Skip to main content

    AI by country · Southeast Asia

    AI in Brunei: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Brunei know before starting with AI?

    Brunei has no dedicated AI law as of 29 October 2026. The Personal Data Protection Order, 2025 is the main law for AI that uses personal data in the private sector, and AITI enforces it. AITI's Guide on AI Governance and Ethics, now in a second edition, gives voluntary principles, so a company should start with consent, breach handling and its data protection officer.

    At a glance

    Brunei at a glance

    Key facts about Brunei
    Data protection lawPersonal Data Protection Order, 2025, made 8 January 2025; most provisions reported in force from 1 January 2026
    RegulatorAuthority for Info-communications Technology Industry (AITI), through its Data Protection Office
    AI policyGuide on AI Governance and Ethics for Brunei Darussalam (April 2025, second edition 2026). No dedicated AI law as of 29 October 2026
    Time zoneBNT, UTC+8, no daylight saving (2.5 hours ahead of India)
    CurrencyBND (Brunei dollar)
    Business languageMalay and English

    Why now

    Why Brunei is worth watching

    Each point links to the document it comes from.

    • The Personal Data Protection Order, 2025 was published in the Government Gazette on 8 January 2025 to govern how organisations collect, use and disclose personal data.[1]

    • Most of its substantive provisions took effect on 1 January 2026, according to a law firm summary.[3]

    • AITI released the Guide on AI Governance and Ethics for Brunei Darussalam on 11 April 2025, with seven principles for organisations that design, develop, deploy or use AI.[4]

    • A second edition of the guide, reported in May 2026, adds the risks of generative AI and local use cases, and AITI also published a Guide on Responsible Use of Generative AI.[6]

    • AITI's PDP Conference 2026 drew over 250 attendees from government and the private sector, and the order is described as a core pillar of the Digital Economy Masterplan 2025.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Order, 2025: consent, purpose and accountability

    In force2025An organisation may collect, use or disclose personal data only with consent, deemed consent or a ground allowed by the Order (section 8). It must designate at least one person to ensure compliance and publish that person's business contact details (section 7). The Order does not apply to public agencies (section 3).[1]

    Personal Data Protection Order, 2025: transfers and breach notification

    In force2025Personal data may go outside Brunei only under prescribed requirements that give comparable protection (section 24), which matters if your AI tool runs on overseas servers. A breach that is likely to cause significant harm or is of significant scale must be reported to AITI as soon as practicable and no later than 3 days after you assess it as notifiable (sections 26 and 28).[1]

    Personal Data Protection Order, 2025: penalties and private action

    In force2025AITI can impose a financial penalty of up to 10% of annual turnover in Brunei for an organisation whose local turnover exceeds BND 10 million, or up to BND 1 million in other cases (section 37). People who suffer loss from some breaches of the Order can also sue (section 59).[1]

    Guide on AI Governance and Ethics for Brunei Darussalam

    In force2025This is guidance, not law. Its seven principles are transparency and explainability, data protection and governance, security and safety, robustness and reliability, fairness and equity, human centricity, and accountability and integrity. A second edition covering generative AI risks was published in 2026.[5]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Document processing for account opening and drafting customer replies in Malay and English, with staff approving decisions.

    We found no AI-specific rule from the Brunei Darussalam Central Bank as of 29 October 2026. The central bank joined a 2026 university symposium panel on regulation of AI-driven finance.[9]

    Government suppliers

    Search and summarisation over policy and procedure documents.

    Public agencies are outside the Order, but a private contractor processing data for a client is still covered for security, retention and transfer duties (section 3).[1]

    Retail and services

    Customer service chatbots and sales forecasting.

    Marketing to Brunei phone numbers needs specific consent under section 9 of the Order, so check consent before AI-driven campaigns.[1]

    Your first steps

    Your first steps

    1. Appoint a data protection officer and publish their business contact details, using AITI's Guide for Appointment of Data Protection Officers.
    2. Check that each AI use of personal data has consent or another ground under the Order, and that the purpose was notified.
    3. Find out where your AI vendor stores and processes data, and confirm the transfer meets the Order's requirements.
    4. Set up a breach process that can assess a breach and report it to AITI within 3 days of deciding it is notifiable.
    5. Read AITI's Guide on AI Governance and Ethics, second edition, and record how you meet its seven principles.
    6. Keep a person reviewing AI outputs that affect customers or staff.

    AI services for Brunei

    AI consulting and development for teams in Brunei

    We work remotely with companies in Brunei, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Brunei is on UTC+8 with no daylight saving, and India is on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 17:00 day in Brunei and 9:30 to 18:30 in India, the overlap is about 5 hours, from 12:00 to 17:00 Brunei time.

    Questions

    Common questions about AI in Brunei

    Does Brunei have an AI law?

    Not as of 29 October 2026. AITI's Guide on AI Governance and Ethics gives voluntary principles. The Personal Data Protection Order, 2025 applies whenever AI uses personal data.

    Is the Personal Data Protection Order in force?

    The Order was made on 8 January 2025 and takes effect on dates set by gazette notification. A law firm summary says most substantive provisions started on 1 January 2026. We could not open the commencement notice itself.

    How fast must we report a data breach?

    If a breach is likely to cause significant harm or is of significant scale, you must tell AITI as soon as practicable and no later than 3 days after assessing it as notifiable. Affected people must also be told in many cases.

    What are the maximum penalties?

    Up to 10% of annual turnover in Brunei for organisations with local turnover above BND 10 million, and up to BND 1 million for others. Some acts are also criminal offences under the Order.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Brunei Darussalam Government Gazette, via AITI Data Protection Office, 2025-01-08. Personal Data Protection Order, 2025 (No. S 1)(pdp.aiti.gov.bn)
      Full title and what we used it for

      Personal Data Protection Order, 2025 (No. S 1). Primary. Read in full text. Used for sections 1, 3, 7, 8, 9, 24, 26, 28, 37 and 59. Section 1 says the Order starts on dates set by gazette notification.

    2. [2] AITI Data Protection Office, 2026-10-29. Legislation: Personal Data Protection Order, 2025(pdp.aiti.gov.bn)
      Full title and what we used it for

      Legislation: Personal Data Protection Order, 2025. Primary. Used to confirm AITI administers and enforces the Order and that it covers private organisations.

    3. [3] DLA Piper, 2026-10-29. Data Protection Laws of the World: Brunei(dlapiperdataprotection.com)
      Full title and what we used it for

      Data Protection Laws of the World: Brunei. Law firm summary, used for interpretation only. Used for the 1 January 2026 start of most substantive provisions. Parts of this page still describe the Order as anticipated, so it may be out of date. We could not find the gazette commencement notice.

    4. [4] Authority for Info-communications Technology Industry (AITI), 2025-04-11. Guide on Artificial Intelligence Governance and Ethics for Brunei Darus…(aiti.gov.bn)
      Full title and what we used it for

      Guide on Artificial Intelligence Governance and Ethics for Brunei Darussalam (news release). Primary. Used for the release date, the seven principles and who the guide is for.

    5. [5] Authority for Info-communications Technology Industry (AITI), 2026-10-29. AI Governance and Ethics(aiti.gov.bn)
      Full title and what we used it for

      AI Governance and Ethics. Primary. Used for the working group (May 2024), the public consultation of 9 July 2024 and the existence of the second edition.

    6. [6] The Star, 2026-05-01. Brunei ramps up efforts to ensure ethical AI practices(thestar.com.my)
      Full title and what we used it for

      Brunei ramps up efforts to ensure ethical AI practices. Press report. Used for the second edition's generative AI content and the Guide on Responsible Use of Generative AI.

    7. [7] AITI Data Protection Office, 2026-10-29. Guidance documents(pdp.aiti.gov.bn)
      Full title and what we used it for

      Guidance documents. Primary. Used for the Guide for Appointment of Data Protection Officers (version 1, June 2025) and the Guide to Developing a Data Protection Management Programme.

    8. [8] Borneo Bulletin, via Asia News Network, 2026-01-28. Brunei enters transformative era for its digital landscape(asianews.network)
      Full title and what we used it for

      Brunei enters transformative era for its digital landscape. Press report. Used for the PDP Conference 2026 attendance and the link to the Digital Economy Masterplan 2025.

    9. [9] The Star, 2026-04-15. Shaping a safe AI finance future in Brunei(thestar.com.my)
      Full title and what we used it for

      Shaping a safe AI finance future in Brunei. Press report. Used for the central bank's part in a 2026 symposium panel on AI in finance. It mentions no rules.

    This is general information, not legal advice. Commencement dates rest partly on a law firm summary, and regulations under the Order may add detail. Check with a qualified Brunei lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Brunei?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score