On 30 October 2026, Komdigi's AI director Said Mirza Pahlevi told CNBC Indonesia TV that the draft Presidential Regulation (Perpres) on AI Ethics is risk-based and will prohibit AI that endangers citizens' safety or rights. His example was facial recognition used to monitor people en masse in public spaces without a legal basis. High-risk uses such as medical diagnosis remain allowed under special supervision, with a human making the final decision. Businesses would only self-assess, with no new licences. Both the Perpres and the 2026-2029 National AI Roadmap were, he said, still in the signing process.
That is a sensible design in principle. The question is whether it reaches the surveillance that is actually being deployed.
The case for a prohibition
The strongest argument for the ban is that biometric identifiers cannot be reset. A leaked password can be changed; a face cannot. Indonesia's Personal Data Protection Law (Law 27 of 2022) already treats the risk as serious: Article 4(2) lists 'data biometrik' among 'Data Pribadi yang bersifat spesifik', alongside health, genetic and criminal-record data. Article 34 requires a controller to run a data protection impact assessment where processing carries 'potensi risiko tinggi' for data subjects. A regulator that draws a hard line at indiscriminate public-space identification is applying a proportionate principle, not stifling innovation.
The design also avoids the worst habits of licensing regimes. Katadata reported in April 2026 that the ethics Perpres sorts AI into three tiers: low risk (a hospital chatbot is the example), high risk (use of specific personal data or significant impact on rights and safety) and unacceptable risk. Director General Edwin Hidayat Abdullah said the rule is not like foreign models that ban AI, and stresses the responsibilities of government, sector players and users. Self-assessment with no new licences keeps compliance costs low for start-ups, which is the right instinct.
Where the gap is
The difficulty is that the prohibition is defined by the absence of a 'legal basis', and the state is the main deployer of facial recognition. On 5 August 2026, Antara reported that Korlantas Polri's ETLE traffic cameras now match faces against Dukcapil population data, so offenders can be identified when plates are fake, covered or missing. The Korlantas law-enforcement director, Brigjen Pol. I Made Agus Prasatya, said ETLE recorded 16,812 plate-related violations in the first half of 2026, 77.24 percent of them by motorcycle riders. CNN Indonesia, reporting the same day, described the Dukcapil matching in the future tense and gave a January-July period for the 16,812 figure, so the reporting is not consistent on whether the matching was already live or about to start.
The legal basis cited in that coverage is the 2009 Road Traffic Law: Article 68(1) on plates, Article 280 and Article 391 of the Criminal Code on fake plates. Those provisions authorise sanctioning a missing plate. They say nothing about querying a national population database with a face. CNN Indonesia's account describes a back-office officer verifying the match before field enforcement, which is a good human-in-the-loop step. Neither article describes a retention period, an audit mechanism or an independent oversight body.
The officials' stated purpose, catching plate fraud, is legitimate, and a targeted lookup of a specific offender is very different from scanning a crowd. But a system built on a national database of faces can be widened by administrative decision. Without a statute that says when the query is allowed, a ban on surveillance 'without a legal basis' invites the answer that any ministerial regulation or internal police circular is a legal basis.
The consent-based model
Rail shows the alternative. KAI said 5,555,034 long-distance customers used its Face Recognition Boarding Gate from January to June 2026, according to a statement published on a Polri-hosted site on 5 August 2026. Registration is opt-in: customers consent through the Access by KAI app, check-in machines or customer service, and those who do not register can board with a ticket. This is the kind of use the Perpres should protect. The passenger chose it, gets a faster journey, and can walk away. The caveat is that the published statement points to a privacy policy for retention and deletion but states no durations.
The contrast is the useful policy lesson. Consent-based identity checks within a single service relationship are low-risk and valuable. Non-consensual matching in public space against a population registry is a different category, and should be treated as one.
What the Perpres should say
Three additions would make the prohibition real without adding licences.
- Define 'legal basis' narrowly. It should mean a law passed by the DPR or a regulation specifically authorising named biometric use, not general policing or traffic powers.
- Require published impact assessments for state use. Article 34 of the PDP Law already requires assessments for high-risk processing; the Perpres should make the public-sector versions disclosable, with retention limits and logging of every database query.
- Set up the oversight body. Article 58 of the PDP Law provides that data protection is run by an institution designated by the President and answerable to the President. A supervisor that depends on the executive it supervises is a weak check on that executive's cameras, so its independence and its powers over police and ministries should be settled in writing.
There is also a timing problem. As of Selular's report on 4 September 2026, Edwin Hidayat Abdullah said only that the President's signature remained, and the Perpres had still not been signed on 30 October. Meanwhile ETLE facial matching goes ahead under older traffic rules. A regulation that arrives after the infrastructure is built tends to ratify it.
Conclusion
Komdigi's risk-based, no-licence approach is the right architecture for a fast-growing market, and the commitment to prohibit unlawful mass facial recognition is welcome. Its credibility will be judged by one test: whether the same rule binds the police cameras on Indonesia's roads. If the Perpres defines legal basis tightly, requires public assessments and gives an oversight body real independence, businesses keep their freedom to innovate and citizens keep a face that is not a standing ID card. If it does not, the ban applies to everyone except the largest deployer.