Thailand's New Draft AI Act 2026: What Businesses Need to Prepare

What this draft is, and where it stands right now

Thailand's Electronic Transactions Development Agency (ETDA) released a new draft Artificial Intelligence Act for public consultation on 2 July 2026, with a comment window of roughly 30 days. It builds on the earlier draft AI law principles that the Ministry of Digital Economy and Society and ETDA opened for comment in 2025, and it is the first Thai text to separate the duties of the organisation that deploys an AI system from those of the organisation that builds it.

That separation is the part Thai businesses should read carefully. Most organisations here do not train models — they subscribe to an AI service and put it to work screening job applications, scoring credit, flagging suspicious transactions, or drafting documents. Under this draft those organisations are deployers, and deployers carry obligations of their own. For the wider picture of where Thai AI regulation is heading, see our overview of Thailand's AI law.

AI is sorted into three risk groups

The draft follows a risk-based approach, the same broad philosophy used in other jurisdictions: not every AI system is regulated equally, and the level of duty scales with the potential impact on people. In practice most ordinary back-office uses will not land in the high-risk group — but an organisation still has to be able to say which of its systems sits where, and to show the reasoning.

For high-risk providers, the draft sets out qualities the system itself must have: it must be efficient and fit for purpose, transparent in operation, subject to meaningful human control, and fair and non-discriminatory. It also leaves room for risk-oversight guidelines spanning some 13 areas — from risk management and bias prevention through cybersecurity to complaint handling.

Developers and deployers do not carry the same duties

This is the section Thai businesses should read line by line, because the common assumption is that AI law is a problem for the companies that build models. The draft says otherwise. Deployer duties are process obligations that no vendor can discharge on your behalf — they belong to the organisation that decides where and how the system is used.

Read that table and three duties stand out as the heavy ones for an ordinary business: the risk management system, the six-month log retention, and named oversight personnel. None of them requires buying new software to begin. All of them require an accountable owner and written evidence — which is the same groundwork described in our article on AI governance inside the organisation, and the same discipline ETDA promoted during AI Governance Week 2026.

Penalties and enforcement measures

The draft provides for administrative fines in the range of THB 1 million to THB 5 million depending on the nature of the violation. Beyond the fine, courts may order additional measures — and commercially these bite harder than the money, because they stop the service.

• Administrative fines of THB 1–5 million — a direct cost, and a fact that internal auditors and business partners may later ask to see.
• Temporary suspension of the service by court order — if the system sits in a core workflow, that workflow stops. Keeping a non-AI fallback path documented is cheap insurance.
• Product recall by court order — hits developers and distributors directly, and every customer running the product with them.
• ISP-level blocking of access — a non-compliant foreign service may become unreachable from Thailand, which means organisations depending on it are affected too. That is a good reason to assess single-vendor dependency in advance.

Extraterritorial reach and the local representative requirement

The draft applies to AI development or deployment affecting people in Thailand even where the activity takes place outside the country, and it requires foreign providers to appoint a local coordinator or representative in Thailand.

For an organisation buying AI from an overseas provider, that translates into two very practical procurement questions: does this provider have a contactable presence in Thailand, and what does the contract say about responsibility when the system's output causes damage? Both belong in the vendor assessment form now — there is no reason to wait for the law to be in force before asking them.

Six things you can do now, while the draft is still a draft

Because the risk-control measures only take effect 180 days after the law enters into force, there is reasonable runway. But the slowest task is finding out where AI is already being used, and that should start first — everything else depends on the answer.

• Build an AI usage register — list, department by department, which tools are in use, what job each one does, whether it decides or merely drafts, and what data leaves the organisation.
• Group by risk — draw a clear line between AI that helps write text and AI whose output affects a person's rights, such as screening candidates, scoring applicants, or approving requests.
• Name the owners — assign an accountable person for AI use in each function rather than leaving it as an unassigned IT responsibility.
• Sort out log retention — check how far back each tool's logs actually go on your current plan. If it is less than six months, plan to export and retain them yourself.
• Write the review step down — define who checks AI output before it is used, which is the same discipline covered in verifying AI-generated content before it enters an official document.
• Revisit provider contracts — look at training-data terms, where data is stored, how long logs are kept, and whether there is a contact point in Thailand.

Where an ERP system actually fits into this

Let us be direct: an ERP system is not an AI governance platform, and there is no button labelled "comply with the AI Act". But there is one honest point of overlap. The draft keeps asking for things that a proper system of record produces as a by-product — a trail of who did what to which record and when, and controls over who may see which part of the data.

Saeree ERP keeps master data in a single database with a record of creation and modification, and user permissions that the organisation's own administrator maintains — adding users, setting a user to inactive, and setting the period an account is valid from and to. It can be deployed on-premise in the organisation's own data centre or in the cloud, which is a direct answer when an auditor asks where the data an AI tool can reach actually lives and who can reach it. On the access side the system supports two-factor authentication to reduce account-takeover risk, a topic we cover further in our article on system security.

Conclusion

The draft Artificial Intelligence Act published on 2 July 2026 sets up a risk-based frame — prohibited systems, high-risk systems, and systems requiring notification or a licence — and, importantly, writes deployer duties separately from developer duties. An organisation that merely buys AI and puts it to work is squarely inside scope.

Three obligations matter most to an ordinary business: a risk management system at your own usage level, operational logs retained for at least six months, and named oversight personnel. All three can be started today without waiting for the law to pass, and the one to start first is the usage register — it takes the longest and everything else is built on it.

"An AI law does not ask how skilfully you use AI. It asks whether you can say who made the decision, and show where the evidence is."

- The Saeree ERP team

References

• Mondaq — Thailand Releases New Draft Artificial Intelligence Act (2 July 2026)
• ETDA — Thailand's first draft AI law principles opened for public hearing
• Bangkok Post — ETDA unveils roadmap to strengthen AI governance
• Electronic Transactions Development Agency (ETDA)

Information verified 20 July 2026 — the text remains a draft under public consultation.