As of 18 October 2026, Thailand has no AI-specific law in force. What already binds organisations is the Personal Data Protection Act B.E. 2562 (PDPA) and existing law such as consumer protection, copyright and civil liability. The latest change: the Office of the Personal Data Protection Committee (PDPC Office, สคส.) published the final version of its AI personal data protection guideline on 7 Oct 2026, and it was published in the Royal Gazette (ราชกิจจานุเบกษา) on 2 Nov 2026. The document itself says it has no legal force. But it shows clearly how the regulator views AI use. For example, entering personal data into public AI is high risk. Meanwhile, public consultation on the draft Artificial Intelligence Act (ร่าง พ.ร.บ. ว่าด้วยปัญญาประดิษฐ์) of the Electronic Transactions Development Agency (ETDA, สพธอ.) closed on 14 Aug 2026, and we have found no Cabinet resolution on it yet. The draft proposes risk-based tiers, joint liability without proof of fault, and fines of THB 1–5 million. The financial sector has had a Bank of Thailand (BOT, ธปท.) policy guideline on AI risk since 12 Sep 2025. This article has a status table for each document, a timeline of the draft law, what the draft contains, and a checklist that links each task to its source document.
This article is a practical overview to help you prepare. It is not legal advice. The status of draft laws can change. Check the latest status, and consult your legal adviser about your own case.
Status as of 18 Oct 2026: what is binding, what is guidance, what is still a draft
| Document | Issued by · date | Status | Applies to |
|---|---|---|---|
| Personal Data Protection Act B.E. 2562 (PDPA) | Published in the Royal Gazette, 27 May 2019 | In force | Every organisation that collects, uses or discloses personal data |
| Guidelines on personal data protection in the development and use of AI technology (version 1.0) | The Personal Data Protection Committee (คณะกรรมการคุ้มครองข้อมูลส่วนบุคคล) under section 16(3) of the PDPA, prepared by the PDPC Office with ETDA · published 7 Oct 2026 · published in the Royal Gazette 2 Nov 2026 | Guidance, no legal force | Data controllers and data processors that develop or use AI |
| BOT policy guidelines on risk management for the use of AI systems (ว. 5994/2568) | Bank of Thailand · 12 Sep 2025 (B.E. 2568) | Policy guidance for reference, used alongside the IT risk requirements already in force | Financial institutions and service providers the BOT supervises |
| Draft Artificial Intelligence Act | ETDA · public consultation closed 14 Aug 2026 | Draft, no Cabinet resolution found yet | AI developers, providers and organisations that deploy AI, including foreign providers |
| Guideline on applying generative AI with good governance for organisations | Ministry of Digital Economy and Society (MDES, กระทรวงดีอี) with ETDA · 30 Oct 2024 | Voluntary guidance | Executives and staff of organisations |
| Guideline on applying AI with good governance for organisational executives | ETDA · first edition 2023 · on 24 Aug 2026 the National Digital Economy and Society Committee (คณะกรรมการดิจิทัลเพื่อเศรษฐกิจและสังคมแห่งชาติ) had it trialled in agencies under MDES | Guidance, being trialled in the public sector | Organisational executives |
Having no AI-specific law does not mean there is a legal vacuum. The PDPA already binds every use of AI that touches personal data, and it carries real penalties. The duties are set out in PDPA and AI use in organisations.
The PDPC Office's final AI guideline
The PDPC Office opened the draft for comment on 19–25 Feb 2026. It published the final version 1.0, 80 pages long, on its website on 7 Oct 2026. The guideline was then published in the Royal Gazette, vol. 143, special issue 261 ง, on 2 Nov 2026. The Royal Gazette version is still version 1.0, and it still states that it "has no legal force and no binding effect in the consideration of offences". But it is the regulator's own explanation of how the PDPA applies to AI work. These are the points that most affect organisations that use AI in daily work.
- Entering personal data into public generative AI is high risk. It may amount to unlawful disclosure of data. The guideline recommends a policy that bans such input, or using enterprise versions backed by a data protection agreement.
- Bar staff from connecting personal AI tools to company data, and state in the contract that the AI provider may not use the organisation's data to train models without permission.
- High-risk work needs human oversight by someone who can intervene in, review or stop an AI decision at once.
- If people abroad can access the data, it may count as a cross-border data transfer, which must comply with sections 28 and 29 of the PDPA.
Draft Artificial Intelligence Act: timeline
| When | What happened | Source |
|---|---|---|
| May – 24 Jun 2025 | ETDA ran its first public consultation on the principles of an artificial intelligence law | ETDA |
| 2–9 Jul 2026 | ETDA published a new draft for public comment on the government's central law portal (ระบบกลางทางกฎหมาย). Tilleke gives 2 Jul, BDO gives 9 Jul | Tilleke & Gibbins, BDO |
| 14 Aug 2026 | Public consultation closed | BDO |
| As of 18 Oct 2026 | No consultation summary, revised draft, Cabinet resolution or referral to the Council of State (คณะกรรมการกฤษฎีกา) for review found | TRAINIAC search of government and ETDA websites and the news |
| Next steps | Council of State review → Cabinet → Parliament → publication in the Royal Gazette | The normal law-making process |
In practice, the draft is unlikely to take effect in 2026. Once it is promulgated, the July 2026 draft gives 180 days to prepare for some parts.
What the July 2026 draft proposes
| Topic | What the draft proposes | What it means for organisations that use AI |
|---|---|---|
| Scope | Applies to developing or using AI that affects people in Thailand, even if the provider is abroad. Personal use by individuals is excluded | Thai organisations that use foreign tools are still in scope |
| Prohibited AI | Subliminal manipulation techniques, and wide-scale discrimination from processing unrelated data. The committee can add more by notice | Check that none of your systems falls into these |
| High-risk AI | Systems designated by royal decree (พระราชกฤษฎีกา) in security, health, environment, energy, telecommunications, transport and public utilities. A royal decree may also require other systems to be notified, registered or licensed | The actual list must wait for the royal decree |
| Duties of organisations that deploy high-risk systems | Have a risk management system, follow the provider's instructions, assign competent human oversight, keep logs for at least 6 months, and report unexpected risks | Name who is responsible and start keeping logs today |
| Transparency | Developers of systems that create images, audio or video must embed machine-readable markings. Anyone who releases certain AI content to the public, such as content on elections, investment, food and drugs, or impersonation, must disclose it, and platforms must label it | Label AI-generated content that you publish externally |
| Foreign providers | Must appoint a coordinator or representative in Thailand | Ask the providers you use how they are preparing |
| Civil liability | Joint liability without proof of intent or negligence. Defences are limited to force majeure, the injured party's own act, or following an official's order | Review how liability is shared in your contracts with providers |
| Penalties | Administrative fines of THB 1–5 million depending on the type of violation, and a court can be asked to order a service suspended or to order internet service providers to block it | The cost of non-compliance is high enough to prepare in advance |
| Entry into force | Core measures on releasing AI products take effect on promulgation. Risk control, oversight and serious-incident provisions take effect 180 days after promulgation | About six months to prepare after promulgation |
Sector regulators
The financial sector is the clearest. The BOT issued policy guidelines on risk management for the use of AI systems, dated 12 Sep 2025 (B.E. 2568). The document is policy guidance for financial institutions to refer to, not a notification with penalties of its own. But it is used alongside the IT risk requirements that are already binding. The capital markets and insurance sectors also have guidance from their own regulators. Organisations in regulated sectors must therefore read their regulator's documents alongside the PDPA, and should check the latest version directly with the regulator.
What organisations can do now
You do not need to wait for the AI law to be enacted. Most of the work the draft law would require is already recommended in the PDPC Office's guideline.
| What to do | Which document it answers |
|---|---|
| Make an inventory of where you use AI, and rate the risk of each use | The draft Act (risk-based tiers) and the PDPC Office guideline (impact assessment before high-risk work) |
| Bar entering personal data into public AI, and use organisation accounts that have a data protection agreement | The PDPA and the PDPC Office guideline |
| Put a ban on using your data to train models into your contracts with providers | The PDPC Office guideline |
| Let people review and stop AI decisions in work that affects individuals | The PDPC Office guideline and the draft Act |
| Keep logs of AI use in important work | The draft Act (at least 6 months for high-risk systems) |
| Label AI-generated content that you publish externally | The draft Act |
| Review how liability is shared in your contracts with providers | The draft Act (joint liability without proof of fault) |
| Assign a person or team to track the status of the law | All of them, because the draft can still change |
Turn this checklist into rules staff can follow with an AI policy framework for organisations (in Thai), and see how to manage risk systematically in the AI risks organisations must manage (in Thai).
Where you need an adviser
Whether your AI system counts as high risk or needs a licence under the draft law, questions of liability, and drafting contracts with providers are for your legal adviser to decide on the facts. This article helps you see the overall picture so you can ask the right questions. It is not a legal conclusion.
Sources
- Guidelines on personal data protection in the development and use of artificial intelligence technology (แนวทางการดำเนินการด้านการคุ้มครองข้อมูลส่วนบุคคลเกี่ยวกับการพัฒนาและการใช้งานเทคโนโลยีปัญญาประดิษฐ์), PDPC Office (final version, 7 Oct 2026), and the version published in the Royal Gazette (vol. 143, special issue 261 ง, 2 November 2026 (B.E. 2569))
- Draft guideline on personal data protection for AI technology (ร่างแนวปฏิบัติด้านการคุ้มครองข้อมูลส่วนบุคคลเกี่ยวกับเทคโนโลยี AI), PDPC Office (public consultation, Feb 2026)
- Personal Data Protection Act B.E. 2562 (พ.ร.บ. คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562), Royal Gazette
- BOT policy guidelines on risk management for the use of artificial intelligence systems (แนวนโยบาย ธปท. เรื่อง การบริหารจัดการความเสี่ยงของการใช้งานระบบปัญญาประดิษฐ์), Bank of Thailand
- Public consultation on the principles of an artificial intelligence law (รับฟังความเห็นหลักการของกฎหมายว่าด้วยปัญญาประดิษฐ์), ETDA (first round, 2025)
- Guideline on applying generative AI with good governance for organisations (แนวทางประยุกต์ใช้ Generative AI อย่างมีธรรมาภิบาลสำหรับองค์กร), ETDA
- Guidelines and research of the AI Governance Center (ศูนย์ธรรมาภิบาล AI), ETDA
- Thailand Releases New Draft Artificial Intelligence Act, Tilleke & Gibbins
- Thailand Moves Forward with Draft Artificial Intelligence Act in 2026, BDO
- Thailand's proposed AI law, Rajah & Tann (estimate of the law-making timeline)
- Meeting No. 1/2569 of the National Digital Economy and Society Committee (ประชุมคณะกรรมการดิจิทัลเพื่อเศรษฐกิจและสังคมแห่งชาติ ครั้งที่ 1/2569), Naewna (trial of the AI governance guideline in government agencies)
Read next
Read your PDPA duties when you use AI, the law that is already in force, and an AI policy framework for organisations (in Thai) to turn it into rules people can follow. See the AI Governance & Responsible AI course, which can run in-house, or see our corporate AI training in detail.