Skip to main content

    AI by country · Southeast Asia

    AI in the Philippines: the rules, the readiness and where to start

    Last checked: 26 October 2026

    What should a company in Philippines know before starting with AI?

    The Philippines has no general AI law as of 26 October 2026. AI projects that touch personal data are covered by the Data Privacy Act of 2012 (RA 10173) and a December 2024 National Privacy Commission advisory on AI. Banks and other BSP-supervised firms also have central bank AI principles, and a House AI bill is still being drafted.

    At a glance

    Philippines at a glance

    Key facts about Philippines
    Data protection lawData Privacy Act of 2012 (RA 10173), in force
    RegulatorNational Privacy Commission (NPC)
    AI policyNational AI Strategy Roadmap 2.0 (2024). No dedicated AI law as of 26 October 2026
    Time zoneUTC+8 (2 hours 30 minutes ahead of India)
    CurrencyPHP
    Business languageEnglish and Filipino

    Why now

    Why Philippines is worth watching

    Each point links to the document it comes from.

    • The Department of Trade and Industry launched the National AI Strategy Roadmap 2.0 on 3 July 2024. It aims to lift research spending from 0.3% to 1.0% of GDP.[5]

    • The IT and business process management sector earned more than US$40 billion in export revenue in 2025 and employed about 1.9 million people, according to its industry association.[10]

    • The government's eGovPH app has more than 61 million downloads and now includes free AI tools built on Google Gemini, so many citizens already use AI in daily government tasks.[11]

    • In June 2026 the central bank issued AI governance principles for banks and other supervised financial firms.[8]

    • A House committee working group advanced a draft AI bill in July 2026. It would regulate only high-risk uses, such as lending, hiring and health.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Data Privacy Act of 2012 (RA 10173) and its implementing rules

    In force2012You need a lawful basis for processing personal data, such as consent, a contract or a legitimate interest. People can ask about automated processing where it is the sole basis of a decision that significantly affects them. You stay responsible for data you hand to a vendor. Unauthorised processing carries prison terms and fines. A law-firm summary of the implementing rules says serious breaches need notice within 72 hours.[1]

    NPC Advisory Guidelines on Artificial Intelligence Systems Processing Personal Data

    In force2024Dated 19 December 2024, these guidelines apply to anyone who develops, tests, trains or deploys AI that processes personal data. They ask for plain-language transparency, privacy impact assessments, data minimisation, bias checks and human intervention in risky automated decisions. In July 2026 the NPC repeated that a company using a vendor's AI remains accountable. The NPC site blocked us, so this summary is secondary.[2]

    BSP Memorandum M-2026-031, Governance Principles for AI in Financial Services

    In force2026Dated 24 June 2026, it sets five principles: sustainability, transparency, accountability, responsibility and security. Press reports call it voluntary and non-binding, while also saying it states the central bank's minimum supervisory expectations. Treat it as guidance you will be judged against, and ask your bank's compliance team.[9]

    Artificial Intelligence Development and Regulation Act (House draft)

    Draft2026A House working group consolidated 26 bills into one draft in July 2026. It would require registration and safety checks only for high-risk systems and bar dismissing a worker on an algorithm's decision alone. Several Senate bills on AI and deepfakes were also pending in May 2026. We found no report of a floor vote, so its status after July is unclear as of 26 October 2026.[7]

    Where AI fits first

    Where AI fits first

    IT-BPM and outsourcing

    Drafting and quality-checking call and email replies, summarising cases, and classifying documents for overseas clients.

    Data from foreign clients often falls under their home law and contracts. The Act extends to some acts done abroad that relate to Philippine residents, and a company stays accountable for data it passes to vendors.[10]

    Banking and fintech

    Document processing for loans and know-your-customer checks, fraud alerts, and customer service in English and Filipino.

    The BSP principles apply to supervised institutions. The draft AI bill treats lending as high-risk, so keep a person in the loop for credit decisions.[8]

    Government services

    Assistants that guide citizens through forms, translation and document handling inside the eGovPH app.

    The DICT built its AI tools on a commercial model. Suppliers to agencies should expect questions on where personal data is processed.[11]

    Your first steps

    Your first steps

    1. List every AI use that touches personal data and name the lawful basis under the Data Privacy Act for each one.
    2. Run a privacy impact assessment before launch, as the 2024 NPC guidelines expect, and keep the record.
    3. Check your vendor contracts. You remain accountable for personal data a third-party AI tool processes, so agree on security, data location and breach reporting.
    4. Write a breach plan that can meet a 72-hour notice, and name who decides when to notify.
    5. For decisions about people, such as loans or hiring, make sure a trained person can review and reverse the result.
    6. If you are a bank or other BSP-supervised firm, compare your AI controls with the five BSP principles.
    7. Watch the House bill and NPC announcements, and review your plan when either changes.

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. The Philippines is UTC+8 and India is UTC+5:30, a gap of 2 hours 30 minutes. If both sides work 9:00 to 18:00 local time, the shared window is 12:00 to 18:00 Philippine time (9:30 to 15:30 IST), about 6 hours.

    Questions

    Common questions about AI in Philippines

    Does the Philippines have an AI law?

    Not yet. As of 26 October 2026 there is no general AI law. Several bills are pending, and a House working group is drafting a combined version. Until one passes, the Data Privacy Act and NPC guidance are the main rules.

    Can we use ChatGPT or another overseas AI tool with customer data?

    Only with a lawful basis and proper safeguards. The NPC said in July 2026 that a company using third-party AI remains accountable under the Data Privacy Act. Check the vendor's terms on storage, training use and breach notice first.

    Do we have to tell people when AI is used?

    The 2024 NPC guidelines ask for plain-language explanations of the purpose, inputs, outputs and risks of an AI system that handles personal data. The Act also lets people ask about decisions made only by automated processing that significantly affect them.

    Are the BSP AI principles mandatory?

    Press reports call them voluntary and non-binding, yet also the BSP's minimum supervisory expectations. The text we could read uses mixed wording. Ask your compliance lawyer how your firm will be assessed.

    What happens if we have a data breach?

    Notice to the NPC and affected people is generally due within 72 hours for breaches involving sensitive data or a real risk of serious harm, per a law-firm summary of the implementing rules. Concealing a breach is a crime under the Act.

    Free tools

    Try these first

    Three free tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 26 October 2026. Numbers in square brackets above match this list.
    1. [1] LawPhil Project (Arellano University School of Law), 2012-08-15. Republic Act No. 10173, Data Privacy Act of 2012(lawphil.net)
      Full title and what we used it for

      Republic Act No. 10173, Data Privacy Act of 2012. Law text for lawful basis, rights including automated processing (Sec. 16), accountability for transfers (Sec. 21), extraterritorial reach (Sec. 6) and penalties. Opened and read.

    2. [2] Securiti, 2025-01-01. Summary of NPC AI Advisory Guidelines (19 December 2024)(securiti.ai)
      Full title and what we used it for

      Summary of NPC AI Advisory Guidelines (19 December 2024). Secondary summary used for the NPC AI guidelines. The NPC's own PDF on privacy.gov.ph returned 403 Forbidden, so its text was not read or relied on. Publication date approximate.

    3. [3] MLex, 2026-07-23. Philippines warns companies remain liable for personal data in third-pa…(mlex.com)
      Full title and what we used it for

      Philippines warns companies remain liable for personal data in third-party AI. Report of the NPC deputy commissioner's statement on vendor AI accountability. News report, not the NPC statement itself.

    4. [4] Hunton Andrews Kurth, 2016-09-13. Final Rules for the Data Privacy Act Published in the Philippines(hunton.com)
      Full title and what we used it for

      Final Rules for the Data Privacy Act Published in the Philippines. Law-firm summary of the 2016 implementing rules, used only for the 72-hour breach notice and registration threshold. The NPC and official gazette pages returned 403, so the rules' own text was not read.

    5. [5] US-ASEAN Business Council, 2024-08-13. Philippines unveils enhanced national AI strategy and research ambitions(usasean.org)
      Full title and what we used it for

      Philippines unveils enhanced national AI strategy and research ambitions. Used for the NAISR 2.0 launch date and the R&D target. The DTI page was not reachable, so this secondary source was used.

    6. [6] Foundation for Media Alternatives, 2026-05-28. Regulating Risk: The 20th Congress of the Philippines Response to Artif…(fma.ph)
      Full title and what we used it for

      Regulating Risk: The 20th Congress of the Philippines Response to Artificial Intelligence. List of pending Senate and House AI and deepfake bills as of May 2026, all in committee.

    7. [7] The Philippine Star, 2026-07-14. Proposed AI bill gains momentum in Congress(philstar.com)
      Full title and what we used it for

      Proposed AI bill gains momentum in Congress. Status and content of the House draft AI Development and Regulation Act. No later news found.

    8. [8] GMA Network, 2026-07-14. BSP lays down rules on AI use to guide banks, financial institutions(gmanetwork.com)
      Full title and what we used it for

      BSP lays down rules on AI use to guide banks, financial institutions. Memorandum number, date, five principles and its described voluntary status.

    9. [9] Divina Law (copy of BSP issuance), 2026-06-24. BSP Memorandum No. M-2026-031, Governance Principles for AI in Financia…(divinalaw.com)
      Full title and what we used it for

      BSP Memorandum No. M-2026-031, Governance Principles for AI in Financial Services. Law-firm copy of the memo, partly readable. Used for date and wording. Its binding status could not be settled from the text we could read.

    10. [10] The Philippine Star, 2026-01-29. IT-BPM revenues breach $40 billion mark(philstar.com)
      Full title and what we used it for

      IT-BPM revenues breach $40 billion mark. 2025 export revenue and headcount as stated by the industry association's president. Press report, not the association's own release.

    11. [11] BitPinas, 2026-07-31. DICT Usec: How the eGov PH App Lets You Skip Government Lines and Acces…(bitpinas.com)
      Full title and what we used it for

      DICT Usec: How the eGov PH App Lets You Skip Government Lines and Access Free AI Tools. eGovPH download figure and AI tools built on Google Gemini. Press report of a DICT official's remarks.

    12. [12] Germany Trade & Invest (GTAI), 2026-10-06. Recht kompakt Philippinen: Datenschutz und KI(gtai.de)
      Full title and what we used it for

      Recht kompakt Philippinen: Datenschutz und KI. Cross-check that no general AI law exists, page marked current to 6 October 2026.

    This is general information, not legal advice. Laws and guidance change, and several sources here are news reports or law-firm summaries because the NPC and DTI sites could not be read. Check with a qualified Philippine lawyer before you act. Facts checked on 26 October 2026.

    Other country guides

    Starting with AI in Philippines?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score