How the EU AI Act affects Thai businesses: who is in scope and what to do when

A document-processing (BPO) company in Chiang Mai uses AI to score loan applications and sends the results to a bank client in Europe. One day the client sends a questionnaire asking, 'Has your system been classified under the EU AI Act?' The owner wonders how a European law could possibly apply to a Thai company.

What you need to know

The 6 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.

• A Thai company using AI purely at home with Thai customers is out of scope: scope follows the EU market and where output is used, not where the company is based.
• The Article 5 prohibitions and the Article 4 AI literacy duty have applied since 2 February 2025, and the Article 50 transparency duties since 2 August 2026.
• New prohibitions on non-consensual sexual imagery of identifiable people and on child sexual abuse material take effect on 2 December 2026.
• Duties attach to your role for each system. One company can be the provider of one system and the deployer of another.
• Under Article 25, a deployer can become the provider of a high-risk system by putting its own name on it, substantially modifying it or changing its purpose.
• This article summarises the AIPDPA team's applied guide, not the legal text. Real cases should be checked by counsel familiar with EU law.

↑ Back to contents

How to do it in 7 steps

Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.

1. Answer the first question: are we in scope?Work through the Article 2(1) routes that reach Thai firms, such as selling or offering an AI system in the EU, sending output for use in the EU, having an EU branch, or exporting products with embedded AI under your own brand. Then ask your EU clients: 'What decisions do you make with our output, and about whom?'
2. Register each AI systemRecord each system's name, purpose, users, upstream provider and where its output goes. Both role allocation and risk classification are done system by system, not for the company as a whole.
3. Assign your role per systemAsk whose name the system goes out under. If it is yours, even if someone else built it, you are the provider under Article 3(3). If you decide which tasks and people the system is used for, you are the deployer under Article 3(4).
4. Check prohibitions and transparency dutiesConfirm that no system falls under the Article 5 prohibitions, which already apply, and prepare for the Article 50 transparency duties. If you offer AI image generation, check your safeguards before the new prohibitions take effect on 2 December 2026.
5. Classify risk and plan for high-risk dutiesSystems listed in Annex III, such as recruitment screening or credit scoring of individuals, must meet the Chapter III duties by 2 December 2027. The team's guide recommends planning to the earlier date wherever the interpretation is unclear.
6. Close the Article 25 trap in your contractsBefore repurposing or fine-tuning a system, log the change in your registry. In contracts with upstream providers, state whether the system may or may not be used for high-risk purposes, and request the information listed in Article 25(2)(a)–(c) in advance.
7. Put AI literacy measures in placeAmended Article 4 requires measures that support staff AI literacy, without guaranteeing any individual's level of knowledge. It is still a duty, so keep a training plan and records.

↑ Back to contents

Does the EU AI Act apply to Thai companies?

Yes, if you fall within one of the Article 2(1) routes, even without an EU office. The EU AI Act is an EU Regulation: it is not law in Thailand and Thai authorities cannot enforce it, but its scope follows the EU market and where output is used, not a company's nationality or location.

The route Thai firms most often miss is Article 2(1)(c), which covers providers and deployers in third countries when the output of their system is used in the EU. The company is not selling AI to anyone; it uses AI in Thailand and sends the results to people in the EU.

• Article 2(1)(a): providers placing AI systems on the EU market or putting them into service there, wherever they are based, such as a Thai software firm selling recruitment-screening SaaS to clients in Germany.
• Article 2(1)(c): providers and deployers in third countries whose output is used in the EU, such as a Thai BPO sending credit scores to an EU bank.
• Article 2(1)(b): deployers established in the EU, such as the EU branch or subsidiary of a Thai group.
• Article 2(1)(d)–(e): importers, distributors and manufacturers shipping products with embedded AI under their own name.
• Article 2(1)(f): authorised representatives must be based in the EU, so a Thai company appoints one rather than acting as one.

↑ Back to contents

When does the EU AI Act apply?

The Act entered into force on 1 August 2024 and applies in stages under Article 113. Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, rewrote that timetable, so documents and checkers prepared before July 2026 still show the old dates.

• 2 February 2025: general provisions, including Article 4, and the Article 5 prohibitions.
• 2 August 2025: general-purpose AI model duties, governance and penalties.
• 2 August 2026: general application, including Article 50 transparency.
• 2 December 2026: new prohibitions in Article 5(1)(ba) and (bb).
• 2 December 2027: high-risk duties for Annex III systems, including Articles 26 and 27, the main deadline for deployers.
• 2 August 2028: high-risk duties for AI in products covered by Annex I.

↑ Back to contents

Is a Thai company a provider or a deployer?

It depends on the system, not the company. A firm that calls a model through an API and sells an app under its own name in the EU is the provider of that AI system, and a downstream provider under Article 3(68), not a deployer.

Article 25(1) sets out three situations in which a distributor, importer, deployer or other third party is treated as the provider of a high-risk system and takes on all the Article 16 duties.

• Putting its own name or trademark on a high-risk system already on the market, such as reselling a credit-scoring system in the EU under your own brand.
• Substantially modifying a high-risk system already on the market, where it remains high-risk.
• Changing the purpose of an AI system, including a general-purpose one, so that it becomes high-risk, such as turning a chatbot into a job-applicant screening tool.

↑ Back to contents

What does not get you out of the EU AI Act?

Common lines such as 'we only buy the service', 'we don't collect personal data' or 'our servers are in Thailand' do not remove your duties. The real exceptions are only those in Article 2.

• Military, defence and national security (Article 2(3)).
• Systems developed and used solely for scientific research and development (Article 2(6)).
• Research, testing and development before market placement, although testing in real-world conditions is not exempt (Article 2(8)).
• Individuals using AI for purely personal, non-professional activity (Article 2(10)).
• Open-source systems, unless they are high-risk or fall under Article 5 or 50 (Article 2(12)).

↑ Back to contents

Common problems and how to fix them

Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.

↑ Back to contents

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)