Indonesia AI Regulation: the Roadmap and the Rules Businesses Must Meet

Key Takeaway

• 📋 Indonesia AI regulation is still waiting for a pen: no AI-specific law is in force. Two draft Presidential Regulations, one on a National AI Roadmap for 2026-2029 and one on AI ethics, finished inter-ministry harmonisation in April 2026 and sit with the Ministry of State Secretariat awaiting President Prabowo’s signature, per the Indonesia policy tracker updated October 2026.
• ⚖️ Three laws bind AI users today: the Electronic Information and Transactions Law, the Personal Data Protection Law (fully effective since October 2024), and financial-sector rules enforced by OJK. Every AI obligation a business has right now comes from this existing layer.
• 🚦 The draft ethics regulation uses three risk tiers: unacceptable, high, and low risk, with mitigation duties for higher-risk uses such as processing sensitive personal data or affecting essential public services, and it sets no sanctions of its own.
• 🏗️ The roadmap points state AI at five sectors: finance, health, education, food security, and defence, including AI inside the government’s $15-billion free meals program (Reuters, June 2026).
• ✅ Tonight-action: inventory the AI systems your organization runs or sells into Indonesia, and map each one against the three draft tiers, because the companies that did this exercise early are the ones that activate compliance in days when the text publishes.

Indonesia is the region’s biggest economy by far, and it is the biggest AI market still running without AI-specific law, a gap the Indonesia AI regulation drafts exist to close. Indonesia AI regulation reached its final waiting room in 2026: two draft Presidential Regulations prepared by the Ministry of Communication and Digital Affairs (Komdigi) completed public consultation in August 2025, finished harmonisation by April 2026, and now await the President’s signature at the State Secretariat. Until that signature lands, the rules that actually bind AI users are the older ones: data protection, electronic transactions, and sector regulation. This guide separates the two stacks cleanly, because the drafts and the current law carry different obligations, different dates, and very different penalties.

Watchers tracked this story differently at every stage, and the 2026 record shows why status discipline matters: versions of the tale ran from “rules pushed to 2026” through “imminent signing” to the present, verified picture of documents finished and waiting. The dates below all come from the maintained policy trackers and the ministry’s own releases, each with its as-of stamp.

Indonesia AI Regulation Status: What Binds Today

The binding layer beneath Indonesia AI regulation was built for a digital economy and inherited the AI workload:

• Personal Data Protection Law (Law 27 of 2022). Fully effective since October 2024, it governs every AI system that processes Indonesian personal data, consent included, and its enforcement provisions are live. Any AI use case built on customer data answers to this law first.
• Electronic Information and Transactions Law. The EIT framework covers unlawful content and electronic conduct, and the draft regulations explicitly lean on it for enforcement once ethics rules arrive.
• OJK rules for financial services. The financial supervisor issued AI governance expectations for banking documented in the Indonesia regulator directory covering fraud detection, credit assessment, and compliance monitoring, and retains administrative sanction powers over regulated firms. AI inside an Indonesian bank is a supervised use case today, not a future one.
• Ethics guidance and sector patchwork. Ministerial guidelines and private-sector codes fill the gaps while the umbrella regulation waits, a pattern the Tech for Good Institute describes as consolidation without completion.

The practical meaning: an AI vendor selling into Indonesia cannot wait for the new regulation to have obligations. The data-protection exposure on training data and inference logs is enforceable right now, and OJK-supervised firms already answer for model governance. The new regulation layers on top of this stack rather than replacing any of it.

Indonesia AI Regulation Drafts: Two Perpres Awaiting Signature

The two documents at the center of Indonesia AI regulation answer different questions, and both matter to any business deploying AI in Indonesia:

The timeline pieces are simple to verify: public consultation ran in August 2025 through Komdigi’s own announcement of the white paper and ethics concept, officials said drafts were complete in October 2025, both documents cleared inter-ministry harmonisation in April 2026, and they have sat with the State Secretariat since. The Tech for Good Institute’s 2026 review reads the pattern as Indonesia aiming for compliance-by-design, building ethics and risk logic into deployment instead of bolting them on later, and expects both regulations to enact by the end of 2026 if inter-ministerial alignment holds. The holdup is coordination, not disagreement in principle.

For the region, the timing matters: Vietnam already runs its binding law, Malaysia and Thailand have bills in consultation, and Singapore chose voluntary frameworks. When Indonesia signs, ASEAN’s largest market gets its umbrella framework, and regional vendors will feel it within a quarter.

The Three Risk Tiers and What Each Would Demand

The draft ethics regulation sorts AI uses into three categories, and the middle one carries the work:

Companies comparing this to Europe should note the design choice (our plain-English AI glossary decodes the tier vocabulary): the tier structure resembles the EU AI Act’s risk pyramid, but Indonesia’s version, as drafted, sets no penalties of its own. Officials have said enforcement would ride on the EIT Law and the Personal Data Protection Law rather than on new sanctions inside the ethics regulation. That makes the drafts a labeling and governance layer over existing liability, not a parallel enforcement regime.

The tier map also hands businesses a shortcut today. The uses that would land in the high tier, sensitive personal data and essential public services, are the same ones already exposed under the PDP Law. A company that fixes its data governance for the current law has pre-paid most of its high-tier obligation.

What the Roadmap Prioritizes: Sectors and State AI

The roadmap draft names five priority sectors: finance, health, education, food security, and defence. The interesting part is how the state already models the behavior it wants the market to adopt. Indonesia’s government plans AI inside flagship social programs: the $15-billion free meals initiative will use systems to design local menus, monitor pantry hygiene, and determine cash-transfer eligibility for low-income households, per Reuters reporting on June 22, 2026. That is a public-sector commitment to AI in daily administration, not a policy paper.

For vendors, the roadmap’s sector list doubles as a demand map: the five named sectors are where state-backed AI procurement concentrates in 2027-2029. For compliance teams, the same list predicts where OJK-style sector rules will multiply first, because every sector that uses AI at scale develops its own supervisory practice.

Indonesia’s domestic AI ecosystem is also moving under its own power: the Sahabat-AI open-source model family, built with support from AI Singapore’s ecosystem, added a 27B model covering five Indonesian languages in October 2026, which we covered in the SEA-LION and regional language models guide. The regulator’s risk framework and the local model ecosystem are being built in parallel, which is the point of the roadmap’s compliance-by-design bet.

What Businesses Must Meet Today: the Working Checklist

The obligations that exist now, in checklist form (steps as tracker teams recommend them, verified October 2026):

• Inventory every AI system your organization uses or offers into Indonesia, recording purpose, data flows, and affected users.
• Map each system against the three draft tiers, flagging anything that touches sensitive personal data or essential public services.
• Verify Personal Data Protection Law compliance for the data those systems process, since this law is in force and enforceable today.
• Check EIT Law exposure for content-generation and communication use cases.
• If you operate in finance, answer to OJK now: supervisory expectation and sanction powers already exist in the banking lane.
• Track the Ministry of State Secretariat for the signature and the published text, and brief leadership that the drafts carry no sanctions of their own today.

The funding side of this market adds context on pressure: Indonesia’s native AI startups raised just $6 million through July 2026 (as of the Tracxn 2026 landscape, covered in the AI funding map), which means most companies deploying AI in Indonesia buy foreign systems rather than build local ones. The compliance question for Indonesian regulators is therefore mostly a question about deployers, not developers, and the drafts are written for that reality, expecting the rules to apply broadly regardless of company size or sector.

Why Indonesia AI Regulation Matters to the Whole Region

The signature wait is a regional variable, not a domestic one. Indonesia AI regulation is the largest open question in Southeast Asia’s compliance map: when the two drafts enact, every vendor selling AI into ASEAN inherits a 270-million-user market with a written risk framework, and every regional comparison gets redrawn around it. Indonesia also carries ASEAN’s heaviest AI usage footprint without a matching startup funding base, so the rules will bind deployers mainly, the companies wiring foreign AI systems into Indonesian data and Indonesian users. That asymmetry is why the drafts apply broadly across enterprise sizes, as the trackers note, and why the checklist above works for a two-person agency as well as a bank.

For teams planning 2027 budgets, the sensible planning posture is simple: build to the tier map and to the current data law as if both are permanent, and treat the signed text as an adjustment later. That posture costs less than waiting, and it survives every plausible version of the final regulation.

The Watch List: What Changes the Picture Next

Four triggers refresh every claim this guide makes about Indonesia AI regulation:

• The signature. President Prabowo signing either document moves it straight from draft to law, and the published text becomes the only version that counts for planning.
• The sanctions question. If the published text adds sanctions the drafts lack, enforcement consequences change for every deployer.
• OJK updates. The financial supervisor’s AI expectations evolve on a separate schedule from the umbrella regulation.
• The end-of-2026 expectation. The Tech for Good Institute’s tracking expects enactment by year-end if coordination holds; if 2027 opens with both documents unsigned, read that as coordination failing again, as it did through 2025.

Until one of those fires, the summary stands: Indonesia AI regulation is a finished drafts problem, not a rules problem, and the binding obligations live in the PDP Law, the EIT Law, and sector supervision like OJK’s.

FAQ

Is there an AI law in force in Indonesia right now?

No. As of November 2026, Indonesia has no AI-specific law in force. AI users answer to existing law: the Personal Data Protection Law (effective October 2024), the Electronic Information and Transactions Law, and sector rules such as OJK’s governance expectations for banking. The two draft Presidential Regulations on the AI roadmap and AI ethics await the President’s signature.

What are the two draft Presidential Regulations?

One sets a National AI Roadmap for 2026-2029 with priority sectors including finance, health, education, food security, and defence. The other installs AI ethics rules with three risk tiers and mitigation duties. Komdigi prepared both, public consultation ran in August 2025, harmonisation finished in April 2026, and both await signature at the State Secretariat.

Will the new Indonesia AI regulation carry fines?

The drafts at the heart of Indonesia AI regulation set no sanctions of their own. Officials have said enforcement would rely on existing laws, principally the Electronic Information and Transactions Law and the Personal Data Protection Law. That design makes the ethics regulation a governance and labeling layer over existing liability. Whether the published text keeps that choice is one of the watch items.

Which AI uses count as high risk under the draft rules?

Per the trackers’ reading of the drafts: processing sensitive personal data, and uses that significantly affect essential public services. Businesses should map their systems against those two markers now, because both categories already carry obligations under the Personal Data Protection Law regardless of the new regulation.

What should a company selling into Indonesia do about AI regulation today?

Inventory AI systems with their data flows, map them against the three draft tiers, verify PDP compliance for the data involved, check EIT exposure for content and communication features, meet OJK expectations if the customer base includes Indonesian financial firms, and track the State Secretariat for the signature.

When will Indonesia’s AI regulations take effect?

Not announced as a date. The Indonesia AI regulation drafts reached signature-readiness in April 2026, the Tech for Good Institute’s 2026 tracking expects enactment by the end of 2026 if inter-ministerial alignment holds, and any published date will come with the signature event itself.

@online{agron2026indonesiaai,
  author       = {Agron, Edmon},
  title        = {{Indonesia AI Regulation: the Roadmap and the Rules Businesses Must Meet}},
  year         = {2026},
  date         = {2026-11-12},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/indonesia-ai-regulation-roadmap/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Indonesia AI Regulation: the Roadmap and the Rules Businesses Must Meet
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/12/
UR  - https://worldngayon.com/indonesia-ai-regulation-roadmap/
Y2  - 
ER  -