Thailand's AI law and the PDPA amendment are not yet in force: as of 11 September 2026 no Artificial Intelligence Act had been published in the Royal Gazette, and the amendment bill was still at public consultation. The team's notes are forecasts, not legal text. This is for DPOs and executives who get what to prepare now, such as an AI inventory, a named overseer and logging.
- As of 11 September 2026 no Thai AI Act was in the Royal Gazette; only ETDA's draft principles and a 93-respondent consultation exist.
- The team's forecast: Thailand regulates only prohibited and high-risk AI, with sector regulators publishing their own high-risk lists.
- The MPs' PDPA bill amends Section 4(2), adds a 'State agency' definition to Section 6 and rewrites Section 24, making consent basis (7).
- The PDPA of 2019 remains in force in every section. Do not change your RoPA or documents to match the bill; track it instead.
- Best value now: an AI inventory, a role per system, a named overseer, AI logs, and telling people when AI decides about them.
The question reaching the AIPDPA team most often lately is a double one: has Thailand passed its AI law, and is the PDPA about to change? The short answer is no on both counts. That does not mean organisations should sit and wait.
This article draws on two notes the team keeps in its knowledge base. The first reads the direction of the draft AI law from documents published by the Electronic Transactions Development Agency (ETDA). The second tracks a bill, tabled by members of the House of Representatives, to amend the Personal Data Protection Act B.E. 2562 (2019). We then tie each suggested step to the PDPA as it stands, so that whatever you do today has a real legal footing.
How far has Thailand's AI law actually got?
Not as far as statutory text. As of 11 September 2026, when the team wrote its note, no Artificial Intelligence Act had been published in the Royal Gazette and no section-by-section draft had been released to the public.
Three documents genuinely exist: ETDA's draft principles for an AI law, an annex explaining them, and a summary of a public consultation that drew 93 respondents between 10 May and 24 June 2025. Between principles and an Act sit the Council of State and Parliament, and either can change the substance a great deal.
Press reports said the bill would go to Parliament in September 2026. The team note flags that this date comes from the press, not from any official document. If you are budgeting or negotiating contracts around a date, wait for the Royal Gazette.
no penalty figures, commencement date or transition period exist anywhere
Treat that line as a filter. If a vendor tells you the Thai AI Act will fine you a certain amount or bite on a certain date, ask for the source document. The team found no such figure in any published material.
What the team expects the Act to look like
The five points below come from principles that won more than 85% agreement in the consultation, which is why the team rates them most likely to survive into the Act. They remain forecasts.
- Risk-based, with only two tiers: prohibited and high-risk. Most AI would not be regulated by the Act at all.
- The Act itself would not list high-risk systems. Sector regulators such as the Bank of Thailand, the SEC, the OIC and the FDA would issue their own secondary rules.
- Providers of high-risk AI would owe a risk-management duty, benchmarked on ISO/IEC 42001:2023 and the NIST AI RMF.
- Deployers would carry their own duties: human oversight, logging, input-data quality, informing affected people and cooperating with inspections.
- Foreign providers would need a legal representative in Thailand, an idea 75 of 89 respondents called necessary.
Point four matters most to Thai organisations. Most do not build models; they buy or rent them, which makes them deployers. The exception is a company that fine-tunes a model itself or offers AI to its own customers. The team note warns that such a company may become a provider, with much heavier duties.
| Issue | EU AI Act | Expected Thai bill |
|---|---|---|
| Risk tiers | Four | Two: prohibited and high |
| Who decides what is high-risk | The Regulation itself (Annexes I and III) | Secondary rules from each sector regulator |
| Central body | AI Office and AI Board at Union level | A coordinator; assumed to be ETDA, but no document says so |
| Penalties | Administrative fines under Article 99 | Administrative (pinai) fines for prohibited AI; high-risk unresolved; no figures |
| Generative AI | A dedicated chapter | Undecided (67 of 89 respondents favoured regulating it) |
What would the MPs' PDPA amendment change?
Three things. The bill is a draft Personal Data Protection Act (No. ..) tabled by a group of members of the House of Representatives. When the team wrote its note, it was out for public comment under Section 77 of the Constitution and had not passed any reading.
- Section 4(2): widen the public-sector exemption to cover the prevention and suppression of corruption and misconduct.
- Section 6: add a definition of 'State agency'. The final wording is still unsettled.
- Section 24: repeal and rewrite it, moving from 'no collection without consent, unless…' to 'processing is lawful where at least one basis applies', with consent becoming basis (7).
Businesses would feel the third change most, because it reframes how every legal basis is chosen. Here is how Section 24 opens today.
The Data Controller shall not collect Personal Data without the consent of the data subject, unless:
Read that way, consent looks like the rule and the other six bases look like exceptions. The bill would put all bases on an equal footing, closer to the GDPR's list of lawful bases. The team also noticed that the bill uses a new term, 'personal data processing controller', which does not appear in the current Act.
| Basis | PDPA 2019 (in force) | Bill |
|---|---|---|
| Public task / official authority | (4) | (1) |
| Archives, research, statistics | (1) | (2) |
| Vital interests | (2) | (3) |
| Contract | (3) | (4) |
| Legitimate interests | (5) | (5) |
| Legal obligation | (6) | (6) |
| Consent | The default rule, outside the Section 24 list | (7) |
The Personal Data Protection Act B.E. 2562 (2019) remains in force in every section.
The same note advises against changing registers, documents or customer notices now. Many private members' bills fail at first reading or are amended beyond recognition. The one sensible action is to watch the bill on Parliament's information system and keep an impact list ready.
If it does pass, almost every basis number in Section 24 moves. Labels such as 'Section 24(4)' in your RoPA, privacy notices and forms would change from the date the amendment takes effect, not retroactively. Consent forms would also have to stop saying 'consent is required unless…'.
Where do the two drafts meet?
They meet at one point: using personal data for AI, and in particular taking data collected for one purpose to train or test a model.
One of the draft AI principles would let organisations in a regulatory sandbox reuse personal data collected for another purpose to develop or test AI in the public interest. The team note reads this as an exception to the PDPA's purpose-limitation rule, and warns that until a law actually provides for it, doing so still breaches the PDPA.
The collection, use, or disclosure of Personal Data shall not be conducted in a manner that is different from the purpose previously notified to the data subject in accordance with paragraph one, unless:
Section 21 leaves two doors open: tell people about the new purpose and get their consent first, or rely on a provision of the PDPA or another law. A sandbox rule in a future AI Act would be such 'other law'. It does not exist yet, so a company that wants to train a model on customer chats or staff records still has to go through Section 21 as it stands.
Incident reporting is the second meeting point. The team expects the AI Act to require serious AI incidents to be reported to a state body, separately from personal data breach notification to the Office of the Personal Data Protection Committee (PDPC Office). 'Serious incident' is still undefined, so one event may one day need several reports. What already applies today is PDPA Section 37(4).
notify the Office of any Personal Data breach without delay and, where feasible, within 72 hours after having become aware of it
If an AI system leaks customer data, the 72-hour deadline in Section 37(4) applies now, with no need to wait for an AI law. The step-by-step sequence is in our article on the first 72 hours after a breach.
What can you prepare now without wasting effort, whatever the Act says?
Do work that already pays off under the PDPA and carries over if an AI Act arrives. The team note ranks seven steps by value; we added a column showing how each one helps with the PDPA in force.
| Step | Why now | How it helps under the PDPA today |
|---|---|---|
| Inventory every AI system in use | When regulators publish high-risk lists, you can see at once what applies to you | Shows which systems process personal data, for the Section 39 record of processing |
| Classify your role per system: provider or deployer | Fine-tuning or reselling AI can make your duties much heavier | Pairs with deciding whether you are controller or processor for each activity |
| Name an individual overseer, not a department | Systems that decide about people — hiring, credit, insurance — need an identifiable owner | Someone owns data subject requests and objections |
| Turn on AI logs and set a retention period | Logs cannot be created after the fact; without them there is nothing to inspect | Evidence of security measures and incident investigation under Section 37 |
| Tell people when AI is part of a decision about them | The right to be informed drew strong support and is the cheapest to deliver | Fold it into the Section 23 notice |
| Run a gap analysis against ISO/IEC 42001 or the NIST AI RMF | Both are named directly in the principles | Doubles as the review of security measures under Section 37(1) |
| Review contracts with foreign AI providers | Allocation of responsibility between deployer and provider is unanswered in the principles | Check processor terms and cross-border transfer arrangements |
Each step answers several laws at once. The team note points out that the ISO/IEC 42001 risk-management duty overlaps with PDPA Section 37 security measures and, for critical information infrastructure operators, with the Cybersecurity Act B.E. 2562 (2019). One control set covering all three costs less than three separate ones.
In AIPDPA, steps one to five live in the AI registry together with AI Risk Radar, which maps each system against Thai law, the NIST AI RMF, ISO 42001 and the EU AI Act on one screen, plus a checklist for the PDPC's AI guideline. If you are not sure where you stand, start with the free AI risk check.
Guidance you can use while the Act is pending
The team note points to four ETDA guidelines that already exist: one for executives, a draft playbook for ethical impact assessment, one on generative AI for organisations, and one on job redesign. None is law, but they come from the same agency that drafted the AI principles, which makes them the best available signal of intent.
For a workplace AI policy, see how to write a generative AI policy. For a management system, see getting started with ISO/IEC 42001. If your customers or your outputs reach Europe, continue with the EU AI Act for Thai companies.
Which claims should you not believe yet?
We set common claims against what the team notes actually found. Each card says how far the claim holds and what to do about it.
The team found no penalty figure, commencement date or transition period in any published document.
No document names the enforcing body. The assumption rests on ETDA drafting the principles and hosting the AI governance centre.
Under the 2023 draft definition they could fall outside entirely. The final definition is not out.
The bill has passed no reading and the 2019 Act applies in full. Changing now would make your records wrong under the law in force.
The sandbox exception exists only as a principle. Section 21 still requires notice and consent, or a law permitting the new use.
Both were sent back for review and merged into a single bill covering promotion and regulation.
What happens to these notes when the real laws arrive?
The forecast note will never be edited into statutory text. When an AI Act is published, a person will transcribe it from the Royal Gazette into the knowledge base as a separate document. The old note stays, so anyone can check what the team expected and where it was wrong.
The PDPA amendment follows the same rule. If it passes, the amended text goes into the existing file for the 2019 Act section by section, with its effective date. No new statute file is created, because Thai amendments change individual sections rather than creating a new Act.
Frequently asked questions
Is Thailand's AI Act in force?
As of 11 September 2026, when the AIPDPA team note was written, no Artificial Intelligence Act had been published in the Royal Gazette. Only ETDA's draft principles, an annex and a consultation summary exist. Check the Royal Gazette yourself before treating any AI law as in force.
Does the PDPA amendment remove the need for consent?
No, and the bill has no effect at all yet. It would only move consent to become one of seven bases in a rewritten Section 24. Meanwhile the 2019 Act, including Section 19 on consent and Section 24, applies unchanged.
We let staff use ChatGPT. What should we prepare for the AI Act?
The team expects heavy duties to fall on high-risk systems named by sector regulators, so everyday use may not be caught. The PDPA already governs personal data typed into AI tools today. See staff pasting customer data into ChatGPT.
Will foreign AI providers need a representative in Thailand?
The team note expects so, given strong consultation support, but it is not law. What does apply now is PDPA Section 37(5): a controller outside Thailand caught by Section 5 paragraph two must appoint a representative in Thailand in writing.
If we can do only one thing, what should it be?
Build an inventory of the AI systems you use: what each does, who owns it, whether it uses personal data and whom it affects. It feeds your PDPA record of processing immediately and underpins anything an AI Act may later require.
Law and sources
- Forecast note on the draft Thai Artificial Intelligence Act (AIPDPA team note, not law, not enacted)
- Tracking note on the draft amendment to the Personal Data Protection Act (AIPDPA team note, not law, not enacted)
- Personal Data Protection Act B.E. 2562 (2019) — Section 21 · Section 24 · Section 37 (4)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)