The European Union's Artificial Intelligence Act (AI Act) is the world's first broad legal framework for artificial intelligence, and it does not apply only to European companies. Startups and technology firms in Thailand that sell AI systems to customers in the EU, or whose AI output is used in Europe, fall within its scope. The law entered into force in August 2024 and is being phased in. The European Commission, the EU's executive body, has reported that an amendment package known as the AI Omnibus took effect on 27 July 2026 and pushed back deadlines for high-risk AI systems.
The rules matter for any business in Thailand, whether Thai-owned or foreign-owned, that targets Europe. SaaS, fintech, healthtech and AI API providers are among those eyeing the European market. If your system falls under the rules, you must meet EU requirements wherever your company is located.
How far the AI Act reaches companies in Thailand
Article 2 of the AI Act says the rules apply to providers that place AI systems or general-purpose AI models on the EU market, whether the provider is established in the EU or in a third country. It also covers providers and deployers (the organisations that put an AI system to use) in third countries if the system's output is used in the EU. A company with no office in Europe at all can therefore be covered.
The European Commission sorts AI into four risk groups.
- Unacceptable risk: banned outright. There are 9 cases, including social scoring, untargeted scraping of facial images from the internet to build databases, and emotion recognition in workplaces and schools.
- High risk: allowed, but subject to strict requirements such as risk management, data quality, activity logging, technical documentation, human oversight and system robustness. Examples are AI used in hiring, education and credit scoring.
- Transparency risk: users must be told they are talking to an AI, and deepfake-type content must be labelled.
- Low or minimal risk: such as AI-enabled games and spam filters. No specific rules apply.
Two common startup products, AI that screens job applicants and AI that assesses credit, both sit in the high-risk group. Developers need documentation and oversight systems ready before entering the European market.
Timeline and fines
The law applies in stages. The bans on unacceptable-risk AI came first. Rules for general-purpose AI models followed in the same year, requiring model developers to meet transparency and copyright obligations. The year after, the EU's AI Office and national authorities in member states gained full enforcement powers.
The AI Omnibus delays the high-risk deadlines. Cases listed in Annex III, such as biometrics, employment, education and migration, apply from 2 December 2027. AI embedded in products covered by Annex I, such as lifts and toys, applies from 2 August 2028. The same package adds a ban on "nudification" apps that generate fake nude images, applying from December 2026, and extends relief measures to small mid-cap companies.
Fines are set out in Article 99.
- Breaching the bans: up to 35 million euros or 7% of total worldwide turnover in the previous year, whichever is higher.
- Breaching other obligations of providers and deployers: up to 15 million euros or 3%.
- Giving false or incomplete information to authorities: up to 7.5 million euros or 1%.
For SMEs, including startups, the law applies whichever is lower of the amount and the percentage, so the penalties are lighter than for large companies.
Opportunities and risks for startups
The requirements add cost for small teams. They can also be an advantage for teams that already manage data and model-training records in an orderly way. European customers carry their own legal responsibility, and they tend to prefer providers who can show that their systems are traceable.
Startups that connect a foreign model's API to their own product should check whether the model provider complies with the general-purpose AI rules, and which risk group their own product falls into. A downstream AI system provider's duties do not disappear because it uses someone else's model.
How Thailand is preparing its own AI oversight
The Electronic Transactions Development Agency (ETDA) announced on 5 October 2026 that it is upgrading its AI Governance Practice Center (AIGPC) into the central body driving an AI Governance Sandbox. The sandbox lets organisations test AI solutions and oversight approaches on real use cases in a controlled environment before wider rollout. ETDA said its principle is not to wait for problems before fixing them, and that next year's direction will focus on putting AI governance principles into practice.
The same announcement said ETDA will work with Singapore to develop Thai-language test prompts that reflect Thai social context. It will also run exercises on cross-border AI incidents, such as AI-enabled impersonation across ASEAN. All of this is still at the preparation and guideline-development stage.
For businesses in Thailand that sell in Europe, the binding rules under Article 2 are the EU's. Building transparent systems with proper documentation from the start is the easier path, whichever direction Thailand's own mechanisms take.
Source: European Commission (AI regulatory framework page); AI Act text (Regulation (EU) 2024/1689), Articles 2 and 99; Electronic Transactions Development Agency (ETDA). This article is adapted from ViewNews' Thai-language report.
