Thailand's AI law is still a draft set of principles, while Europe already enforces the GDPR and has brought parts of its AI Act into force. The Ministry of Digital Economy and Society (DE), through the Electronic Transactions Development Agency (ETDA), took public comment on the draft principles until 24 June 2025. The rules will shape what AI developers must be responsible for and what rights users have when a system makes a decision that affects them. That matters to anyone in Thailand who uses AI apps or services in daily life.
Thailand's AI law is still a draft of principles
According to an ETDA press release, the draft put out for comment is a set of principles for an AI law, not a full legal text. The DE and ETDA prepared it with the AIGC center at ETDA, experts, government regulators and business representatives. The drafters said a one-size-fits-all law applied to AI of every risk level may not suit Thailand.
The draft focuses on High-Risk AI, meaning AI that could affect people's rights, freedoms or safety. Oversight can come in several steps, from guidelines and good practice, to non-binding Soft Law, to binding Hard Law, with the strictness adjusted by issue. The main content covers:
- basic principles
- support measures, such as Text and Data Mining and a Regulatory Sandbox
- an approach to regulating high-risk AI
- a role for sector-specific regulators, who can issue controls or promotion measures flexibly
The same press release did not give a timeline for the next steps, did not publish penalty rates and did not describe a specific complaint mechanism. There is therefore no official information yet on Thai penalties or complaint rights that can be compared directly with Europe.
Both Thailand and Europe regulate by risk, but at different legal stages
Both sides chose to focus on the AI systems that most affect people's rights and safety, rather than controlling every system equally. The difference is that Europe has already written this into binding law, while Thailand is still at the stage of principles. Thailand's drafters have not announced a list of banned systems or defined risk tiers item by item. It is therefore too early to say whether Thailand will divide risk the same way as Europe.
Article 5 of the EU AI Act (Regulation (EU) 2024/1689) bans several uses of AI. They include:
- subliminal or deceptive techniques that distort decisions and cause significant harm
- Social Scoring that leads to unfair treatment or treatment unrelated to the original context
- building facial recognition databases by indiscriminately scraping images from the internet or CCTV
- inferring emotions of people at work and in schools, except for medical or safety reasons
For high-risk systems, Article 9 requires a documented risk management system that runs throughout the life of the system. It must identify and assess risks to health, safety or fundamental rights, including foreseeable misuse, and set measures to reduce them.
Your rights when an automated system decides
The GDPR (General Data Protection Regulation), or Regulation (EU) 2016/679, is the EU's personal data protection law. It is not an AI law as such, but Article 22 applies to AI directly. It gives people the right not to be subject to a decision based solely on automated processing, including Profiling, if the decision has legal effects or similarly significant effects.
The right has three exceptions: the decision is necessary for a contract, it is authorized by EU or member state law, or the person has given explicit consent. For contract and consent cases, the data controller must put safeguards in place. At a minimum these are the right to human intervention, the right to express one's view and the right to contest the decision.
On the Thai side, the draft principles state goals of protecting human safety, rights and dignity. There is no official information yet on whether Thailand will create a right like Article 22. Article 22 is a right for people in the European Union, so it does not apply automatically in Thailand.
GDPR fines and the delayed AI Act deadlines
The GDPR has two maximum fine tiers under Article 83. The first tier is up to 10 million euros or 2% of total worldwide annual turnover of the previous financial year, for breaches of controller and processor obligations. The second tier is up to 20 million euros or 4% of worldwide turnover, for breaches of the basic processing principles, the conditions for consent, data subjects' rights and the rules on transfers of data outside the EU. In both tiers, the higher figure applies.
On the AI Act, the Digital Omnibus on AI (Regulation (EU) 2026/1744), which amends the AI Act, came into force in July 2026. It pushes back the deadlines for high-risk AI by about 16 months from the original dates:
- Annex III systems must comply from 2 December 2027.
- Systems embedded in products under Annex I must comply from 2 August 2028.
- High-risk systems used by public authorities must be brought into compliance by 2 August 2030.
The amended regulation also adds new Article 5 bans on non-consensual intimate content and child sexual abuse material, which apply from 2 December 2026. The original Article 5 bans already apply. Thai penalties still have no official information, and ETDA has not published a full draft that covers them.
Source: ETDA press release on the public hearing for the draft principles of the AI law; EU Regulation 2026/1744; EU Regulation 2024/1689 (AI Act); EU Regulation 2016/679 (GDPR), Articles 22 and 83.
This article is adapted from ViewNews' Thai-language report.
