When Digital Economy Minister Chaichanok Chidchob addressed AI Governance Week in Bangkok on July 1, Thailand's message was unambiguous: the country's landmark AI Act will be finalized before the end of the current fiscal year. The declaration, made at an event organized by the Electronic Transactions Development Agency (ETDA), came despite mounting industry warnings that two specific design choices — fines calculated as a percentage of organizational revenue, and a copyright framework with no fair-use exception — could deter precisely the foreign tech investment Thailand has spent years cultivating.
What the Draft Law Contains
Thailand's draft AI Act, which the ETDA has been refining following public consultations in mid-2025, is built around a risk-classification framework modeled loosely on the EU AI Act but adapted for local conditions. At the top of the hierarchy are outright prohibitions: AI systems that manipulate behavior through subliminal means, enable social scoring, or conduct real-time biometric identification in public spaces. Below that sits a high-risk tier covering applications in critical infrastructure, healthcare, financial services, and employment decision-making — requiring mandatory registration, auditing, and human-oversight obligations.
The draft also includes mandatory labeling for AI-generated content, framed by regulators as improving transparency without overburdening legitimate creators. Copyright protections for AI training data are under active development, with a specialized committee examining revenue-sharing mechanisms for rights holders whose works are used to train AI models. On enforcement, two penalty models remain under deliberation: flat financial thresholds, or fines calculated as a percentage of organizational revenue.
Why Regulation Has a Legitimate Case Here
The case for a governance framework is straightforward. Thailand is the second-largest digital economy in Southeast Asia, with its digital sector forecast to grow 4.2 percent in 2026 — twice the pace of national GDP — according to the National Board of Digital Economy and Society. That growth depends on public trust in AI systems operating across finance, healthcare, and government services. The Thai Personal Data Protection Committee signaled its enforcement resolve in August 2025, issuing eight administrative fines totaling approximately THB 21.5 million across five cases in a single enforcement day, touching healthcare, retail, and technology sectors alike.
Mandatory content labeling addresses a genuine transparency gap. As AI-generated text, images, and video saturate public information spaces, the disclosure case is legitimate. And the bid to establish some form of revenue-sharing for AI training data responds to real pressure from content creators whose works power Thai-language AI models without compensation.
The Copyright Trap Thailand Has Yet to Escape
Here the framework runs into a structural problem predating the AI Act debate. Thailand's Copyright Act provides no fair use or fair dealing exception. Unlike the United States, the EU (which adopted text and data mining exemptions under the 2019 Digital Single Market Directive), or Japan (which has explicit AI training carve-outs), any copying of copyrighted material for AI model training in Thailand is presumed infringing unless a specific, narrow statutory exception applies. The draft law reportedly contemplates limited text-and-data-mining exemptions modeled on EU practice, but these remain undefined in the current version.
Until exemptions are codified with sufficient precision — specifying which entities may claim them, what content qualifies, and how cross-border datasets are treated — AI developers face a compliance environment where building a language model from Thai-language content carries legal exposure that larger players can absorb and smaller ones cannot.
The Revenue-Percentage Fine Problem
Revenue-based penalties are not inherently unjust — the EU's GDPR employs them precisely because flat fines trivial for large platforms can be existential for smaller operators. The logic is sound: only revenue-scaled penalties give well-resourced companies a genuine incentive to comply.
But the AI Act context differs from GDPR in a critical way: the risk classification system is still being constructed. The draft delegates designation of high-risk AI activities to sectoral regulatory bodies — a sensible acknowledgment that finance regulators understand AI risk in payments better than a central authority. But it also means companies could face revenue-based fines for a classification error made before the rulebook was finished. That risk is not fixed by a grace-period clause; it is embedded in the architectural sequence of publishing penalties before publishing the risk lists.
Southeast Asia's Diverging Regulatory Bets
Thailand is navigating this against a backdrop of genuine regional divergence. Vietnam moved first, promulgating ASEAN's first formal AI law in December 2025 with phased implementation beginning March 2026, adopting a risk-based framework with fewer categories than the EU model. Singapore and Malaysia, by contrast, maintain voluntary governance frameworks — a deliberate calculation that attracting AI capital before locking in compliance costs positions them as neutral regional platforms. As ISEAS research published in early 2026 documented, Thailand explicitly modified its draft away from a direct EU AI Act template, opting for sectoral bodies to designate high-risk activities rather than a centralized classification authority. That delegation is sensible. The question is whether the enforcement penalty model makes the overall package regionally competitive.
The Proportionality Test
Thailand's economic position makes regulatory design more consequential than in most markets. Investment applications to the Board of Investment reached a record US$42 billion in the first nine months of 2025, led by data centers and AI infrastructure. Google Cloud's Bangkok region, launched in January 2026, projects 1.4 trillion baht in economic value over five years. These commitments were made on the strength of Thailand's existing regulatory environment. Mid-tier AI companies evaluating where to deploy for the ASEAN market are making those decisions now, with the penalty structure still unresolved.
The right move is to separate governance objectives from enforcement design. Mandatory labeling, risk-classification registries, and high-risk AI auditing are defensible on their merits. Revenue-based fines, calibrated to a risk classification system still being written by sectoral bodies, are a different question. Publish the high-risk activity lists before publishing the penalty structure. Define text-and-data-mining exemptions in the statute, not in subordinate rules announced after the law passes. These are not concessions to industry lobbying — they are the minimum conditions under which a governance framework earns the compliance it is trying to compel.
Thailand's AI Governance Practice Centre, currently pursuing UNESCO Category 2 Center status, demonstrates genuine regional ambition. That ambition is best served by a law whose sequencing matches its sophistication.