Tag: Commercial

on by

Thailand Moves Toward a Dedicated Regulatory Framework for Data Centers

Thailand may soon take a significant step toward regulating its rapidly expanding data center industry. According to recent reports, the government is preparing a Prime Minister’s Office Regulation that would establish a dedicated framework for overseeing data center operations, with particular emphasis on resource management, environmental impacts, and centralized regulatory oversight. While the proposed regulation has not yet been issued, it signals a potential shift from Thailand’s current investment-driven approach toward a more comprehensive regulatory model for the sector.

Background:

Thailand has become an increasingly attractive destination for data center investment due to strong government incentives, growing cloud adoption, and its strategic location in Southeast Asia. However, the rapid expansion of large-scale facilities has also raised concerns regarding infrastructure capacity, particularly electricity and water consumption.

According to the reported proposal, the government intends to introduce a dedicated regulatory mechanism to better coordinate oversight of the industry and manage its broader impacts on national resources.

Proposed regulatory framework:

The reported proposal indicates that the Prime Minister’s Office Regulation would establish a new committee responsible for supervising data center activities. Its responsibilities would reportedly include:

  • overseeing the overall development of the data center industry;
  • assessing the impacts of data center investments;
  • monitoring resource consumption, particularly electricity and water usage;
  • coordinating regulatory oversight among relevant government agencies; and
  • supervising approvals, permits, and compliance monitoring.

Although further details have not yet been published, the proposal suggests that the government intends to create a more centralized oversight structure than currently exists.

Addressing fragmented regulation:

At present, data center projects typically interact with multiple government agencies depending on the nature of the project. Investors may require approvals or incentives from different authorities, while utility arrangements are often negotiated separately.

The reported proposal appears intended to address this fragmented regulatory landscape by introducing a dedicated governance mechanism specifically focused on data centers.

Greater focus on infrastructure and resource management:

A notable feature of the proposal is its emphasis on resource planning.

According to the reports, the government has identified several concerns, including:

  • increasing electricity demand from large-scale data centers;
  • substantial water consumption required for cooling systems;
  • challenges in forecasting future resource demand; and
  • overlapping arrangements for water supply that may complicate national infrastructure planning.

The proposal therefore appears to reflect a policy objective of integrating data center development with broader infrastructure and environmental planning rather than regulating the industry solely from an investment perspective.

Different treatment for existing and future projects:

The reported framework would distinguish among three categories of data centers:

Existing operating facilities

Existing operators may become subject to audits or assessments focusing on matters such as resource consumption, temperature management, and noise impacts.

Approved projects under development

Projects that have already received approvals but are not yet operational may be required to comply with additional regulatory conditions before commencing operations.

Future applicants

New projects may become subject to a comprehensive regulatory regime addressing matters such as:

  • sustainable water management;
  • reserve water sources;
  • environmental impacts; and
  • measures designed to reduce adverse impacts on surrounding communities.

This tiered approach suggests that the government is seeking to avoid disrupting ongoing investments while progressively strengthening regulatory requirements for future developments.

Potential changes to location planning:

The reports also indicate that the government is considering a more strategic approach to determining where future data centers should be located.

Rather than concentrating additional facilities in existing investment hubs, policymakers are reportedly evaluating locations with stronger electricity and water infrastructure, including areas near major power generation facilities. The government has also indicated that supporting digital infrastructure, such as fiber-optic networks, could be expanded if new data center clusters are developed.

What investors should watch:

Although the proposal remains at the policy stage, investors and operators should monitor several issues as the framework develops:

  • the legal authority under which the new committee will operate;
  • whether additional licensing or approval requirements will be introduced;
  • technical standards relating to electricity, water use, and environmental impacts;
  • transitional requirements applicable to existing operators; and
  • the interaction between the new framework and existing approvals issued by sector-specific regulators.

The final regulatory approach will determine whether the proposed framework primarily serves as a coordination mechanism or introduces substantive compliance obligations for the industry.

Key takeaways:

  • Thailand is reportedly preparing a dedicated regulatory framework for data centers through a proposed Prime Minister’s Office Regulation.
  • The proposal reflects increasing government attention to electricity consumption, water usage, and environmental impacts associated with large-scale data center investments.
  • A new committee may be established to coordinate oversight of approvals, compliance, and resource management.
  • Existing facilities, projects under development, and future investments could become subject to different regulatory requirements.
  • Although the proposal has not yet been formally issued, investors planning data center projects in Thailand should closely monitor further regulatory developments, as they may significantly affect project planning, compliance obligations, and site selection.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Parliament Considers Carbon-Credit Sales from Community Forests

A member-sponsored bill before Parliament could provide a clearer statutory basis for the sale of carbon credits generated from community forests. The Draft Community Forest Act Amendment was proposed by members of the House of Representatives, and its official description identifies its purpose as adding provisions concerning the sale of carbon credits. The proposal is currently undergoing public consultation under Section 77 of the Constitution and is not yet binding law. It remains subject to the legislative process and may be revised before enactment.

The proposal is nevertheless significant because community-forest carbon-credit activities already exist in practice, while the Community Forest Act was principally designed to regulate community participation in forest conservation, restoration, management, and sustainable use rather than transactions in carbon assets. The amendment should therefore not be understood as creating community-forest carbon projects for the first time. Its significance lies in seeking to place the sale of carbon credits more expressly within the statutory framework governing community forests.

Ownership, authority, and community approval:

One of the most important issues is the legal entitlement to carbon credits generated from a community forest. Ownership or control of the underlying land, statutory rights to manage the forest, responsibility for maintaining carbon stocks, entitlement to register a carbon project, and ownership of the resulting carbon credits are not necessarily the same thing. For project developers and purchasers, the relevant question is therefore not simply whether credits have been issued under a recognized carbon program, but whether the seller has a sufficient legal basis to claim and transfer them.

Closely related is the question of who has authority to approve a carbon project and sell the resulting credits. Community forests operate through statutory community-management structures, while carbon projects may involve commitments extending over many years. Project agreements may cover project registration, monitoring and verification, responsibility for development costs, allocation of credits, exclusivity, forest-management obligations, sale of credits, and distribution of revenues. The authority of the community representatives entering into those arrangements is therefore important, particularly where a developer is granted long-term or exclusive rights.

The final legislation will also need to be considered carefully in relation to community approval. A decision to enter into a long-term carbon project may have consequences extending beyond ordinary forest management, particularly where future carbon revenues or carbon rights are committed to a private developer. Any statutory requirements concerning community meetings, resolutions, voting, disclosure, or government approval could therefore become relevant not only to regulatory compliance but also to the validity and bankability of the project.

Revenue allocation and project agreements:

Benefit sharing will be another central issue. Community-forest carbon projects already operate against a background of administrative arrangements dealing with carbon-credit revenues and community benefits, so the proposed amendment will need to be read together with the existing framework. An important point to watch is whether the amended Act itself establishes principles for allocating proceeds from carbon-credit sales or leaves the details to subordinate regulations.

The commercial implications are substantial. Developers may bear the costs of feasibility studies, project design, carbon measurement, registration, verification, monitoring, and financing, while communities provide the forest stewardship and management activities on which the carbon benefits depend. Project-development agreements therefore need to deal clearly with project costs, entitlement to issued credits, authority to market and sell those credits, allocation of revenues, reporting obligations, and the duration of the developer’s rights. They should also address the particular risks of forest-carbon projects, including fire, illegal logging, natural disasters, changes in forest management, and other events that may reduce credit generation or result in carbon reversal.

If the amendment introduces mandatory rules on approval, sales, or benefit sharing, existing contractual models may need to change. Developers negotiating new projects should therefore avoid relying on broad provisions simply assigning all “carbon rights” to the developer without examining whether those rights can legally be granted, by whom, for what period, and subject to what approvals.

Existing projects and corporate purchasers:

The treatment of existing projects will be particularly important. Community-forest carbon projects may already be governed by agreements among communities, developers, government agencies, and other participants. If the amended Act introduces new requirements concerning authority, approval, sale, or revenue allocation, the question will be whether those requirements apply only to future projects or also affect existing arrangements. The final legislation and any transitional provisions should therefore be reviewed carefully. Existing agreements may also need to be assessed for change-in-law provisions and for clauses dealing with ownership and allocation of credits, exclusivity, benefit sharing, duration, and termination.

For companies purchasing community-forest carbon credits, a clearer statutory framework could improve legal certainty, but it should not replace transaction-level due diligence. Buyers should establish the legal status of the community forest, the authority through which the project was approved, compliance with applicable community and government approval requirements, the developer’s entitlement to the credits, applicable benefit-sharing arrangements, and whether the credits have previously been sold, allocated, pledged, or otherwise committed.

There is also an important distinction between carbon-program eligibility and legal entitlement to transact. Registration or issuance under a recognized carbon standard demonstrates compliance with the requirements of that program, but should not necessarily be regarded as conclusive evidence that all underlying questions of ownership, community authorization, or contractual authority have been resolved. This is especially relevant to long-term off-take arrangements for future credits, where the purchaser assumes project-development and regulatory risks in addition to ordinary delivery risk.

What to watch:

The proposal remains a member-sponsored parliamentary bill rather than a change in current law. Businesses should therefore not restructure existing projects on the assumption that it will be enacted in its present form. Its progress is nevertheless worth following because it addresses an increasingly important intersection between community forest management and the carbon market.

If enacted, a clearer statutory framework could strengthen the basis on which communities derive economic benefits from forest conservation, provide greater certainty for developers investing in community-forest carbon projects, and make the resulting credits easier for corporate purchasers to diligence. Much will depend on how the final legislation addresses ownership, authority to sell, community approval, revenue allocation, benefit sharing, and existing projects.

Key takeaways:

  • Corporate purchasers should examine the underlying legal entitlement to community-forest credits rather than relying solely on their registration or issuance under a carbon standard.
  • The proposed amendment was initiated by members of the House of Representatives and specifically addresses the sale of carbon credits from community forests. It is undergoing public consultation under Section 77 of the Constitution and is not yet binding law.
  • Community-forest carbon-credit activities already exist. The proposal is significant because it could provide a more express statutory foundation for the sale of those credits.
  • Carbon-credit ownership, authority to sell, and community approval are separate legal issues and will be important for both project structuring and buyer due diligence.
  • Project-development agreements may need to address statutory requirements concerning approval and benefit sharing, as well as project costs, allocation of credits, exclusivity, carbon-reversal risks, and changes in law.
  • Existing projects should monitor the final legislation and any transitional provisions to determine whether current contractual arrangements will need to be reviewed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

United States Finalizes Section 301 Tariff Framework Based on Forced Labor Enforcement: Thailand Subject to a 12.5% Tariff

In our previous article (USTR Section 301 Forced-Labor Determinations: Implications for Thailand – The Legal Co., Ltd.), we discussed the U.S. Section 301 investigation involving approximately 60 trading partners, including Thailand, and Thailand’s response to the proposed tariff measures through trade negotiations and domestic regulatory reforms.

The Office of the United States Trade Representative (“USTR“) has now concluded that review, announcing the final tariff framework under Section 301 of the Trade Act of 1974 on 23 July 2026. The framework imposes additional tariffs ranging from 10% to 12.5% on imports from approximately 60 trading partners, effective from 24 July 2026.

Although Thailand actively participated in the consultation process and sought both a reduction in the proposed tariff rate and additional product-specific exemptions, it remains subject to the higher 12.5% tariff, which took effect immediately upon the expiry of the preceding tariff measures.

The final framework is significant not only for the additional tariffs it introduces, but also for what it signals: the United States’ continued use of trade policy as a lever to address forced labor concerns and to encourage stronger labor standards and supply chain governance among its trading partners.

Overview of the Final Tariff Framework

The final framework adopts a tiered approach, with tariff rates determined by the USTR’s assessment of each trading partner’s efforts to prevent goods produced using forced labor from entering the U.S. market.

  • 10% tariff — applies to countries that (i) already prohibit imports of goods produced using forced labor, (ii) have committed to implementing such measures through reciprocal trade arrangements, or (iii) have introduced measures offering some protection against such imports. Countries in this category include Argentina, Bangladesh, Cambodia, Canada, Ecuador, El Salvador, Guatemala, Honduras, India, Indonesia, Jordan, Malaysia, Mexico, Pakistan, Sri Lanka, Trinidad and Tobago, and the United Kingdom.
  • 12.5% tariff — applies to countries the United States considers not to have implemented sufficiently effective measures to prevent goods produced using forced labor from entering U.S. supply chains. Thailand falls within this category, alongside China, Hong Kong, Japan, the Philippines, Singapore, and Vietnam, among other trading partners.

According to the USTR, the final framework applies to trading partners representing approximately 99.4% of total U.S. imports. Certain products remain exempt, including oil, natural gas, and goods that cannot be sourced domestically in the United States.

Legal Significance

Beyond the tariff rates themselves, the legal basis for the framework carries equal significance.

According to publicly available reports, the United States introduced the final tariff framework after the U.S. Supreme Court ruled that tariffs previously imposed under emergency powers were unlawful. Rather than relying on those emergency powers, the U.S. government has instead invoked Section 301 of the Trade Act of 1974, which authorizes the USTR to act against foreign government policies or practices considered unfair or burdensome to U.S. commerce.

This development demonstrates that, notwithstanding new limits on the use of emergency powers, the United States continues to rely on existing trade legislation to pursue its broader trade policy objectives. It also reflects a growing trend in which labor standards, human rights, and supply chain governance are increasingly treated as matters of international trade compliance, rather than solely as corporate social responsibility or ESG considerations.

Business Implications

The practical implications of the final tariff framework extend beyond the tariffs themselves.

Businesses exporting to the United States — including manufacturers, suppliers, and other participants in global supply chains — should expect increased requests from customers and business partners to demonstrate that their products are free from forced labor and that appropriate due diligence has been conducted throughout the supply chain.

Businesses should therefore consider:

  • reviewing supplier due diligence procedures;
  • strengthening supply chain traceability;
  • maintaining documentation on product origin and manufacturing processes; and
  • monitoring developments in U.S. trade policy, as well as Thailand’s proposed Human Rights Due Diligence (HRDD) framework.

Taking these steps early may help businesses respond more effectively to evolving customer expectations, reduce compliance risk, and minimize disruption to cross-border trade.

Key Considerations for Businesses

The final tariff framework reinforces the growing convergence between international trade policy, labor standards, and supply chain governance. While the immediate consequence is the additional 12.5% tariff imposed on imports from Thailand, the broader implication is that businesses should expect increasing scrutiny of their supply chains and rising expectations around responsible sourcing and human rights due diligence.

Businesses with operations or supply chains connected to the United States should review their existing compliance programmers, strengthen supplier due diligence and traceability measures, and continue monitoring regulatory developments in both the United States and Thailand to remain prepared for evolving trade compliance requirements.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Tomorrowland Thailand 2026: Business Opportunities and Operational Readiness for Local Investors

WeAreOne.World (Thailand) Co., Ltd., a Thai-Belgian joint venture, has received investment promotion approval from the Board of Investment (BOI) to organize Tomorrowland Thailand, a world-class electronic dance music (EDM) festival. The event will take place at Wisdom Valley, Chonburi Province, from December 11 to 13, 2026, marking the festival’s first-ever edition in Asia and featuring a star-studded lineup of internationally renowned artists and DJs.

The project is a joint venture between TL International BV, a subsidiary of the Belgium-based Tomorrowland Group, and Thailand’s One Asia Ventures Co., Ltd. TL International BV brings more than two decades of experience organizing EDM festivals worldwide, while One Asia Ventures has produced major music events in Thailand.

All 50,000 daily tickets — 150,000 in total across the three-day event — have officially sold out. Over 85% of attendees, or approximately 127,500 people, are expected to be international visitors, led by primary markets including Malaysia (8.5%), Singapore (7.5%), and Australia (6.5%), alongside secondary markets in Europe (8%) and the United States (3.5%).

Benefits for Thai Business Operators and Local Investors

The festival is projected to generate 6.13 billion Baht (approximately EUR 159 million) in immediate economic value, with a potential contribution exceeding 21,386 million Baht over its planned five-year run (2026–2030). This positions Thailand as a global event hub, driving revenue across hotels, accommodation, restaurants, transportation, and regional service providers.

1. Tourism, Hotels, and Accommodation Ticket sales have already driven more than 22,000 ticket-and-accommodation package bookings, along with over 250 pre and post-festival travel itineraries designed to extend visitor stays by one to two weeks. These offerings are well positioned to capture high-spending, long-stay travelers, allowing Thailand’s tourism sector to fully benefit from the event.

2. Creative and Music Industry Government representatives anticipate long-term advantages for Thailand’s creative sectors. By bringing world-class staging, acoustics, lighting, and visual production technology to the country, the event will give local designers and crew hands-on experience with international-standard setups — supporting Thailand’s long-term capability to host major global events.

3. Local Suppliers and Service Providers (Direct Impact) Event organizers will procure and contract directly with Thai suppliers and service providers, with an allocated budget exceeding 1,092 million Baht (EUR 28 million). This spans production and infrastructure, food and beverage, workforce and staffing, logistics and transportation, hospitality, venue management, and other local services.

4. Retail, Restaurant, and Transport Sector (Indirect Impact) Local businesses stand to benefit from more than 5,309 million Baht (EUR 131 million) in indirect economic circulation, generated by visitor spending on retail, local travel, and extended stays in neighboring provinces.

5. Job Creation The festival is expected to generate up to 21,386 jobs across tourism, events, logistics, and hospitality, beginning with 1,900 positions in its first year, with priority given to Thai personnel. Knowledge-transfer initiatives — including a DJ Academy and Festival Academy — will further build local expertise in festival management.

Preparation for Thai Business Operators and Investors

To capitalize effectively on the capital circulation generated by Tomorrowland Thailand, local businesses should prepare across five key areas:

1. Service Standards and Multilingual Support With international visitors making up the majority of attendees, hotel, restaurant, and transport operators should train staff in English and key ASEAN languages, and ensure full integration of international payment gateways (credit cards, digital wallets, and e-payment systems).

2. Long-Stay Travel Packages As the event falls in December, many attendees are likely to extend their stay by one to two weeks. Tourism operators in Chonburi, Rayong, and surrounding provinces — including Bangkok and Chiang Mai — should develop experiential travel packages, airport transfer services, and premium programs tailored to high-spending travelers.

3. Supplier and Production Readiness Businesses in events, production, lighting, audio, logistics, F&B, and security should upgrade operational, hygiene, and safety standards to international levels to compete for direct-procurement subcontracts. Commercial agreements should be drafted clearly and enforceably to protect business interests.

4. Cross-Border Business and Contractual Readiness Businesses pursuing joint ventures, co-branding, or merchandise sales at the event should establish robust JV agreement structures and carefully review trademark licensing requirements to avoid intellectual property infringement.

5. Regulatory Compliance Operators should review all applicable laws for large-scale festival operations and establish clear compliance frameworks, including:

  • Food, Beverage, and Alcohol Control Laws: Temporary liquor sales permits must be obtained from the Excise Department for on-site sales points, with strict age-verification (20 years and older, as required by law).
  • Personal Data Protection Act (PDPA): Operators collecting customer data, using ticket or room scanning systems, or capturing photos/video for promotional use must provide proper privacy notices and implement valid consent mechanisms.

Author: Panisa Suwanmatajarn, Managing Partner

Other Articles

on by

Integrating Cybersecurity, Fraud Response, and PDPA Compliance: Practical Implications of the Proposed Digital Channel Security Framework

The Bank of Thailand (BOT) has released a proposed Digital Channel Security framework that would strengthen expectations for authentication, fraud prevention, incident response, and the governance of digital financial services. While the proposal focuses primarily on enhancing the security and resilience of digital channels, financial institutions should not view these requirements in isolation.

In practice, a single cybersecurity incident frequently triggers multiple legal and regulatory obligations simultaneously. For example, an account takeover resulting from a phishing attack may require an institution to activate its cybersecurity incident response procedures, implement fraud mitigation measures, assess whether a personal data breach has occurred under the Personal Data Protection Act (PDPA), evaluate outsourcing or third-party service provider involvement, and make appropriate internal and regulatory notifications.

Although these obligations arise from different legal and regulatory sources, organizations may benefit from managing them through a coordinated incident response framework. This article examines the practical implications of the proposed BOT framework alongside existing obligations under the PDPA and broader operational governance practices.

From cybersecurity to operational resilience:

The proposed framework reflects an increasing regulatory emphasis on operational resilience rather than viewing cybersecurity solely as an information technology function. It places greater focus on preventing, detecting, responding to, and recovering from threats affecting digital financial services while maintaining the continuity and integrity of critical operations.

At the same time, financial institutions should recognize that cybersecurity incidents rarely occur in isolation. A single event may involve operational disruption, attempted fraud, compromise of customer credentials, unauthorized disclosure of personal data, and third-party service providers. As a practical matter, organizations may therefore benefit from adopting governance arrangements capable of addressing these interconnected risks through a unified response process.

Governance beyond information technology:

The proposed framework emphasizes that responsibility for digital channel security extends beyond information security teams.

Boards of directors and senior management are expected to establish appropriate governance, oversee digital risks, allocate adequate resources, monitor security performance, and ensure that significant incidents are escalated appropriately.

From a broader governance perspective, institutions should also consider ensuring that legal, compliance, privacy, operational risk, business continuity, and customer service functions are integrated into incident management processes. This cross-functional approach can help organizations address multiple regulatory obligations efficiently when significant incidents occur.

Fraud prevention as part of digital channel security:

The BOT proposal places significant emphasis on fraud prevention through enhanced digital channel security. Proposed measures include stronger customer authentication, monitoring of suspicious activities, behavioral analysis, device identification, protection against phishing and social engineering attacks, and mechanisms for responding to suspicious transactions.

These expectations primarily seek to reduce fraud risks affecting digital financial services. However, successful fraud attacks frequently have wider legal implications. Unauthorized access to customer accounts may also involve compromised personal data, contractual issues with service providers, customer remediation, and regulatory reporting obligations. Institutions should therefore consider integrating fraud response procedures into broader cybersecurity governance rather than treating fraud management as a separate operational function.

Incident response across multiple regulatory frameworks:

The proposed framework expects institutions to establish formal incident response procedures covering detection, escalation, containment, investigation, recovery, and post-incident review.

In practice, these procedures should also enable organizations to identify other legal and regulatory obligations that may arise from the same incident. Depending on the circumstances, an incident may require parallel consideration of fraud management, operational resilience measures, contractual obligations, outsourcing arrangements, and personal data protection requirements.

Developing coordinated response procedures may help reduce duplication of effort, improve decision-making, and ensure that regulatory obligations are addressed consistently across different functions.

Interaction with the Personal Data Protection Act:

The proposed BOT framework does not replace or modify existing obligations under the PDPA. Rather, the two regimes operate alongside one another.

Where a cybersecurity incident involves unauthorized access to, disclosure of, alteration of, or loss of personal data, organizations should assess their obligations under the PDPA independently of the BOT framework. This may include determining whether a personal data breach has occurred, evaluating notification obligations, preserving relevant evidence, documenting response measures, and implementing appropriate remediation.

Accordingly, organizations may wish to ensure that privacy officers, legal counsel, and cybersecurity teams participate jointly in incident response planning and tabletop exercises so that both operational and data protection considerations are addressed from the outset.

Third-party risk management:

Digital financial services increasingly depend on cloud service providers, payment processors, managed service providers, software vendors, and other external partners.

The proposed framework reinforces expectations regarding oversight of third-party service providers throughout the outsourcing lifecycle. Institutions should conduct appropriate due diligence, establish contractual security requirements, monitor vendor performance, and ensure that incident reporting and business continuity arrangements are clearly defined.

Because cybersecurity incidents involving third parties may also raise fraud and personal data protection issues, organizations should consider aligning vendor management processes with their broader incident response and compliance frameworks.

Documentation and evidence of compliance:

The proposed framework places considerable emphasis on governance, accountability, and demonstrating that appropriate controls are in place.

Organizations should maintain comprehensive records of cybersecurity governance, risk assessments, incident response activities, testing, training, vendor oversight, and business continuity exercises. From a broader compliance perspective, documentation should also support obligations arising under other applicable legal frameworks, including the PDPA and contractual commitments relating to outsourced services.

Maintaining complete records may facilitate regulatory engagement, internal investigations, and post-incident reviews while demonstrating that reasonable organizational and technical measures have been implemented.

Practical considerations:

As organizations prepare for the proposed framework, they may wish to assess not only technical cybersecurity controls but also how different compliance functions interact during a significant incident.

Areas for review may include:

  • governance and board oversight;
  • coordination among cybersecurity, legal, compliance, privacy, and operational teams;
  • fraud detection and response procedures;
  • customer authentication controls;
  • third-party risk management;
  • incident reporting and escalation processes;
  • documentation and recordkeeping; and
  • operational resilience testing and tabletop exercises.

An integrated approach may improve organizational readiness while reducing the risk that separate regulatory obligations are managed through disconnected processes.

Key takeaways:

  • The proposed BOT Digital Channel Security framework primarily addresses digital channel security, fraud prevention, governance, and operational resilience.
  • Existing obligations under the PDPA continue to apply independently where cybersecurity incidents involve personal data.
  • A single cyber incident may simultaneously trigger cybersecurity, fraud management, personal data protection, outsourcing, and operational governance obligations.
  • Although these obligations arise under different legal and regulatory frameworks, organizations may benefit from managing them through an integrated incident response framework.
  • Financial institutions should consider reviewing governance structures, cross-functional coordination, and documentation practices to improve operational resilience and regulatory compliance.

Author: Panisa Suwanmatajarn, Managing Partner

Other Articles

on by

PDPA Insights: Building Effective Privacy Governance

PDPA: AI Is Not Replacing Privacy Law—It Is Changing How We Apply It

Artificial intelligence has rapidly become part of everyday business operations. Recommendation engines personalize online shopping experiences, chatbots answer customer enquiries, fraud detection systems identify suspicious transactions, recruitment platforms screen job applicants, and generative AI assists with customer service, marketing and document preparation.

As AI adoption accelerates, organizations frequently ask whether the Personal Data Protection Act (PDPA) contains special rules governing AI.

The answer is both simple and nuanced.

Thailand’s PDPA does not establish a standalone regulatory framework for artificial intelligence. Unlike some jurisdictions that have introduced AI-specific legislation, the PDPA remains technology neutral. The same legal principles governing all personal data processing—including lawfulness, purpose limitation, transparency, data minimization, security, and accountability—continue to apply regardless of whether personal data is processed manually or through sophisticated AI systems.

Nevertheless, the Personal Data Protection Committee’s (PDPC) recent consultation on marketing and direct marketing demonstrates that the regulator increasingly recognizes AI-assisted personalization, profiling, and automated decision-making as ordinary components of modern business operations rather than exceptional technologies. This signals an important evolution in regulatory expectations. The question is no longer whether AI falls within the scope of the PDPA. Instead, organizations should consider how existing privacy principles should operate when personal data is processed at unprecedented speed and scale.

AI changes the scale—not the legal principles:

One misconception is that AI requires an entirely new compliance framework.

In reality, the core legal questions remain familiar.

Why is personal data being processed?

Is there an appropriate legal basis?

Have individuals been informed?

Is the processing proportionate?

Are appropriate safeguards in place?

These questions existed before AI and remain the foundation of PDPA compliance.

What AI changes is the scale and complexity of those questions.

A marketing employee might manually analyze one hundred customer records to recommend products.

An AI system may analyze ten million records every day, continuously refining customer profiles and generating individualized recommendations without direct human intervention.

The legal principles remain the same.

The governance challenge becomes significantly greater.

Organizations should focus on the processing—not the technology:

Discussions about AI frequently focus on algorithms.

Privacy law focuses on personal data.

Organizations should therefore avoid beginning compliance discussions with technical questions such as:

“Are we using AI?”

Instead, they should ask:

“How is personal data being collected, analyzed, combined, retained and disclosed?”

This shift in perspective has practical consequences.

An AI system recommending products based upon purchasing history raises different privacy considerations from an AI system screening job applicants or detecting fraudulent transactions.

The technology may be identical.

The processing purposes are not.

Organizations should therefore evaluate each AI use case separately rather than adopting a single enterprise-wide conclusion regarding AI compliance.

Profiling is becoming an ordinary business activity:

One of the most significant aspects of the PDPC’s recent consultation is the inclusion of profiling alongside AI-assisted marketing and automated decision-making.

This reflects commercial reality.

Retailers profile customers to recommend products.

Banks profile spending behaviour to identify suitable financial services.

Hotels profile travel patterns.

Streaming platforms profile viewing preferences.

Insurance companies profile claims histories.

Profiling has become routine.

The regulatory focus is therefore shifting away from asking whether profiling exists toward examining whether organizations understand, govern and explain how profiling operates.

Transparency becomes particularly important where profiling materially influences commercial decisions affecting individuals.

Explainability is becoming a governance issue:

Many AI systems are capable of generating sophisticated outputs while providing limited insight into how those outputs were produced.

This creates a practical challenge.

Organizations may be able to explain what an AI system does without fully understanding why it reached a particular recommendation.

The PDPA does not require organizations to explain complex algorithms.

However, organizations should be capable of explaining much more fundamental issues.

What personal data does the AI system use?

Why is that information necessary?

What business objective does the system support?

Who reviews significant outputs?

What safeguards exist to identify inappropriate outcomes?

These governance questions are likely to become increasingly important as AI adoption expands.

Vendor governance is becoming AI governance:

Few organizations develop AI systems internally.

Most rely on external providers.

Large language models.

Cloud AI services.

Marketing automation platforms.

Customer relationship management systems.

Fraud detection software.

Human resources platforms.

Consequently, AI governance increasingly depends upon vendor governance.

Organizations should understand:

  • where personal data is processed;
  • whether overseas transfers occur;
  • whether providers use customer data to train models;
  • whether subcontractors process personal data;
  • how security is maintained;
  • how long information is retained.

Vendor due diligence therefore becomes an essential component of AI governance under the PDPA.

Human oversight still matters:

AI enables organizations to automate decisions at unprecedented scale.

Automation, however, should not eliminate accountability.

Organizations should identify situations where meaningful human review remains appropriate.

Examples may include:

  1. rejecting employment applications;
  2. detecting suspected fraud;
  3. evaluating insurance claims;
  4. determining customer eligibility for significant commercial benefits.

The appropriate level of oversight will depend upon the context and the potential impact on individuals.

Organizations should therefore design governance frameworks that ensure AI supports decision-making without entirely replacing human judgement where significant interests are involved.

AI governance is ultimately privacy governance:

Perhaps the most important lesson is that organizations should resist creating isolated AI compliance programs.

Instead, AI should be incorporated into existing privacy governance.

Records of Processing Activities should identify AI-supported processing.

Privacy notices should accurately describe AI-related processing where appropriate.

Legal basis assessments should consider AI processing explicitly.

Vendor management should address AI providers.

Privacy impact assessments should evaluate AI risks.

Training programs should include AI governance.

In other words, organizations should integrate AI into their existing accountability framework rather than building a separate compliance structure.

Looking ahead:

Artificial intelligence will continue to reshape business operations.

The more significant challenge under the PDPA, however, is unlikely to be the technology itself.

It will be governance.

Organizations capable of explaining why AI is used, what personal data supports it, how risks are managed, and how decisions remain accountable are likely to be better prepared than organizations focusing exclusively on technical innovation.

The PDPC’s recent consultation suggests that this is the direction in which Thailand’s privacy regime is evolving. AI is becoming an ordinary business tool. As a result, organizations should treat AI governance as an ordinary component of privacy governance.

Key takeaways:

  1. The PDPA does not establish separate legal principles for AI; existing privacy obligations continue to apply regardless of the technology used.
  2. AI increases the scale and complexity of personal data processing but does not replace the need for lawful basis, transparency, purpose limitation, and accountability.
  3. Organizations should assess individual AI use cases rather than treating all AI deployments identically.
  4. Profiling and AI-assisted decision-making are becoming mainstream regulatory concerns and should be supported by appropriate governance and transparency.
  5. Vendor management is increasingly inseparable from AI governance because many AI capabilities are provided by third-party platforms.

The organizations best prepared for future regulation will be those that integrate AI into existing privacy governance rather than treating it as a separate compliance project.

Author: Panisa Suwanmatajarn, Managing Partner.

Related Articles in the “PDPA Insights: Building Effective Privacy Governance” Series

on by

Billing Software Requirements vs. Electronic Invoicing Requirements

Executive Summary:

As governments continue to digitalize tax administration, businesses are increasingly expected to adopt electronic invoicing solutions that comply with evolving regulatory requirements. Although the terms billing software and electronic invoicing are often used interchangeably, they represent distinct concepts that serve different commercial and legal functions.

In Thailand, billing software is not subject to a dedicated statutory or regulatory framework. Businesses are generally free to select accounting, billing, or enterprise resource planning (ERP) systems that best support their commercial operations, provided they comply with the Revenue Code and other applicable laws. Electronic invoicing, by contrast, is governed by the Revenue Department’s e-Tax Invoice & e-Receipt framework, which establishes the legal and technical requirements for issuing electronic tax invoices recognized for VAT purposes.

Understanding the distinction between these concepts is important for businesses implementing digital invoicing solutions. A billing system that efficiently generates commercial invoices does not necessarily satisfy the legal requirements for issuing electronic tax invoices. Businesses should therefore evaluate their invoicing systems not only from an operational perspective but also from a tax compliance standpoint.

Introduction:

Digital transformation has fundamentally changed the way businesses prepare invoices, maintain accounting records, and comply with tax obligations. Around the world, tax authorities have introduced electronic invoicing regimes to improve tax compliance, enhance transparency, and reduce administrative burdens for both taxpayers and regulators.

Although electronic invoicing has become an increasingly common feature of modern tax systems, countries have adopted different regulatory approaches. Some jurisdictions regulate the software used to generate invoices, while others focus on the legal validity and technical characteristics of the electronic tax documents themselves.

Thailand follows the latter approach. Rather than regulating billing software as a separate category of software, Thai law establishes a framework governing the issuance of electronic tax invoices through the Revenue Department’s e-Tax Invoice & e-Receipt system. Consequently, businesses remain free to use their preferred accounting or ERP software, provided that the electronic tax documents generated by those systems comply with the applicable legal and technical requirements.

For businesses operating in Thailand, particularly multinational enterprises implementing global ERP platforms, understanding the distinction between billing software and electronic invoicing is essential. While both are integral components of modern financial management, they perform different functions and are subject to different legal considerations.

Billing Software:

Billing software generally refers to applications used by businesses to prepare invoices, calculate taxes, record payments, manage customer accounts, and maintain accounting records. These functions support day-to-day commercial operations and are commonly integrated into accounting software or ERP systems.

Unlike some jurisdictions that regulate invoicing software, Thailand does not currently impose a dedicated legal or regulatory regime governing billing software itself. There is no statutory requirement for billing software to be licensed, certified, or approved by the Revenue Department before it can be used by businesses. Instead, Thai law focuses on the legal sufficiency of the invoices and accounting records generated by the software.

This does not mean that businesses have complete discretion in how billing systems are used. Regardless of the software selected, businesses remain responsible for ensuring that invoices comply with the Revenue Code, VAT is correctly calculated where applicable, accounting records are properly maintained, and supporting documentation is available for inspection by the tax authorities.

Accordingly, compliance under Thai law depends not on the software itself, but on whether the business uses that software in a manner that satisfies its statutory obligations. A business may therefore choose from a wide range of commercial accounting platforms, cloud-based invoicing applications, or ERP systems without obtaining prior approval from the Revenue Department.

Electronic Invoicing:

Electronic invoicing serves a different purpose. Rather than facilitating internal billing processes, it establishes the legal framework under which electronic tax invoices are recognized for VAT purposes.

Thailand’s electronic invoicing regime is principally governed by the Revenue Code, supplemented by the Electronic Transactions Act, Ministerial Regulation No. 384, and Revenue Department notifications prescribing the technical standards for electronic tax documents. Collectively, these instruments enable tax invoices and receipts to be created, transmitted, and retained electronically while ensuring their authenticity, integrity, and reliability.

Businesses wishing to issue electronic tax invoices under the Revenue Department’s e-Tax Invoice & e-Receipt framework must comply with prescribed legal and technical requirements. These include registration with the Revenue Department, generation of electronic tax documents in the prescribed format, use of appropriate electronic authentication mechanisms, transmission through approved channels where applicable, and maintenance of electronic records in accordance with the Revenue Department’s requirements.

An important characteristic of the Thai framework is that it regulates the electronic tax document rather than the accounting software used to produce it. Consequently, businesses may continue using their existing accounting or ERP systems, provided those systems are capable of generating electronic tax invoices that comply with the Revenue Department’s technical specifications. In practice, many businesses achieve this through system localization or integration with specialized e-Tax solutions or authorized service providers.

Thailand currently provides two principal electronic invoicing models. The e-Tax Invoice & e-Receipt system is designed for businesses requiring full electronic integration, while the e-Tax Invoice by Email system provides a simplified alternative for eligible businesses. Although both systems enable businesses to issue legally recognized electronic tax invoices, they differ in their technical implementation and authentication methods.

Key Takeaways:

  • Thailand does not regulate billing software as a separate legal category or require billing software to be certified or approved by the Revenue Department.
  • The Revenue Department’s e-Tax Invoice & e-Receipt framework governs the issuance of legally recognized electronic tax invoices and establishes the applicable technical and procedural requirements.
  • A commercial invoice generated by billing software does not automatically constitute an electronic tax invoice for VAT purposes.
  • Businesses implementing accounting or ERP systems should evaluate both operational functionality and compliance with Thailand’s e-Tax requirements.
  • Early coordination among finance, tax, legal, and information technology functions can help ensure a successful implementation of electronic invoicing while supporting long-term digital tax compliance.

Source: International Comparison July 2026: Global Legal Market Analysis

Read Full Article

on by

Consumer Enforcement Intensifies for EV Businesses as Complaint Cases Rise and Labeling Expectations Increase

Thailand’s consumer protection regulator has signaled a more assertive enforcement approach toward the electric vehicle (EV) sector through two related developments. First, it has indicated its readiness to initiate legal proceedings on behalf of consumers in appropriate EV dispute cases. Second, it has issued new guidance consolidating labeling requirements for automobiles, electric vehicles, and used cars.

Although neither development introduces new legislation, together they demonstrate heightened regulatory scrutiny of the automotive industry and provide valuable insight into the regulator’s current enforcement priorities. Manufacturers, importers, distributors, dealers, service centers, and online vehicle marketplaces should treat these developments as an opportunity to reassess their compliance and dispute management frameworks.

Increased Enforcement Risk from EV Consumer Complaints:

The Office of the Consumer Protection Board (OCPB) has reported a significant number of consumer complaints relating to electric vehicles, with a substantial portion already progressing through legal procedures. The agency has confirmed that it has begun issuing formal demand letters in cases supported by sufficient documentation and has reiterated its statutory authority to commence legal proceedings on behalf of consumers where the legal requirements are satisfied.

This represents an important enforcement signal. Rather than merely facilitating mediation between consumers and businesses, the regulator has indicated its willingness to escalate suitable cases into formal litigation.

The risk is particularly significant where multiple complaints arise from the same product model, manufacturing issue, software defect, battery performance concern, warranty practice, or recurring after-sales service problem. A pattern of similar complaints may increase regulatory attention and expose businesses to coordinated enforcement actions, representative litigation, or broader product liability claims.

Businesses operating within the EV supply chain should therefore review whether existing complaint-handling mechanisms are capable of identifying systemic issues before they evolve into regulatory investigations or court proceedings.

Strengthened Expectations for Vehicle Label Compliance:

Separately, the OCPB has published an electronic handbook consolidating labeling requirements applicable to automobiles, electric vehicles, and used vehicles.

The publication emphasizes information that consumers commonly rely upon when making purchasing decisions, including battery specifications, driving range, testing standards, pricing information, warranty coverage, and the disclosure of material vehicle history for used vehicles.

Although the handbook itself is not legally binding, it provides a clear indication of the regulator’s compliance expectations. It reinforces that automobiles and electric vehicles remain controlled labeling products under consumer protection law and that incomplete, inaccurate, or misleading information may expose businesses to regulatory enforcement.

The guidance also illustrates that compliance extends beyond physical labels. Regulators are increasingly likely to examine whether information presented across all customer-facing channels remains accurate and consistent.

Businesses should therefore review:

  • labels displayed at dealerships and points of sale;
  • information published on corporate websites and online marketplaces;
  • brochures and sales presentations used by sales personnel;
  • representations concerning driving range and the testing methodology used, such as WLTP or NEDC;
  • battery capacity, expected degradation, warranty scope, and warranty exclusions;
  • disclosures relating to collision history, flood damage, major repairs, and battery replacement for used vehicles; and
  • consistency between information published by manufacturers, importers, dealers, and affiliated sales channels.

Claims relating to vehicle performance, battery longevity, operating costs, sustainability, resale value, or environmental benefits should be supported by appropriate technical evidence and internal documentation before publication.

Litigation Readiness and Document Preservation:

These developments also highlight the importance of litigation preparedness.

Businesses should consider establishing a centralized process for collecting and analyzing customer complaints to determine whether recurring issues indicate broader product or service risks.

At the same time, organizations should preserve relevant evidence, including:

  • sales documentation;
  • warranty records;
  • repair histories;
  • technical diagnostic reports;
  • replacement part records;
  • communications with customers;
  • call center recordings;
  • email correspondence;
  • mobile application records; and
  • connected vehicle diagnostic data.

Where disputes may reasonably be anticipated, organizations should consider implementing litigation hold procedures to reduce the risk of inadvertent deletion of potentially relevant evidence.

Companies should also review contractual risk allocation among overseas manufacturers, importers, dealers, distributors, and service centers, including indemnity provisions and responsibilities for handling product defects, recalls, warranty claims, and consumer litigation.

Data Protection Considerations:

Responding to consumer complaints frequently requires the collection and sharing of customer information, vehicle service histories, location information, and connected vehicle diagnostic data. Much of this information may constitute personal data under the Personal Data Protection Act.

Organizations should ensure that internal investigations and litigation response procedures incorporate appropriate data governance measures, including clearly defined access controls, documented processing purposes, retention periods, and secure mechanisms for sharing information with external counsel, technical experts, and other authorized parties.

Integrating consumer protection compliance with data governance can reduce both regulatory and litigation risks while supporting more effective dispute management.

Key Takeaways:

  • Organizations should strengthen complaint management, evidence preservation, document retention, contractual risk allocation, and data governance processes to prepare for increased regulatory scrutiny and potential consumer litigation.
  • The OCPB’s indication that it is prepared to commence litigation on behalf of consumers represents a significant escalation in consumer protection enforcement affecting the EV industry.
  • Businesses should not view repeated consumer complaints as isolated customer service matters but as potential regulatory and litigation risks requiring centralized oversight.
  • The newly published vehicle labeling handbook, although not legally binding, demonstrates higher regulatory expectations regarding the accuracy, completeness, and consistency of vehicle-related information across all sales channels.
  • Automotive businesses should review advertising claims, warranty disclosures, battery-related representations, and used vehicle disclosures to ensure they are fully substantiated.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

TCCT Establishes Two Subcommittees to Strengthen Trade Competition Oversight

The Trade Competition Commission of Thailand (“TCCT”) has appointed two subcommittees to oversee digital platform businesses and to establish competition rules for modern wholesale and retail businesses (“Modern Trade”). The move is intended to curb unfair trade practices and strengthen law enforcement in step with rapidly evolving trade dynamics.

1. Subcommittee on Considering Guidelines for the Oversight and Deterrence of Trade Practices in Digital Platform Businesses

This subcommittee’s primary mandate is to study, analyze, and collect data on the business models, commercial conditions, and trade practices of digital platform businesses, and to assess their impact on trade competition, business operators, consumers, and other stakeholders. It will drive more intensive regulatory measures for digital platform businesses and prepare proposals, guidelines, codes of conduct, criteria, announcements, regulations, and policy recommendations for the TCCT’s consideration.

The subcommittee will also coordinate with government agencies, the private sector, business operators, and other relevant stakeholders across all sectors to oversee and deter trade practices that may affect competition in digital platform businesses, and to promote free and fair competition more broadly.

2. Subcommittee on Determining Guidelines and Action Plans Regarding Competitive Conditions in Modern Wholesale and Retail Businesses

This subcommittee is tasked with studying, analyzing, and monitoring the market structure of modern wholesale and retail businesses; building a database to analyze retail market concentration and its impact on small-scale operators; and recommending guidelines and measures for overseeing competition in the retail sector.

Objectives of the Subcommittees

The subcommittees will study trade practices in digital platforms and in the modern wholesale-retail market to keep pace with shifting business dynamics and to investigate practices with anti-competitive effects. Each subcommittee will determine oversight guidelines and accelerate the promotion of fair trade so all parties can compete on equal terms.

The subcommittees will integrate efforts across relevant agencies, apply existing law to address exploitation or competitive pressure affecting the majority of business operators nationwide, and enforce compliance with guidelines the TCCT has already issued — notably the TCCT Notification on Guidelines for Considering Unfair Trade Practices and Acts that Monopolize, Reduce, or Restrict Competition in Multi-Sided Platform Business Operations for Digital Platform Services of Goods or Services (E-Commerce), in effect since March 25, 2026. They will also continue overseeing platform service businesses and Modern Trade going forward.

Background

Rapidly shifting competitive conditions and an influx of foreign capital have affected domestic operators, particularly SMEs and small-scale retailers. This has driven a sharp rise in complaints to the TCCT concerning online trading practices and the expansion of retail formats into community areas.

A particular concern is the continued increase in Gross Profit (GP) fees — the revenue-share or fee percentages that merchants pay to platforms. Higher GP rates compress net margins for SMEs, which may in turn force price increases that are ultimately passed on to consumers.

According to TCCT data:

  • E-commerce platforms and Modern Trade are currently among the leading competition concerns for small-scale operators at the grassroots of the Thai economy. In the first six months of this year alone, 21 platform-related complaints were filed, involving transactions collectively worth hundreds of billions of baht.
  • During fiscal year 2025 (October 1, 2024 – September 30, 2025), the TCCT received 78 complaints in total. Of these, 40 were not accepted for consideration, 9 were settled, and the remaining 29 are under investigation — most involving platforms, franchises, logistics and transport, digital platforms, and general commerce.

Through its Mobile Competition Clinic project, the TCCT has previously conducted on-site visits in several provinces to hear directly from business operators. Findings included:

Krabi Province:

  1. Online platform issues, including being forced to use specific transport providers and reduced product visibility due to algorithmic ranking.
  2. Online Travel Agency (OTA) platform issues, including price-parity clauses that prohibit hotels from listing lower rates on their own websites than on OTAs.
  3. Unfair trade practices between SMEs and Modern Trade operators, including redundant fee charges and additional GP fees imposed without prior notice.
  4. Palm oil pricing structure issues affecting local farmers.

Chiang Mai and Lamphun Provinces:

  1. Online platform issues, including algorithmic ranking practices that favor a platform’s own affiliated transport services.
  2. Unfair trade practices between SMEs and Modern Trade operators, including credit-term disputes, GP fee collection, and unfair contract terms.
  3. Pricing issues in agricultural product procurement.

Current Priorities and Enforcement Timeline

The TCCT is accelerating proactive oversight across four key business groups: (1) digital platforms, (2) wholesale and Modern Trade, (3) ride-hailing platform services, and (4) online travel booking platforms (OTAs). The newly formed subcommittees will study, analyze, and propose oversight guidelines, and investigate practices affecting competition across all four groups, with findings due by the fourth quarter of 2026. This will include updated operational guidelines designed to keep pace with evolving trade practices.

This initiative marks a deliberate shift in the TCCT’s enforcement approach — from a largely reactive, complaint-driven model to proactive market inspections that do not wait for formal complaints. On-site visits to gather in-depth input from business operators will remain central to this approach, with the TCCT aiming to demonstrate tangible results within the next six months.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

NBTC Issues AI Governance Guidelines for Telecom Licensees

Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has issued new guidelines setting out its expectations for the responsible use of artificial intelligence (AI) by telecommunications licensees. Although the guidelines are not legally binding, they establish a comprehensive risk-based framework for AI governance and provide a clear indication of the regulatory standards that the NBTC expects telecom operators to adopt when deploying AI in the provision of telecommunications services.

The guidelines reflect the increasing regulatory focus on AI governance and complement existing legal obligations relating to cybersecurity, personal data protection, and telecommunications. They also align with broader national efforts to develop a comprehensive AI regulatory framework.

Scope of the Guidelines:

The guidelines apply to holders of telecommunications business licenses under Thailand’s telecommunications licensing regime, but only in relation to AI systems used to provide licensed telecommunications services.

Organizations that are not telecommunications licensees are not directly subject to the guidelines. Nevertheless, AI developers, technology vendors, cloud service providers, and outsourced service providers may be indirectly affected because telecommunications licensees are expected to exercise oversight over third-party AI solutions used in their operations. As a result, contractual obligations and vendor due diligence are likely to become increasingly important for suppliers serving the telecommunications sector.

The guidelines should be considered alongside existing legal requirements, including the Personal Data Protection Act, the Cybersecurity Act, the Computer Crime Act, and the NBTC Notification on the Protection of Telecommunications Service Users’ Rights in relation to personal data, privacy, and the freedom of telecommunications. They also complement the broader AI legislation currently under development by the Electronic Transactions Development Agency (ETDA).

Strengthening AI Governance:

A central feature of the guidelines is the expectation that AI governance should extend beyond technical implementation and become an organizational responsibility.

Telecommunications licensees are encouraged to establish governance structures at both the policy and operational levels, such as AI committees, working groups, or designated responsible officers. These governance bodies should oversee AI strategy, establish internal policies, supervise risk management, and define accountability throughout the AI lifecycle.

The guidelines also emphasize that responsibilities should be clearly assigned not only to internal personnel but also to third-party AI solution providers and outsourced service providers. Licensees are expected to ensure that contractual arrangements clearly define each party’s obligations regarding AI governance, risk management, and regulatory compliance.

A Principles-Based Approach to Responsible AI:

Rather than prescribing detailed technical requirements, the guidelines adopt a principles-based approach centered on six core expectations.

First, AI systems should comply with applicable laws, ethical principles, and internationally recognized standards. AI should respect privacy, human dignity, and fundamental rights, and organizations should consider implementing appropriate safeguards, including content filtering, to reduce the risk of generating harmful or unlawful outputs.

Second, AI systems should operate fairly. This includes using representative and reliable training data, assessing potential bias, and taking appropriate measures to mitigate discriminatory outcomes.

Third, cybersecurity and privacy protections should be integrated into AI systems. The guidelines encourage the adoption of internationally recognized security standards and recommend technical safeguards such as encryption, anonymization, and access controls to protect personal data and system integrity.

Fourth, organizations should promote transparency by maintaining documentation regarding AI design, development, and operation, while providing consumers with appropriate information about how AI systems influence decisions or recommendations.

Fifth, accountability should be clearly established throughout the organization. Internal policies should define responsibility for AI outcomes, while consumers should have accessible channels to submit inquiries or complaints regarding AI-enabled services.

Finally, AI systems should be reliable and robust. The guidelines recommend testing AI models to ensure that they produce accurate and consistent results, including under unexpected operating conditions.

Governance Throughout the AI Lifecycle:

The guidelines emphasize that AI governance should be integrated throughout the entire AI lifecycle rather than focusing solely on deployment.

Licensees are expected to conduct risk assessments before development begins, evaluate the capabilities and reliability of third-party AI providers, and maintain appropriate standards for data quality and traceability. Before deployment, AI systems should undergo testing for reliability, fairness, and operational performance.

Once AI systems are operational, organizations should continuously monitor performance, maintain appropriate human oversight, and periodically evaluate whether AI systems continue to operate as intended. The guidelines also address the retirement of AI systems, encouraging secure decommissioning processes that protect data and maintain appropriate records throughout the system’s lifecycle.

This lifecycle-based approach reflects the growing international trend toward continuous AI governance rather than one-time compliance assessments.

Consumer Transparency and Organizational Readiness:

Consumer protection is another significant feature of the guidelines.

Telecommunications licensees are encouraged to notify consumers when they are interacting with AI systems, such as chatbots or voicebots. Where AI-generated recommendations may influence consumer decisions, organizations should provide appropriate disclosures and allow consumers to request assistance from a human representative where appropriate. Effective feedback and complaint mechanisms should also be maintained.

Internally, the guidelines recognize that responsible AI governance requires organization-wide awareness. Licensees are therefore encouraged to provide AI-related training across all levels of the organization. Employees who use AI systems should understand the associated legal and operational risks, while technical personnel and external developers should receive training on organizational AI policies, ethical principles, and applicable regulatory requirements.

Practical Implications:

Although the guidelines do not create new legal obligations, they provide valuable insight into the NBTC’s regulatory expectations and are likely to influence future regulatory supervision and industry best practices.

Telecommunications licensees should consider reviewing their existing AI governance frameworks to determine whether governance responsibilities are clearly assigned and appropriately documented. Organizations should also evaluate AI risk management procedures, update contracts with AI vendors and outsourced service providers, assess consumer disclosure mechanisms, and ensure that staff receive appropriate AI governance training.

The guidelines may also have implications for corporate transactions involving telecommunications businesses. As AI becomes increasingly integrated into telecommunications operations, AI governance maturity, data governance practices, and vendor oversight may become important considerations during legal and regulatory due diligence.

Key Takeaways:

  • Telecommunications licensees should review their governance frameworks, contractual arrangements, AI risk management processes, consumer disclosure practices, and staff training programs to align with the NBTC’s expectations.
  • The NBTC’s AI guidelines establish a comprehensive risk-based governance framework for telecommunications licensees and provide a clear indication of the regulator’s expectations for responsible AI deployment.
  • Although nonbinding, the guidelines are likely to influence regulatory supervision and industry best practices within Thailand’s telecommunications sector.
  • AI governance is expected to extend throughout the entire AI lifecycle, encompassing organizational governance, risk management, vendor oversight, cybersecurity, consumer protection, and ongoing monitoring.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles