On September 17, 2026, Estonian ride-hailing company Bolt and US carmaker Lucid announced plans to deploy at least 25,000 Level 4 robotaxis across European cities, with a goal of 100,000 by 2035. Bolt will own and operate the fleet on Lucid's upcoming Midsize platform, built on Nvidia's Hyperion reference architecture (Silicon Republic). CEO Markus Villig said autonomous driving in Europe "requires data, software, vehicles, and operations to work as one system."
This is a European announcement, and it has no direct Thai regulatory consequence. It matters for Thailand because of the structure it describes. One company would own the vehicles and run the service. It would also feed the resulting data back into the driving software. Bolt says it will draw on more than a decade of operating data from 850+ cities. Thailand is one place that model could arrive, because Bolt already operates there.
The case for tighter rules
The strongest argument for regulating early is that an operator-owned fleet removes the usual separation between service provider and data collector. A robotaxi records street scenes, including faces, plates, and the movements of pedestrians who never agreed to anything. It also records passengers' pickup and drop-off patterns. When the same firm controls the sensors, the training pipeline and the customer relationship, no independent party sees how the data is used. Regulators who worry about that have a fair point. Retrofitting rules after a fleet is scaled is politically and technically harder than setting them first.
What Thailand has
Thailand's Personal Data Protection Act B.E. 2562 (2019) has been in full force since June 1, 2022. It is a horizontal law, and it does apply to a robotaxi operator (PDPA text, Ministry of Digital Economy and Society). It requires a lawful basis for collecting personal data and treats biometric data such as facial recognition data as sensitive, which generally requires explicit consent. The Personal Data Protection Committee has moved from warnings to fines, with penalties reported from tens of thousands to several million baht, mostly for weak security, late breach notification and missing data protection officers (Tilleke & Gibbins).
That gives Thailand more of a base than many emerging markets have. Two gaps remain, and both are specific to autonomous driving.
- Consent does not fit the road. A pedestrian cannot give explicit consent to a passing camera. The PDPA has no purpose-built basis for continuous public-space sensing by a vehicle, so operators would depend on generic grounds such as legitimate interest. Those grounds are untested for mobility.
- Nothing distinguishes safety data from commercial data. Crash and disengagement records serve a safety purpose. Training data that improves a commercial product serves another. Thailand has no rule separating the two, and no rule on who can access the first after an incident.
The PDPC is developing guidelines on personal data in AI development and use, but the same law-firm review found nothing specific to autonomous vehicles, and it notes that autonomous systems currently fall under general civil, commercial and road traffic law (Tilleke & Gibbins). I found no Thai statute written specifically for autonomous vehicles.
What Europe's approach shows
Europe has the opposite problem of over-specification, but one piece is worth copying. Commission Implementing Regulation (EU) 2022/1426 sets type-approval rules for automated driving systems of fully automated vehicles. It requires a defined set of event records: activation and deactivation, emergency operation, detected collisions, failures. Each record carries a timestamp and GPS position, and the data must be retrievable through the standard on-board interface (EUR-Lex). This is a narrow rule. It defines a small safety dataset that must exist and be accessible, and it does not regulate how the operator's wider data is used. Broader personal-data questions stay under the general data protection regime.
That split is the useful lesson. Safety-event data can be mandated cheaply and precisely. Everything else can stay under the existing privacy law.
A proportionate path for Thailand
Thailand should resist writing a comprehensive AV statute now. No Level 4 fleet is running on Thai roads, and a law drafted without one will guess wrong about the technology. It would also signal to operators and investors that Thailand is a harder place to pilot than its neighbours.
A smaller package fits the risk:
- Have the PDPC issue AV-specific guidance inside its AI guidelines process. It should say how the PDPA applies to sensors in public space, what retention limits are reasonable, and when faces and plates must be blurred or dropped.
- Define a minimum safety event record for any automated vehicle in a pilot zone, modelled on the EU's list, and require operators to hand it to investigators after a crash.
- Attach pilot conditions to permits for any zone-limited test, so data terms are set case by case and reviewed before any scale-up.
The operator's own record in Thailand is a reminder that enforcement capacity matters as much as rule design. In May 2026 Bolt said it continued to operate while its electronic platform certification was under review, and it described new driver verification using facial recognition (TTR Weekly). That is a routine ride-hailing matter, not an AV one. But it shows that biometric data already sits inside Bolt's Thai operation, and that regulators already have leverage over it.
The bottom line
The robotaxi announcement does not require Thai action this quarter. It does show what the debate will look like when it arrives: not about whether cars can drive themselves, but about who holds the data they generate. Thailand can answer with existing privacy law, a narrow safety-record rule and pilot-by-pilot permits. That protects people on the street without freezing a technology that remains unproven at scale.