How Governments Are Approaching AI Rules, and What Thai Businesses Should Do Now

The shared idea: match the rules to the risk

Rather than treating all AI the same, many governments reason that the more a system can affect people's rights, safety or opportunities, the stronger the safeguards should be. A tool that recommends songs is low risk. A tool that helps decide who gets a loan or a job interview affects lives directly and deserves more scrutiny.

This helps businesses set priorities. You do not need heavy paperwork for every feature, only real effort where the impact is highest.

EU AI Act basics worth knowing

The European Union has a central AI law, the EU AI Act, which sorts AI systems into risk tiers. Unacceptable uses are banned. High-risk systems need risk management, technical documentation, good-quality data and human oversight. Limited-risk systems mostly need transparency, such as telling users they are talking to an AI, and minimal-risk uses face little extra regulation.

It can matter to a Thai company, for example if you sell a product with AI features to customers in Europe. Details and timelines are phased in by category, so check official sources or a legal adviser from time to time.

• Unacceptable risk: prohibited.
• High risk: documentation, testing and human oversight required.
• Limited risk: transparency duties, such as disclosing AI.
• Minimal risk: few added rules.

Sector guidance and voluntary frameworks

Not every country has a single AI statute. Some let regulators in finance, health or advertising issue their own guidance and apply existing laws, such as consumer protection and data protection, to AI. If you work in a regulated industry, start with what your sector regulator has said.

Alongside this sit voluntary frameworks, such as the AI risk management framework from a US standards body and the international standard for AI management systems. They are not mandatory, but they give you a structure and make it easier to answer questions from corporate customers and partners.

Rules will keep changing, but a team that writes down its own decisions adapts faster.

Thai businesses: start with documentation and an AI inventory

The first step you can take today is a list of where your organisation uses AI, both what your team builds and tools staff already use, like chatbots, CV screeners or writing assistants. For each, record the purpose, the owner, the data involved, the model provider and the risk you assessed.

This does not have to be fancy. A spreadsheet that is kept current will do. When someone asks how a system works and who is responsible, you can answer at once, and regulators and enterprise customers tend to want exactly that.

Data: PDPA remains the foundation

In Thailand, the law that bites hardest on AI in practice is still the PDPA, since most AI systems touch personal data. Review what data you feed in, whether you have a lawful basis or consent, whether you state the purpose clearly, and whether sending data to outside providers or across borders is done under suitable conditions.

Also look at where data used for tuning or testing came from, and have a process for data subject requests such as deletion or correction. That process must actually work with your AI systems, not only with your main database.

Human oversight and keeping up with changes

Every framework above agrees that decisions with a large effect on people should be reviewable by a person. Decide who can override or correct the AI's output, how an affected user can contest a result or ask for human review, and keep logs so you can reconstruct the reasoning.

Finally, AI rules are still moving. Give one person the job of tracking announcements from relevant Thai authorities and from the markets you sell into, and review your AI inventory at least once a year.