Skip to main content

    AI by country · Southeast Asia

    AI in Thailand: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Thailand know before starting with AI?

    Thailand has no AI law in force as of 29 October 2026, but a draft AI Act went to public hearing in July and August 2026. The Personal Data Protection Act B.E. 2562 (2019), fully in force since 1 June 2022, is the law that applies to AI using personal data today. A company should check its legal basis for using data, how it handles breaches and transfers abroad, and follow the draft AI Act as it moves forward.

    At a glance

    Thailand at a glance

    Key facts about Thailand
    Data protection lawPersonal Data Protection Act B.E. 2562 (2019), fully in force since 1 June 2022
    RegulatorPersonal Data Protection Committee and its Office
    AI policyNational AI Strategy and Action Plan 2022 to 2027. Draft AI Act published for hearing in July 2026; no AI law in force as of 29 October 2026
    Time zoneICT, UTC+7 (India is 1.5 hours behind)
    CurrencyTHB (Thai baht)
    Business languageThai

    Why now

    Why Thailand is worth watching

    Each point links to the document it comes from.

    • The Cabinet approved the Thailand National AI Strategy and Action Plan 2022 to 2027 on 26 July 2022, with a target of at least 600 agencies using AI innovation within six years.[5]

    • The Electronic Transactions Development Agency (ETDA) released a draft AI Act for public hearing on 9 July 2026, closing on 14 August 2026, according to a law firm summary.[3]

    • On 5 October 2026 ETDA said it plans an AI Governance Sandbox in 2027, where organisations can test AI uses and policy approaches before wider rollout.[4]

    • ETDA aims to train more than 120,000 people in AI governance and says it works with over 140 agencies across 20 ministries.[4]

    • The Bank of Thailand held a public hearing from 12 to 30 June 2025 on a draft policy for managing the risks of AI used by financial service providers.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Act B.E. 2562 (2019)

    In force2019Sensitive data such as health, biometric and criminal records needs explicit consent unless an exception applies (section 26). Breaches must be reported to the Office without delay and, where feasible, within 72 hours, and to people if the risk is high (section 37(4)). The Act also applies to companies outside Thailand that offer goods or services to, or monitor, people in Thailand (section 5).[1]

    Personal Data Protection Act: transfers and penalties

    In force2019Sending data abroad needs a destination with adequate protection or a listed ground, such as informed consent or performance of a contract (section 28). Administrative fines reach THB 3 million for breaking duties such as security and breach notice, and THB 5 million for misuse of sensitive data (sections 83 and 84). Courts can also award punitive damages of up to twice actual compensation (section 77).[1]

    Draft Artificial Intelligence Act (ETDA)

    Draft2026A law firm summary says it would cover developers, providers, deployers and platforms, including offshore ones, with four groups: prohibited AI, high-risk AI, AI needing a licence and AI with transparency duties for deepfakes, chatbots and generative AI. It also describes strict liability and powers to suspend or block AI systems. Its next step after the hearing is unclear as of 29 October 2026.[3]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Customer service in Thai, document checks and fraud alerts, with staff reviewing decisions.

    The Bank of Thailand consulted on a draft AI risk management policy in June 2025. Whether a final version has been issued is unclear as of 29 October 2026.[6]

    Health care

    Drafting patient summaries and appointment handling, with clinicians making the decisions.

    Health and biometric data are sensitive under section 26 of the PDPA and need explicit consent unless an exception applies.[1]

    Tourism and hospitality

    Multilingual booking support and review analysis.

    Transfers abroad for booking or contract performance can rely on section 28(3), but the destination and safeguards still need checking.[1]

    Public sector

    Answering citizen questions and summarising documents, with officials approving replies.

    The National AI Strategy sets goals for AI use in the public and private sectors.[5]

    Your first steps

    Your first steps

    1. List each AI use that touches personal data and record the legal basis, with explicit consent for sensitive data.
    2. Set up a breach process that can notify the PDPC Office within 72 hours where feasible.
    3. Check every transfer of personal data abroad, including to AI cloud services, against section 28.
    4. Bind vendors by contract so they cannot use or disclose your data without permission, as section 37(2) requires.
    5. If you are based outside Thailand and serve Thai customers, check whether you must appoint a representative in Thailand under section 37(5).
    6. Read the draft AI Act and work out which of its risk groups your AI might fall into.
    7. If you are a financial service provider, follow the Bank of Thailand's AI risk policy work.

    AI services for Thailand

    AI consulting and development for teams in Thailand

    We work remotely with companies in Thailand, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Thailand is on UTC+7 and India on UTC+5:30, a 1.5 hour gap. Taking a 9:00 to 18:00 day in Thailand and 9:30 to 18:30 in India, the overlap is about 7 hours, from 11:00 to 18:00 Thai time.

    Questions

    Common questions about AI in Thailand

    Does Thailand have an AI law?

    Not in force as of 29 October 2026. ETDA published a draft AI Act for public hearing from 9 July to 14 August 2026. Its later progress is unclear.

    Which law covers AI that uses personal data?

    The Personal Data Protection Act B.E. 2562 (2019). It covers consent, sensitive data, security, breach notice and transfers abroad.

    What are the fines under the PDPA?

    Administrative fines go up to THB 1 million, THB 3 million or THB 5 million depending on the breach. The Act also has criminal penalties and allows punitive damages in court.

    Does the PDPA apply to a company outside Thailand?

    Yes, if it offers goods or services to people in Thailand or monitors their behaviour there (section 5). Such a company may need a representative in Thailand.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Royal Thai Government Gazette (unofficial English translation, hosted by King Mongkut's University of Technology Thonburi), 2019-05-27. Personal Data Protection Act, B.E. 2562 (2019)(cc.kmutt.ac.th)
      Full title and what we used it for

      Personal Data Protection Act, B.E. 2562 (2019). Unofficial translation of the Act as published in the Government Gazette. Used for sections 5, 26, 28, 37, 77, 82 to 84. The Thai text prevails, and later amendments were not checked.

    2. [2] InfoQuest, 2021-05-05. Cabinet extends PDPA enforcement by one year(infoquest.co.th)
      Full title and what we used it for

      Cabinet extends PDPA enforcement by one year. News report of the Cabinet decision. Used for the full enforcement date of 1 June 2022.

    3. [3] Baker McKenzie, 2026-07-16. Thailand: Draft AI Act, seven key implications(bakermckenzie.com)
      Full title and what we used it for

      Thailand: Draft AI Act, seven key implications. Law firm summary, used for interpretation. Used for the hearing dates, scope, risk groups and liability. We could not reach the official draft on a government site.

    4. [4] Electronic Transactions Development Agency (ETDA), 2026-10-05. ETDA plans to upgrade AIGPC into a central AI governance mechanism with…(etda.or.th)
      Full title and what we used it for

      ETDA plans to upgrade AIGPC into a central AI governance mechanism with an AI Governance Sandbox in 2027. Primary, Thai. Used for the sandbox plan, the 140 agency network and the 120,000 training target.

    5. [5] AI Thailand (National AI Committee), 2022-07-26. About AI Thailand: National AI Strategy and Action Plan 2022 to 2027(ai.in.th)
      Full title and what we used it for

      About AI Thailand: National AI Strategy and Action Plan 2022 to 2027. Primary. Used for the Cabinet approval date, the five strategies and targets.

    6. [6] Bank of Thailand, 2025-06-12. Public hearing: draft policy on risk management of AI use(bot.or.th)
      Full title and what we used it for

      Public hearing: draft policy on risk management of AI use. Primary, Thai. Used for the hearing dates and purpose. The page does not say whether a final policy has been issued.

    This is general information, not legal advice. The Thai AI Act is still a draft, and we used an unofficial English translation of the PDPA. Check with a qualified Thai lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Thailand?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score