News

Where Thailand AI Law Stands (October 2026): What Applies Now, What Is Still a Draft, and Where to Start

Thailand does not yet have an AI Act in force. The full draft closed its public hearing on 14 August 2026, but several rules already cover how organizations use AI today. This guide separates what you must follow now from what you should prepare for, and where to start.

1 Oct 20269 minRajah & Tann Asia

AI LawThailandPDPAAI GovernanceComplianceEU AI Act

The Thai Parliament building, Sappaya-Sapasathan, with its golden spire — Photo: Sappaya-Sapasathan by Supanut Arunoprayote, Wikimedia Commons, CC BY 4.0

The question our team hears most often right now is "Is the AI law in force yet?" The short answer, as of 1 October 2026, is no. Thailand does not yet have an AI Act in force.

That does not mean organizations can use AI however they like. Several rules that cover AI use already apply today, and the draft AI Act is clear enough about its direction to start preparing. This article keeps the two apart so that management, legal and IT can work from the same picture.

Note: our article Thailand AI and Digital Platform Rules, published in April, stated that Thailand's AI Act took effect on 1 March 2026. That was wrong. We have corrected that article and apologise for the error.

Where the draft AI Act is in the process

The Electronic Transactions Development Agency (ETDA) opened a public hearing on the full draft Act on Artificial Intelligence in early July 2026 and closed it on 14 August 2026 (Tilleke & Gibbins, Rajah & Tann Asia).

Next, ETDA revises the draft based on the comments, the responsible ministry submits it to the Cabinet for approval in principle, and it then goes through Parliament. Rajah & Tann estimates it could take 6 to 24 months to be enacted and come into force.

An Act must pass Parliament and be published in the Royal Gazette before it takes effect. The draft AI Act has not reached that stage.

A verified timeline

When	What happened	Status
11 to 24 June 2025	ETDA consults on the draft principles of an AI law	Draft
18 July 2025	OCPB notification on disclosures in AI-generated advertising	In force
12 September 2025	Bank of Thailand policy direction on AI risk management for financial institutions	In force
November 2025	OIC publishes AI governance guidelines for insurers	Guidance
February to March 2026	PDPC holds two hearings on draft guidelines for personal data in AI development and use	Draft
25 March 2026	TCCT guidelines for multi-sided e-commerce platforms	In force
Early July to 14 August 2026	ETDA consults on the full draft AI Act	Draft
2 August 2026	EU AI Act Article 50 transparency duties apply	In force (for services in the EU)
2 December 2027 and 2 August 2028	EU high-risk AI rules, after the delay	Future

Rules that already apply to AI use

There is no AI Act yet, but organizations using AI must already follow these rules.

PDPA applies to every AI system that processes personal data, whether it is a customer service chatbot, a CV screening tool, or AI that summarizes documents containing customer names and phone numbers. Lawful basis, purpose notices and data subject rights apply just as they do to any other processing. The PDPC announced 8 administrative fines across 5 cases on 1 August 2025, which shows enforcement is real (Formichella & Sritawat).

The OCPB notification on AI-generated advertising (18 July 2025) requires adverts made with AI to say so. Marketing teams using AI images or video already have this duty (Baker McKenzie).

The Bank of Thailand policy direction (12 September 2025) sets out how financial institutions should manage data, model-development and cyber risks from AI (Bank of Thailand).

The Trade Competition Commission of Thailand (TCCT) guidelines for e-commerce platforms have applied since 25 March 2026. They cover conduct such as using algorithms to favour a platform's own products or suppress sellers' visibility, and unfair use of seller data (Bangkok Biz News). The TCCT received 16 platform complaints in the first half of 2026 (Thansettakij).

EU AI Act Article 50 has applied since 2 August 2026. Thai organizations offering chatbots or AI-generated content to users in the EU must tell users they are dealing with AI and label AI-generated content. The EU's high-risk rules have been delayed to December 2027 and August 2028 (Cuatrecasas, Gibson Dunn).

There is also non-binding guidance that regulators expect organizations to follow, such as ETDA's AI Governance Guideline for Executives (OECD.AI) and the OIC guidelines (Asia Insurance Review).

What is still a draft, and where it points

The Royal Government Gazette collection at the National Library of Thailand

Photo: Royal Government Gazette collection, National Library of Thailand, December 2024, by Paul_012, Wikimedia Commons, licensed CC BY-SA 4.0, resized

The draft AI Act

According to Tilleke & Gibbins, the July draft groups AI into prohibited AI, high-risk AI, and designated AI that may need notification or a licence. The points organizations should know:

Providers of high-risk AI must make systems fit for purpose, transparent, fair and subject to meaningful human control
Deployers of high-risk AI must run risk management, assign oversight staff, keep operational logs for at least six months, and report unforeseen risks
Foreign AI providers must appoint a local coordinator or representative in Thailand
Systems that generate or modify images, audio or video must embed machine-readable marks identifying AI content
Administrative fines range from THB 1 million to THB 5 million

These details may change before enactment, but the core duties, such as keeping logs, naming owners and labelling AI content, are things organizations can start now without wasted effort.

The PDPC's draft AI guidelines

The PDPC's draft guidelines on personal data in AI development and use are not yet final (Tilleke & Gibbins, Daily News), but several points directly affect how organizations buy AI services:

If an AI provider uses a customer's data to train or fine-tune its own model, the provider may become a data controller in its own right
Data processing agreements should prohibit model training and require deletion at the end of the engagement
High-risk AI using personal data should have a data protection impact assessment (DPIA) before use

Why start now

A 2024 survey by ETDA and NSTDA found that about 17.8% of Thai organizations already use AI and another 73.3% plan to (The Thaiger). AI systems installed while the law is still a draft are the systems that will need adjusting once it takes effect. If data and ownership are recorded from the start, that adjustment is much lighter.

Where to start

We have ordered these from what already applies to what you can prepare in advance.

List the AI systems you use, including AI features built into software you buy, such as website chatbots, AI assistants in ERP or CRM, and tools staff use on their own. Note what data each one uses and whose decisions it affects.
Check your AI vendor contracts for whether your data is used to train models, where it is stored, and when it is deleted. This falls under the PDPA, which already applies.
Run a DPIA for AI that uses personal data and affects people, such as candidate screening, credit approval or customer scoring.
Label AI-generated content in advertising under the OCPB notification, and tell users when they are chatting with AI, especially if you serve customers in the EU.
Name an owner and keep logs for important AI systems. The draft proposes at least six months. Starting now helps with troubleshooting today and with proving compliance later.
Follow the draft AI Act through ETDA and review this list again once the draft passes the Cabinet.

How Enersys can help

We help organizations list their AI systems and assess gaps against both the rules in force and the draft that is coming. We use PrivacyHub to keep processing records, DPIAs and PDPA evidence in one place, and we set AI permissions in Odoo before AI features are switched on, as described in our guide to Odoo 20 MCP permissions.

If your organization already uses AI and wants to know what to tackle first, talk to the Enersys team.

References

Back to Insights

AIS x Thai SME Council Launches ProStart — Digital + AI Bundle with 200% Tax Deduction Thai SMEs Shouldn’t Miss

AIS has partnered with the Thai SME Council to launch ProStart, an AI + Digital package for SMEs with a 200% tax deduction worth up to ฿300,000 — a golden opportunity available only until the end of 2027.

Anthropic Hits $30B ARR — Enterprise AI Has Officially Crossed the Tipping Point

Anthropic tripled from $9B to $30B run rate in just four months, with 1,000+ enterprise customers each spending over $1M a year. This is no longer hype — it is proof that Enterprise AI has real ROI at scale, and Thai businesses need to decide when (not if) to move.

Anthropic Files Confidential S-1 in May 2026 After Series H at $65 Billion, Valuation Near $965 Billion, and a $47 Billion Revenue Run-Rate

Anthropic filed a confidential draft S-1 with the SEC in late May 2026, on the back of a $65 billion Series H that lifted post-money valuation to roughly $965 billion. Revenue run-rate stood at about $47 billion in May 2026, up from $10 billion the prior year. This piece sets out the numbers, explains why this is a tipping point for enterprise AI, and considers what teams using Claude in production, including Enersys, should take from the signal.

"Empowering Innovation,
Transforming Futures."