How to write a Generative AI use policy for your organisation in Thailand A Generative AI use policy should answer four questions: what staff may use it for, what data they must never enter, who checks the output before it is used, and who is accountable. A ready framework is ETDA's Generative AI Governance Guideline for Organizations, together with ETDA's AI Governance Guideline for Executives, which organises governance into structure, strategy and operations. Both are guidance, not law.
At a mid-sized distributor in Bangkok, marketing uses Generative AI to write posts every day, and the accounts team quietly uploads financial statements for AI summaries. One day the managing director receives a report quoting figures that don't exist, and realises the company has not a single line of rules on AI.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- ETDA's Generative AI guideline states that not following it, or following it only in part, is not a breach of the law, so it is a voluntary framework you can adapt.
- The guideline for executives splits AI governance into three components: AI Governance Structure, AI Strategy and AI Operation.
- The guideline groups the benefits of Generative AI into six areas, from ideation and content creation to source code and multimedia.
- The limits your policy must address include hallucination, bias, out-of-date information and the difficulty of explaining outputs.
- The guideline stresses that Generative AI output cannot replace expert advice in fields such as law or medicine.
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Find out who uses which toolsList the Generative AI tools staff actually use and what they use them for, such as writing, summarising or coding. Your policy should match real behaviour, not assumptions.
- Define permitted uses by the six benefit areasUse ETDA's six areas as categories: ideation and content creation, information discovery, content refinement, data analysis and recommendations, source code, and multimedia. State the conditions for each.
- Set rules on what may be enteredA good practice is to ban entering customer personal data, sensitive data and trade secrets into any tool the organisation has not approved, and to set a route for requesting exceptions.
- Require human review of outputBecause Generative AI can hallucinate and may not have current information, users must check facts, figures and sources before use, and must never treat the output as a substitute for legal or medical advice.
- Name an owner and a tool approverThe guideline for executives recommends an AI Governance Council that sets policy, monitors and evaluates AI use. A small company can start with one named person, as long as it is clear who approves new tools.
- Train staff and record acknowledgementThe guideline for executives emphasises awareness of each role's responsibility and accountability. Train staff, test their understanding and keep evidence that each person has acknowledged the policy.
- Review on a scheduleThe AI Operation component covers monitoring and evaluation for continuous improvement. A good practice is to review the policy and the approved tool list at least once a year and whenever a new tool or use case appears.
What should a Generative AI policy include?
A workable policy needs at least six parts: purpose and scope, permitted uses, prohibited data, human review of output, ownership and tool approval, and training and review. This structure maps onto the three components in ETDA's guideline for executives.
- Purpose and scope: which business goals Generative AI serves and who the policy covers.
- Permitted uses: grouped by the guideline's six benefit areas, with conditions for each.
- Prohibited data: personal data, sensitive data and trade secrets, unless specifically approved.
- Output review: who checks, what they check, and which work needs an expert's sign-off.
- Ownership: the person or council responsible for AI and the approval process for new tools.
- Training and review: how often, how understanding is measured and how evidence is kept.
What Generative AI risks does the policy need to cover?
ETDA's AIGC guideline lists seven limitations organisations should plan for. The most common is hallucination, where the tool produces an answer that sounds reasonable but is factually wrong, such as recommending shares in a company that does not exist.
- Hallucination: convincing answers that are factually wrong.
- Critical thinking and judgement: text is generated by predicting the next word, so conclusions can be flawed.
- Sensitive or ethical context: output can be biased or lead to discrimination.
- Domain expertise: it cannot replace legal, medical or other expert advice.
- Personal experience and context: it lacks human experience and emotion.
- Real-time information: it may give outdated answers, such as citing a law that is no longer in force.
- Explainability: the inner workings of the model are hard to explain.
Is ETDA's Generative AI guideline legally binding?
No. The guideline itself says that not following it, or adopting only part of it, is not a breach of any law or related requirement. It was written for both public and private organisations to adapt as they see fit.
It builds on ETDA's AI Governance Guideline for Executives, which in turn draws on the Thailand AI Ethics Guideline. That document was prepared by the Office of the National Digital Economy and Society Commission, endorsed by the Cabinet on 2 February 2021, and sets out six AI ethics principles.
Who should own the AI policy in a company?
ETDA's guideline for executives recommends an AI Governance Council that sets strategy and policy and continuously monitors and evaluates AI use, with clearly defined roles and responsibilities for staff and other stakeholders.
Beyond the structure, the guideline asks organisations to provide resources, build skills and raise awareness of each role's responsibility and accountability for outcomes.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ The policy is just a list of bans, so staff quietly switch to personal accounts. | ✓ Spell out permitted uses by the six benefit areas and set conditions instead of blanket bans. AIPDPA includes a ready-to-use workplace AI tools policy and an AI registry that keeps every tool actually in use in one place. |
| ✗ Staff trust AI output without checking, and wrong figures or legal points reach customers. | ✓ State in the policy which work must be reviewed and by whom, then train staff on hallucination. AIPDPA's staff quiz shows whether everyone really understands the rules and keeps the results as evidence. |
| ✗ The policy is signed off, but nobody tracks the risk of new tools. | ✓ Name an owner and a review cycle. In AIPDPA, every registered AI system runs through the AI Risk Radar, which checks it against Thai law, NIST, ISO 42001 and the EU AI Act, alongside an ETDA-based checklist. |
A ready-to-use AI policy, with a registry and staff quiz built in
AIPDPA brings together an AI registry, the AI Risk Radar, an ETDA-based checklist, a workplace AI tools policy and a staff quiz in one place. See the demo account today, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Does a small company need a Generative AI policy?
ETDA's guideline is guidance, not a legal requirement. But if staff already use tools such as ChatGPT, Claude or Gemini, a one-page policy sets out which data must never be entered and who must check the output.
Can we use ChatGPT with customer data?
A good practice is not to enter customer personal data into any tool the organisation has not assessed and approved. If you need to, assess the privacy risk first and keep a record of the approval.
What is an AI hallucination?
It is when Generative AI produces an answer that sounds reasonable but is factually wrong. ETDA's guideline gives the example of a user advised to invest in shares of a company that does not exist.
How often should a Generative AI policy be reviewed?
The guideline sets no fixed frequency, but the guideline for executives stresses continuous monitoring and evaluation. A good practice is to review at least once a year and whenever a new tool or use case is introduced.
Where do Thailand's AI ethics principles come from?
From the Thailand AI Ethics Guideline, prepared by the Office of the National Digital Economy and Society Commission under the Ministry of Digital Economy and Society and endorsed by the Cabinet on 2 February 2021. It sets out six principles.
Sources
This guide relies on 2 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Generative AI Governance Guideline for Organizations — AI Governance Center (AIGC), Electronic Transactions Development Agency (ETDA) (guidance, not law)
- AI Governance Guideline for Executives — Electronic Transactions Development Agency (ETDA) (guidance, not law)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
An AI registry and AI Risk Radar against Thai law, NIST, ISO 42001 and the EU AI Act, plus a workplace AI-use policy.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →An AI-use risk review and an AI governance setup for your organisation.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.