The EU AI Act applies to a Thai company only when Article 2(1) reaches it, which is when AI systems are placed on the EU market or their output is used in the EU. Using AI only with Thai customers is out of scope. This is for executives and legal teams, and gives the scope test and the 2 December 2027 postponement of Annex III high-risk duties.
- The EU AI Act does not bind Thai companies directly. It reaches them only through Article 2(1), which ignores where a company is registered.
- The route most often missed is Article 2(1)(c): you use AI in Thailand, but the output is used in the EU.
- Duties attach to your role per system. A deployer becomes a provider by rebranding or repurposing a system into high-risk use (Article 25).
- Article 5 prohibitions have applied since 2 February 2025; Annex III high-risk duties now start on 2 December 2027.
- Our corpus text is a team-built consolidation, not EUR-Lex's official one. The Official Journal text is the authentic version.
Picture two Thai companies. One sells a CV-screening system to customers in Germany. The other is an online shop that answers Thai customers with a chatbot. They may even run the same underlying model, yet only the first needs to read the EU AI Act closely.
The deciding factor is neither the technology nor where the company sits; it is where the system, or its output, is used. This article works from the text of Regulation (EU) 2024/1689 as consolidated with Regulation (EU) 2026/1744 in the AIPDPA knowledge base. The original is in English, so we quote it verbatim.
When does a Thai company fall within the EU AI Act?
When it is a provider placing an AI system on the EU market or putting it into service there, or when output produced by its AI system is used in the EU. Those are points (a) and (c) of Article 2(1).
(a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;
The phrase that matters is 'irrespective of whether those providers are established or located within the Union or in a third country'. Location is irrelevant: put a system on the EU market and you are in. A Thai SaaS vendor with European customers cannot argue its way out on the basis that it has no office there.
(c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;
Point (c) is the one Thai companies overlook. The company sells no AI; it simply uses AI in Thailand and hands the results to someone in the EU. The team guide's example is a Thai BPO scoring loan files with AI for a European bank. The question to put to your European client is blunt: what do you use our output to decide, and about whom?
a Thai company using AI purely domestically with Thai customers is out of scope
The hypothetical scenarios below show where the line falls. They are illustrations, not real cases.
A provider placing a system on the EU market under Article 2(1)(a); recruitment screening is listed in Annex III point 4 on employment.
Output used in the EU under Article 2(1)(c); creditworthiness assessment of individuals is Annex III point 5(b).
Deployers established in the EU fall under Article 2(1)(b). The EU entity is the deployer; the Thai parent must be assessed separately by role.
No placing on the EU market and no output used in the EU. The PDPA still governs its customer data.
Article 2(8) excludes research, testing and development before placing on the market, but testing in real-world conditions is not excluded.
Three excuses that are not exclusions
- 'We only buy the service' does not remove deployer duties.
- 'We hold no personal data' does not escape Article 5 or Annex III, because the Act regulates systems, not data.
- 'Our servers are in Thailand' is irrelevant if the output is used in the EU.
The team guide collected these from misunderstandings it meets often. They are the team's reading of Article 2, not words from the Regulation.
Are we a provider or a deployer?
Answer system by system, not once for the whole company. The same business can be the provider of one system and the deployer of another, and the duties of the two roles differ sharply.
(4) ‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;
Most Thai companies are deployers: they use a system under their own authority. A provider, under Article 3(3), develops a system or has it developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
The trap is Article 25. A deployer can become a provider without noticing, and then takes on all of the provider obligations in Article 16.
(c) they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6.
The team guide's warning example: a Thai firm builds a recruitment-screening tool for European clients on top of a general-purpose model and still thinks of itself as a mere user. Article 25(1) has two further triggers: putting your name or trademark on a high-risk system already on the market, and making a substantial modification to one.
A Thai provider of a high-risk system must, under Article 22(1), appoint by written mandate an authorised representative established in the EU before making the system available on the EU market. The representative has to sit in the EU, so the Thai company appoints one; it cannot act as one.
Which risk tier is our system in?
Work down from the heaviest tier and stop at the first one that fits.
- Prohibited practices (Article 5): for example manipulative or deceptive techniques causing significant harm, social scoring, inferring emotions in the workplace or in education (except for medical or safety reasons), and building facial recognition databases by untargeted scraping of the internet or CCTV.
- High-risk (Article 6 and Annex III): eight areas — biometrics, critical infrastructure, education, employment, access to essential services such as credit and life or health insurance, law enforcement, migration, and justice and democratic processes.
- Transparency duties (Article 50): chatbots must tell people they are dealing with AI, and deployers of deep-fake generators must disclose that content is artificial.
- Everything else: no tier-specific duty, though Article 4 on AI literacy still applies to providers and deployers.
Article 6(3) lets an Annex III system escape the high-risk label where it poses no significant risk to health, safety or fundamental rights, for example when it performs a narrow procedural task or a preparatory one. The last subparagraph of Article 6(3) closes that door for systems that assess people.
Notwithstanding the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons.
A system that profiles individuals — scoring job candidates or loan applicants, for instance — cannot use the Article 6(3) derogation. A provider that believes its Annex III system is not high-risk must document that assessment before placing it on the market, under Article 6(4).
The transparency tier hits Thai firms that build chatbots or image apps used by people in the EU. The first duty sits with whoever designs the system.
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
Article 50(4) separately requires deployers of systems that generate or manipulate deep-fake image, audio or video content to disclose that it is artificial, and Article 50(5) requires the information to be given clearly at the latest at the first interaction or exposure.
By when do we need to be ready, after the 2026 amendment?
The 2024 calendar is out of date. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026, entered into force on 27 July 2026 and rewrote Article 113. The text in our knowledge base already includes those changes.
- 2 Feb 2025Chapters I and II apply: general provisions including Article 4, and the prohibitions in Article 5 points (a) to (h)Article 113(a)
- 2 Aug 2025General-purpose AI models (Chapter V), governance (Chapter VII) and penalties (Chapter XII), except Article 101Article 113(b)
- 27 Jul 2026Regulation (EU) 2026/1744 in force; Articles 102 to 110 applyArticle 113(d)
- 2 Aug 2026General date of application, including Article 50 transparency dutiesArticle 113, second paragraph
- 2 Dec 2026New prohibitions in Article 5(1)(ba) and (bb): non-consensual intimate imagery of identifiable people and child sexual abuse materialArticle 113(a)
- 2 Dec 2027High-risk duties for Article 6(2) and Annex III systems (Chapter III Sections 1 to 3, including Article 26)Article 113(c)(i)
- 2 Aug 2028High-risk duties for Article 6(1) and Annex I product systemsArticle 113(c)(ii)
(i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
If we are in scope and get it wrong, what happens?
Article 99 leaves penalty rules to each Member State but caps administrative fines in the Regulation itself, and requires the interests and economic viability of SMEs to be taken into account. The highest cap applies to the prohibitions.
Non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
Breaches of deployer obligations under Article 26 and transparency obligations under Article 50 fall in a lower band under Article 99(4): up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. These are ceilings, not standard rates.
Where do the EU AI Act and the PDPA think alike?
On reach beyond borders they are close. Thailand's PDPA does not stop at where a company is based either; it follows foreign controllers whose activities target people in Thailand.
In the event that a Data Controller or a Data Processor is outside the Kingdom of Thailand, this Act shall apply to the collection, use, or disclosure of Personal Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data Controller or Data Processor are the following activities:
The two laws still ask different questions. The PDPA asks whether personal data is collected, used and disclosed lawfully. The EU AI Act asks which tier a system sits in and who in the supply chain must do what. A system that processes Thai people's data and sends results for use in the EU may have to answer both at once.
| Issue | PDPA (Thailand) | EU AI Act |
|---|---|---|
| What it regulates | Collection, use and disclosure of personal data | AI systems and general-purpose AI models, by role and risk tier |
| Reach outside its territory | Offering goods or services to, or monitoring, people in Thailand (Section 5 paragraph two) | Placing on the EU market, or output used in the EU (Article 2(1)) |
| No personal data at all | Out of scope | Can still be caught under Article 5 or Annex III |
| Local representative | A representative in Thailand under Section 37(5) | An authorised representative in the EU under Article 22, for high-risk systems |
| Sensitive data for bias testing | Needs a Section 26 basis | Article 4a permits it under conditions, but creates no PDPA basis (team note) |
| Incident reporting | Personal data breach to the PDPC Office within 72 hours where feasible (Section 37(4)) | A deployer that identifies a serious incident informs the provider first, then market surveillance authorities (Article 26(5)) |
Where should a Thai company start?
Know what systems you have before you ask about scope. The team's notes on the Digital Omnibus draw one lesson for companies: plan around duties that do not change, not around dates. Dates can move; the core work of an inventory, oversight, impact assessment, logs and informing affected people stays the same.
- Build an AI inventory and ask, system by system, whether the system or its output reaches the EU.
- Record your role per system and check for rebranding, modification or repurposing under Article 25.
- Classify in order: Article 5, then Annex III, then Article 50, and write down the reasons.
- If you provide a high-risk system, prepare to appoint an EU representative under Article 22 and plan to finish before 2 December 2027.
- Put AI literacy measures in place for staff who operate the systems, under Article 4, which already applies.
- Ask European clients what they decide with your output, and allocate each party's duties in the contract.
- Once an assessment says you are in scope, have EU counsel interpret the points the text leaves open.
In AIPDPA, the AI registry works together with AI Risk Radar, which maps each system against the EU AI Act, Thai law, the NIST AI RMF and ISO 42001, so one register serves several frameworks. Even so, the registry's risk score is not a legal classification under EU law; someone in your organisation still has to confirm the tier and record why.
For a short version to share with management, read how the EU AI Act affects Thai businesses. If you use AI in HR, see AI in hiring and staff evaluation. For where Thailand's own AI law stands, read Thailand's AI bill and PDPA amendment.
Frequently asked questions
Does a Thai company with no EU branch have to comply with the EU AI Act?
Yes, if it falls within Article 2(1): for example as a provider placing an AI system on the EU market, which point (a) covers wherever the provider is established, or where its system's output is used in the EU under point (c). If no case applies, the Act does not bind the company.
Are Thai companies whose staff use ChatGPT covered?
If the use is in Thailand and the output is not used in the EU, the team guide considers it out of scope. The PDPA still governs any personal data staff type in. See staff pasting customer data into ChatGPT.
When do the high-risk obligations apply?
Under Article 113 as amended by Regulation (EU) 2026/1744: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems. The Article 5 prohibitions have applied since 2 February 2025.
Does ISO/IEC 42001 certification mean we comply with the EU AI Act?
No. The team guide notes that ISO certification is not an Article 43 conformity assessment. An ISO/IEC 42001 management system does, however, generate much of the evidence the Act expects.
Was Article 4 on AI literacy repealed?
No. The amended Article 4 requires providers and deployers to take measures to support their staff's AI literacy and states expressly that no specific level of literacy must be guaranteed for any individual.
Law and sources
- Regulation (EU) 2024/1689 (EU AI Act), consolidated with Regulation (EU) 2026/1744 — EU law, not binding in Thailand — Article 2(1) · Article 3(4) · Article 6(3) · Article 25(1) · Article 50(1) · Article 99(3) · Article 113
- Applying the EU AI Act in Thai organisations (AIPDPA team guide, not law) — Clause
- Background documents and case notes on the EU AI Act (AIPDPA team notes, not law)
- Personal Data Protection Act B.E. 2562 (2019) — Section 5, para. 2
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)