Thailand AI Act: the Draft Rules, Who They Cover, and the Fines

Key Takeaway

• 🇹🇭 Thailand AI Act status as of November 2026: still a draft, and a detailed one. The Electronic Transactions Development Agency (ETDA) released the full draft Artificial Intelligence Act in July 2026, the public hearing closed on August 14, 2026, and the draft now moves toward Cabinet approval. Thailand has no AI statute in force.
• 🏭 The draft covers the whole value chain: AI developers, service providers, deployers, and platform service providers all fall inside its scope, with duties that follow the system rather than the job title.
• 💰 The fines are baht-scale and tiered by violation: the draft sets civil liability plus fines up to 5 million baht for prohibited-practice breaches, and fines up to 1 million baht for ignoring supervisory orders, with enforcement escalation up to court-ordered service suspension.
• 🏷️ Labelling and disclosure are core duties: AI-generated content would need labelling, users would get notification mechanisms, and record-keeping obligations apply across the chain.
• ✅ Tonight-action: if you deploy AI in Thailand or serve Thai users, map your systems against the draft’s role categories (developer, provider, deployer, platform) and start a record-keeping habit now, because those two moves carry the heaviest obligations in the text.

Thailand AI Act discussions in 2026 moved from abstract policy talk to a fully drafted statute, and that draft is unusually specific about who answers for what. ETDA published the draft in July 2026, ran the hearing through mid-August, and per the public Thailand status timeline the draft is now headed for the Cabinet process. Nothing is law yet, which makes this the right moment to read the Thailand AI Act text: draft-stage rules are changeable, and the businesses that comment and prepare during the draft window shape both the final text and their own readiness.

This guide walks the draft’s scope, the obligations it would attach to each role, the enforcement ladder, the fine figures published so far, and the separate banking-lane track with its own schedule. Where a figure is draft-stage, the piece says so plainly, because draft numbers have a habit of moving before gazette day.

Thailand AI Act Status: Where the Draft Stands

The verified sequence, each step dated to its source:

ETDA, the Electronic Transactions Development Agency, is Thailand’s e-transactions regulator, and it ran earlier AI governance work as guidance before producing this statutory draft. The agency’s July text is the Thailand AI Act’s first full attempt at a comprehensive framework, and the hearing drew the standard policy-firm fleet, an early sign that the text matters beyond Bangkok.

The regional frame sharpens the significance: Vietnam’s binding law is in force, Indonesia’s drafts wait for a presidential signature as covered in the Indonesia AI regulation guide, Malaysia’s Bill targets early-2027 tabling per the Malaysia AI law status piece, and Thailand’s draft sits at the Cabinet gate. Within one year, every major Southeast Asian economy has an AI framework either in force, awaiting executive action, or awaiting parliament.

Thailand AI Act Roles: Who the Draft Covers

The draft attaches duties by role across the AI value chain, and the four categories matter because a company can hold more than one at once:

A single product launch can place one company in two roles: the travel platform that builds its own itinerary model is developer and deployer at once. The draft’s obligations key to what you do with the system, not to what you call yourself, which is why the inventory exercise in the closing checklist comes first.

The Duties the Draft Would Attach

Per the draft’s published summaries, obligations concentrate in five areas: risk assessment and mitigation, AI-content labelling and disclosure, user notification mechanisms, record-keeping, and compliance with supervisory orders. The labelling duty is the one consumers will actually see: AI-generated content would carry disclosure, so Thai users could tell generated media from recorded reality, a rule aimed straight at the fraud vector we documented in the AI scam compounds landscape, where cloned voices and real-time deepfakes are already factory-standard.

Record-keeping is the quiet workhorse. The draft’s documentation expectations mean deployments need logs, versions, and decision trails from day one, which is exactly the discipline that turns a regulator’s question later into a file retrieval instead of a scramble.

Thailand AI Act Fines: the Draft Numbers

The draft’s penalty schedule is tiered by violation type, per the law firms tracking the text:

The enforcement ladder climbs past money: the regulator may order providers and deployers to rectify insufficient measures, and with ministerial approval it may petition the court to suspend a service temporarily, an escalation that hits revenue, not just the finance team. Every figure above is draft-stage, carries its source, and sits inside the Thailand AI Act’s enforcement ladder, so the numbers businesses should budget against are these bands until the Cabinet-stage text publishes.

The Banking Lane Runs on a Separate Schedule

Thailand’s financial-sector AI and security rules do not wait for the Thailand AI Act. The Bank of Thailand released its revised draft Notification on Digital Channel Security for a second public consultation running through November 6, 2026. Banks and their AI-powered digital channels answer to BOT instruments on their own schedule, so a Thai financial institution reads two schedules: the AI Act draft for the general framework, and BOT notifications for the binding, sector-specific layer that already disciplines their channels.

The drafting history explains the split’s logic as well. Thailand’s AI governance work started as agency guidance, guidance that asked for voluntary alignment while the market scaled, and the statutory draft arrives years after the practices it rules on were already common. That sequence means the Act’s obligations will not feel new to disciplined operators so much as codified: assessments, records, and disclosures the careful ones already keep become the baseline everyone must keep. The draft-stage review period is therefore the cheapest regulatory window a Thai AI operator will ever see, because comment-stage influence and readiness-building cost a fraction of post-enactment catch-up.

That split is the practical reality of Thai compliance: sector supervisors move first where risk concentrates, and the umbrella statute arrives later to standardize the rest. Businesses in other regulated lanes, health and telecom among them, should expect their own sector layers after the Act’s shape settles.

A Worked Example: Mapping One Thai Business

Concretely: a Thai hotel chain deploys an AI concierge built by a regional vendor, listed inside a domestic super-app. Three entities, three draft roles. The hotel is the deployer: it runs the system on guests, so the operational duties sit with it, including the user-notification habit when guests interact with generated content and the records that show what the concierge answered. The vendor is the provider: it made the system available, so risk-assessment documentation for the model’s design follows it, wherever it is incorporated. The super-app is the platform service provider: it distributes the AI service to consumers, so listing, disclosure, and cooperation duties attach. One product, three duty sets, none of which depends on where the company is headquartered, which is the draft’s whole allocation scheme in one booking flow.

Now scale the exercise: a mid-size Thai company running five AI touchpoints, from marketing generation to an HR screening tool, walks the same mapping per system and immediately sees which touchpoints would land in heavier duty buckets, and which ones already generate the records the draft expects. That is the entire readiness gap analysis in an afternoon, and it is the exercise the draft’s structure is quietly asking every deployer to run before the text finalizes.

How the Draft Reads Against Its Neighbours

Comparative context clarifies what Thailand chose. The Thailand AI Act draft carries broader role vocabulary than the EU AI Act’s provider-versus-deployer split, because the platform service provider category catches marketplaces and app stores that merely distribute AI, a group the European text reaches only through separate digital rules. Against Vietnam’s enacted law, the Thai draft leans harder on labelling and disclosure as visible consumer protections. Against the region’s pending texts, the Indonesian drafts and Malaysia’s bill, the Thai document is the most specific about content provenance, which tracks the country’s acute exposure to online fraud, a problem the regional scam economy industrialized and that we mapped in the AI scam compounds guide.

The role table also explains the draft’s reach into small business. A Thai company that merely embeds a vendor’s AI feature is a deployer; the vendor abroad is likely a provider; the marketplace listing both is the platform service provider. Duties scale by role, so the heaviest documentation weight lands on whoever controls the system’s design, while deployers carry the operational duties that sit closer to users. That allocation is the same logic Europe, Indonesia, and Malaysia all converged on, and it means Thai deployer readiness looks similar whichever regional text finalizes first.

The Working Checklist and the Watch Items

The checklist while the draft sits at Cabinet (steps per the published draft summaries, as of November 2026):

• Classify your role or roles for every AI system touching Thailand, using the four-category table above.
• Stand up risk-assessment records for higher-impact systems, because assessment and mitigation duties anchor the draft.
• Plan the labelling pipeline for AI-generated content now, since disclosure obligations are design work, not paperwork swaps.
• Start record-keeping on versions, inputs, and decisions, the cheapest compliance habit to begin early.
• If you are in banking, follow the BOT track separately and meet the November consultation calendar in force.
• Assign one owner for the draft’s status, since a Cabinet decision or revised text can land between quarterly reviews and change which checklist rows apply.

Four triggers refresh this Thailand AI Act guide: the Cabinet’s decision on the draft, any published revised text after the hearing feedback, the fine schedule’s final numbers, and the Act’s gazettement, which sets true effective dates. Until one lands, Thailand AI Act obligations are planning inputs, not law, and Thailand’s binding AI-adjacent rules remain the sector instruments already in force.

FAQ

Is the Thailand AI Act law yet?

No. As of November 2026 Thailand has no AI statute. The draft Act was published by ETDA in July 2026, the public hearing closed August 14, 2026, and the draft is moving toward Cabinet approval. Obligations become law only at passage and gazettement, which is why every figure and duty in this guide carries its draft-stage label rather than an enacted one.

Who does the draft Thailand AI Act cover?

The draft covers the AI value chain: developers building systems, providers offering them, deployers running them in operations, and platform service providers hosting or distributing AI. A company can hold several roles at once, and duties key to the role performed.

What are the fines under the draft Thailand AI Act?

Draft-stage figures: prohibited-practice breaches carry civil liability plus fines up to 5 million baht; ignoring supervisory orders carries fines up to 1 million baht; serious-incident management failures carry their own tiered fines in the text. Enforcement can escalate beyond fines to court-ordered temporary service suspension with ministerial approval. All figures are draft-stage.

What duties would the Act attach?

Five areas concentrate the text: risk assessment and mitigation, AI-content labelling and disclosure, user notification mechanisms, record-keeping, and responding to supervisory orders. Labelling and record-keeping are the two that change daily operations most, because one is a product-design decision and the other is a standing operational habit rather than a one-time filing.

How does the Thailand AI Act compare with Vietnam’s law?

Vietnam’s binding AI law is already in force, so Thai operators face the region’s first enacted statute on the Vietnamese side of their trade. Thailand’s draft, still at Cabinet, follows a similar value-chain logic with its own role definitions and penalty schedule, and the two texts are expected to be read together by companies serving both markets.

What should a business serving Thai users do right now?

Map every AI system against the Thailand AI Act’s four draft roles, begin risk-assessment records for higher-impact systems, plan AI-content labelling into product design, start documentation habits, and track the BOT consultation calendar if your lane is banking. Then watch the Cabinet decision, because the published revised text is where every draft number gets its final form.

@online{agron2026thailandai,
  author       = {Agron, Edmon},
  title        = {{Thailand AI Act: the Draft Rules, Who They Cover, and the Fines}},
  year         = {2026},
  date         = {2026-11-12},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/thailand-ai-act-draft-rules/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Thailand AI Act: the Draft Rules, Who They Cover, and the Fines
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/12/
UR  - https://worldngayon.com/thailand-ai-act-draft-rules/
Y2  - 
ER  -