation laws that are not AI-specific but govern synthetic and manipulated content: the 2022 Act lets IMDA direct social media services to block egregious content and imposes a Code of Practice for Online Safety, while the 2025 Act creates a Commissioner of Online Safety who can order removal of harmful content (initially intimate-image abuse, child abuse imagery, doxxing, harassment and stalking) and new statutory torts against posters, administrators and platforms.
Posture: Singapore is a deliberate no-horizontal-law jurisdiction that governs AI through iterated voluntary frameworks, testing tools and targeted binding rules on specific harms. Name variants: NAIS 2.0 is also written 'National AI Strategy 2.0'; the Model AI Governance Framework is commonly abbreviated MGF or 'Model Framework'; the agentic edition is cited as 'MGF for Agentic AI' and is version 1.5 as of 2026-06-05, so editors should check for a later version. The Ministry of Communications and Information was renamed MDDI in July 2024, so pre-2024 documents carry the old ministry name. The Singapore AI Safety Institute is the Digital Trust Centre at NTU, designated in 2024, not a new statutory body; a 2026-02 MDDI release on Paris summit initiatives and the sgaisi.sg site confirm its role but I did not find a primary page giving the designation date. The MAS Guidelines on AI Risk Management are still a consultation draft; if finalised they would be the first supervisory AI rules with quasi-binding force. AIHGle 2.0: MOH's page says it updates the 2021 guidelines and is a 2026 release; the exact publication date was not visible. The National Day Rally 2026 (2026-08-23) contains no announcement of AI legislation; the Tech Times headline claiming Singapore 'abandons voluntary AI governance' overstates the speech, which promises safeguards and coalitions on AI and binding age checks for social media. Also relevant but not rows: PDPC AI advisory guidelines (2024-03-01), the Global AI Assurance Pilot (2025-02-11), a planned AI tester accreditation programme (reported for Q3 2026, unverified at source), and IMDA's IAPP partnership (2026-07-22, from secondary sources). All dates ISO; Singapore official documents are in English so no translation issues.
Verified September 29, 2026
- Sector rules
- Bank of Thailand Policy Direction on Risk Management of the Use of AI Systems (Guiding Principles for AI Risk Management)September 12, 2025A policy direction (not a formal notification) for BOT-supervised financial institutions and payment providers covering in-house and third-party AI, organised around governance and development-and-security pillars, FEAT principles, and data, model and cyber risks; draft consulted June 2025.
- Guideline on AI Governance for Insurance Companies (AI Governance Guideline)2025Risk-proportionate guidance for insurers in four parts (AI governance, robustness and security, transparency and explainability, fairness and consumer protection), aimed especially at customer-facing and high-risk uses such as underwriting and claims.
- Governance Framework for the Use of AI and Machine Learning in the Capital Market2023Best-practice manual transmitted to securities, derivatives, asset-management and advisory firms (circular Kor Lor Tor. Tor Tor. (Wor) 57/2566); non-binding but treated as the SEC's expectations, and law-firm coverage in April 2026 describes an updated framework that signals future formal rules.
- Guidelines on the Use of Artificial Intelligence for Telecommunications ServicesJuly 2, 2026Non-binding, risk-based guidance for telecom licensees on governance committees, six principles (compliance, fairness, security and privacy, transparency, accountability, reliability), lifecycle controls, vendor oversight and consumer disclosure; the document itself was not located on the NBTC site.
Naming: the current bill is referred to variously as the Draft AI Act, the Draft Act on Artificial Intelligence, and in Thai ร่างพระราชบัญญัติปัญญาประดิษฐ์; it replaced the mid-2025 (Draft) Principles of the AI Law (ร่างหลักการของกฎหมายว่าด้วยปัญญาประดิษฐ์), which itself merged the 2022 ONDE Draft Royal Decree on Business Operations Using AI Systems and the 2023 ETDA Draft Act on the Promotion and Support for National AI Innovation. Both of those older drafts are dead as standalone instruments. Sources disagree on whether the 2026 draft was released on 2 July (Mondaq, Norton Rose) or 9 July (Baker McKenzie, TFGI); the consultation close of 14 August 2026 is consistent. Status on 2026-09-29: consultation closed, ETDA processing comments, no Cabinet submission yet; the Business Software Alliance and AMCHAM have lobbied against strict and joint liability, data localisation and government control of contract terms (AMCHAM met ETDA on 2026-09-22). Draft penalties include criminal liability for AI-generated sexual content and false election statements, which is the closest thing Thailand has to a deepfake or election rule; the Election Commission had no AI-specific campaign rule for the 2026-02-08 general election (Thai PBS Verify, 2026-01-16), and deepfakes are otherwise handled under the Computer-related Crime Act and Criminal Code defamation. Other binding-ish sector items not in the four slots: OCPB notification of 2025-07-18 requiring labelling of AI-generated advertising; Civil Court directive B.E. 2568 requiring disclosure of AI-prepared pleadings; Supreme Court President guidance B.E. 2568 on judges' AI use; NCSA AI security guideline (September 2025). ETDA's AIGC was rebranded the AI Governance Practice Center (AIGPC) in 2026 and Thailand is seeking UNESCO Category 2 status for it. The OECD.AI entry lists NESDC as responsible organisation, but the strategy is run operationally by NECTEC/NSTDA via ai.in.th; MHESI and MDES co-own it. TH-AI Passport: official sites are aipass.go.th and de.aipass.net; registration opened 2026-08-19, service 2026-08-31, program ends 2027-08-31; the THB 1.6 billion figure and the Digital Economy Fund funding route come from press (Fulcrum 2026-09-28, Bangkok Post) and were not seen on the official site. Minister's name is romanised as Chaichanok or Chaiyanok Chidchob. The ETDA AI Governance Guideline for Executives PDF is a slide-style 18-page document dated 2023; ETDA also publishes a broader Thai AI Ethics Guideline series under MDES. The BOT instrument is a policy direction (แนวนโยบาย), formally non-binding but treated as supervisory expectation. The OIC guideline PDF is dated November 2025 and was read directly. The NBTC guideline is known only from law-firm summaries; the NBTC URL given is the regulator's home page, not the document.
Verified September 29, 2026
- Strategy
- None
- AI law
- None
- Guidance
- None
- Data law
- None
Timor-Leste has no AI strategy, AI law, AI ethics framework of its own, data protection law or data protection authority; every 'None' above is grounded in the government's own pages plus the July 2026 cybersecurity package listing. Name variants: TIC Timor I.P. is the Agencia de Tecnologia de Informacao e Comunicacao (Information and Communication Technology Agency), sometimes written TIC TIMOR; the ministry is Ministerio dos Transportes e Comunicacoes (Minister Miguel Marques Goncalves Manetelu); the regulator is Autoridade Nacional de Comunicacoes (ANC). Timor Digital 2032 is the official English name of the Plano Estrategico Nacional para o Desenvolvimento Digital e das TIC. The 2026 government search page returned 48 hits for 'artificial intelligence', almost all speeches or ASEAN meeting reports; the only binding-style act is the 2026-09-16 Council decision, which is an internal pilot authorisation, not a regulation. The 'AI Readiness Task Force' appears only in that communique; its legal basis and membership were not found. The gov.tl page for the 2026-08-24 Government Dialogue on AI was not located; the event announcement is from state news agency Tatoli, and the government's own 2026-08-24 page (?p=50979) covers the wider Science for Development Summit hosted by the President. The cybersecurity package is a request for legislative authorisation (Parliament delegates power to the Government to legislate by decree-law), so if granted the data protection rules would arrive as government decree-laws rather than a parliamentary act; civil society has criticised earlier cyber-law drafts. Timor-Leste joined ASEAN on 2025-10-26; the government has said it aligns with the voluntary ASEAN Guide on AI Governance and Ethics and asked ASEAN for AI skills support, but no ASEAN instrument is binding. Decree-Law 12/2024 entry into force: the trade portal says 13 August 2024 while a law-firm tracker says 18 August 2024; the gazette scan could not be read to settle this. Speech PDF for the Dili Dialogue Forum 2025 (2025-05-10) sits at https://timor-leste.gov.tl/?lang=pt&p=43270 but only metadata rendered.
Verified September 29, 2026
- Sector rules
- Draft Circular on safety, risk management and deployment conditions for AI applications in the banking sectorDraft, 2026Circulated for industry comment via Official Dispatch 1162/NHNN-CNTT of 2026-02-13 (6 chapters, 27 articles in the first draft; a later draft reported as 5 chapters, 26 articles), it would require credit institutions, foreign bank branches and payment intermediaries to classify AI systems by risk, keep human oversight, disclose AI interaction to customers, control bias and report serious incidents within 24 hours, with existing systems to comply by 2027-09-01; it was being finalised after Decision 33/2026 as of August 2026 and had not been located as issued on the SBV portal by 2026-09-29.
- Decision 33/2026/QD-TTg promulgating the List of High-Risk AI SystemsEnacted, 2026Names the specific AI uses in six fields (for example automated credit decisions and transaction controls in banking, surgical robots and diagnostic aids in health, automated student assessment in education, biometric identification in proceedings, autonomous driving and traffic control in transport) that trigger conformity assessment and the other high-risk duties of the AI Law and Decree 142.
Naming: the AI Law's Vietnamese name is Luat Tri tue nhan tao; English sources use 'Law on Artificial Intelligence' or 'AI Law'. Government-portal pages give the law's date as 2025-12-10 (passage and signing), while some English news dated it 2025-12-11. The lead ministry is the Ministry of Science and Technology (MOST, sometimes abbreviated MST on its English site) after absorbing the Ministry of Information and Communications in 2025; the ministry's English site still carries some 'MIC' page paths. A Decree 225/2026/ND-CP (reported in state media as effective 2026-07-01) is said to add AI explicitly to MOST's functions and create a Department of Digital Technology and AI, but this was not confirmed at a primary source. Strategy: the 2021 Decision 127/QD-TTg record on vanban.chinhphu.vn does not yet show a 'replaced' flag, and the government newspaper article on Decision 1671 does not state that it repeals Decision 127, though LuatVietnam reports that it does; treat Decision 1671 as the current strategy and Decision 127 as its predecessor. Political backdrop: Politburo Resolution 57-NQ/TW of 2024-12-22 on breakthroughs in science, technology, innovation and digital transformation (a Party document, not law) drives the whole programme. Law on Digital Technology Industry 71/2025/QH15 (passed 2025-06-14, in force 2026-01-01) originally carried an AI chapter that the AI Law repealed. Pending or unconfirmed: SBV AI banking circular (draft); administrative-sanctions decree for the AI Law and for the PDPL (none located as issued); MOST technical guidance on conformity assessment; the Ministry of Education and Training's AI curriculum framework for grades 1 to 12 from school year 2026-2027 (reported mid-August 2026, no primary document located, so not listed as a sector rule). Penalty amounts under the AI Law are not stated in the sources opened; Vietnam Briefing reports penalties may be set as a share of global revenue but gives no figure. The National AI Ethics Framework is binding only for public-sector AI use and recommended for everyone else; the 2024 Decision 1290 principles were fully voluntary.
