On 3 September 2026, Komdigi's Director General of Digital Ecosystem, Edwin Hidayat Abdullah, said that Indonesia's two AI presidential regulations, the National AI Roadmap and AI Ethics, are finished and await only President Prabowo's signature. He spoke on the sidelines of an OpenAI event in Jakarta. The Ethics regulation would sort AI uses into prohibited, strictly supervised and lower-risk categories, and leave sector rules to individual ministries. The signature was first promised for early 2026.
The case for moving first
The government's logic deserves a fair hearing. Indonesia has no AI-specific law, and a presidential regulation (Perpres) can be issued far faster than a statute passed through the legislature. A risk-tiered approach is also the most defensible design on offer: it concentrates scrutiny on the highest-risk uses and leaves the rest alone. Minister Meutya Hafid has even advised government bodies not to deploy AI until their internal rules are set, which shows officials take the risks seriously. A fast, flexible instrument that signals direction to ministries and investors is a reasonable first step, and it is far better than the sprawling, prescriptive code some jurisdictions have attempted.
A timeline that keeps slipping
The delays are well documented. The Jakarta Post reported in October 2025 that the roadmap target had moved from mid-2025 to October 2025 and then to early 2026. The draft had been completed in August 2025 and sent to the State Secretariat, and it had not been published. Another year of drift followed. For companies deciding whether to build, deploy or localise AI products in Indonesia, an unsigned and unpublished rulebook is its own form of regulatory risk. Investors cannot price rules they have not seen, and the three-tier classification described by officials cannot be tested against real products until the text is public.
Openness matters here as much as speed. A regulation that sorts uses into prohibited and strictly supervised categories will define the boundaries of acceptable speech tools, recommendation systems and generative models. Those definitions should be exposed to public comment before signing, not after.
No penalties, no referee
The central weakness is enforcement. According to the Jakarta Post report, the Perpres will not contain penalties, because only laws can impose legal sanctions. Misuse would instead fall under the existing Electronic Information and Transactions (ITE) Law and the Personal Data Protection (PDP) Law. That matters because the ITE Law is the instrument Indonesian authorities have long used against speech, and it is the one that would do the real work under a framework meant to govern AI. East Asia Forum has made the sharper version of this argument: the regulations lean on existing laws that are applied selectively and have no independent enforcement, and without a strong, independent data protection agency AI could become another tool of political repression.
The PDP Law was enacted in 2022, yet the authority it requires has still not been established. A Rajah & Tann note dated 11 March 2026 says a draft Perpres creating the authority was published in late February 2026 and sent to the State Secretariat to await presidential approval. Under that draft, the authority would be a non-ministerial agency reporting to the President through the communications ministry. PPC.land reports that Komdigi told the Constitutional Court the draft reached the President on 20 May 2026, and that a judicial review petition against the PDP Law (No. 236/PUU-XXIV/2026) was registered on 19 June 2026. Deputy Minister Nezar Patria said the body would work independently but report to the President through Komdigi. Both arrangements sit awkwardly together. A regulator that reports to the executive through the ministry it is meant to police cannot credibly act as an independent check on state use of AI.
What a proportionate framework would look like
None of this requires abandoning the light-touch approach. It requires a few specific fixes:
- Publish before signing. Release the Ethics text, including the definitions of prohibited and strictly supervised uses, for a real comment period.
- Fix the referee first. Establish the data protection authority with statutory independence, so that the same agency does not both write and enforce the rules that bind the state's own AI use.
- Constrain the legal hooks. State plainly that the ITE Law's content provisions are not the enforcement route for AI-related speech.
- Keep sector rules narrow. Ministries should issue guidance tied to demonstrated harms, with sunset or review clauses, rather than layering licensing requirements.
The EFF's recent commentary on digital sovereignty warns that governments can use sovereignty arguments to extend control over citizens' data and communications, a concern that bites hardest where censorship is heavy and surveillance is unaccountable. Indonesia is not Iran or Russia, but the structural question is the same: who checks the state?
The bottom line
Signing the two Perpres will end the uncertainty about whether Indonesia has an AI framework. It will not answer whether the framework protects anyone. A risk-based, ministry-led model can be pro-innovation and proportionate, but only if the rules are public, the sanctions are statutory and narrow, and the regulator is not an arm of the executive. Until the data authority exists and acts independently, the signature is a necessary step and not a sufficient one.