Thailand's Draft AI Act: What Boutique Firms Using AI Need to Understand Before It Becomes Law

Boutique law and accounting firms in Thailand are adopting AI faster than they are reading the rules that may govern it. That gap is understandable. Until now there has been no single statute to read: guidance has come from ethics bodies, courts, and the Electronic Transactions Development Agency, and none of it has carried the force of a binding AI law.

That is the context in which the draft Artificial Intelligence Act matters. ETDA released a revised draft for public consultation on 2 July 2026. It is a bill, not an enacted law, and it may change materially before it reaches that stage. But it shows where Thai regulation is heading, and a firm that understands the direction can prepare calmly rather than react when the text is finalised.

This article describes what commentators report the draft contains, separates what is proposed from what is settled, and sets out preparation that makes sense under almost any final version. Everything below comes from secondary law-firm summaries rather than the draft text itself, so the specifics should be checked against ETDA and the Ministry of Digital Economy and Society before a firm relies on them.

Status: A Draft, With a Long Road Still Ahead

The first thing to establish is what the draft is. Sources agree that it is a proposal released for public consultation, and that the consultation has now run. Commentary notes that the government aims to complete the process in 2026, but parliamentary scheduling is not confirmed, and the draft may change after the feedback it received.

Reports also say that core measures would take effect on publication in the Government Gazette, with risk-control and supervision provisions following 180 days later. Many classifications would depend on future royal decrees and committee decisions, which means that even an enacted Act would leave important details to be filled in.

The honest position for a firm, therefore, is to prepare for a direction of travel rather than a settled rulebook. Telling a client that the Act is law, or quoting its penalties as current obligations, would be wrong.

How the Draft Is Structured

Commentators describe a risk-based architecture, and ETDA is reported to have said that the Thai approach reflects local priorities and should not be assumed to mirror the European Union’s. The summaries describe the tiers slightly differently, but the common elements are these.

Some AI practices would be prohibited outright, such as subliminal behavioural manipulation and unfair discrimination based on irrelevant data. A category of high-risk systems would carry heavier duties, with the sectors reportedly including health, energy, telecommunications, and transport, to be designated by future decree. A further category of designated systems could be subject to notification, registration, or licensing. Separate transparency duties would apply to certain generated content.

For a professional services firm, the key observation is what is not on the reported lists. Legal and accounting practice are not named among the sectors summarised. The ordinary uses a boutique firm makes of AI, drafting assistance, summarisation, document questions, are unlikely to sit in the highest tiers on the reported structure. That does not mean there is nothing to do. It means the relevant duties are more likely to be about transparency, oversight, and liability than licensing.

Duties That Could Touch a Firm

Two sets of reported duties deserve attention.

The first concerns deployers, meaning organisations that use AI systems. For high-risk systems, reports say deployers would need risk-management arrangements, would have to follow the provider’s instructions, assign staff capable of oversight, keep operational logs for a minimum period, and notify the authorities of unforeseen risks. If a firm ever uses a tool that falls within a designated high-risk category, these duties would apply to it directly. The practical habit they imply, knowing what each tool does, who supervises it, and what record exists, is sound practice already.

The second concerns transparency. Developers of image, audio, and video generators would have to embed machine-readable markers, and those who publish AI-generated or AI-modified content on sensitive subjects would have to disclose it. Reported examples include elections, investment, and impersonation. Firms that publish content, including newsletters and client alerts drafted with AI assistance, should watch how these provisions are defined, particularly where content touches investment topics.

Reports also describe duties for foreign providers. The draft would apply to AI development or use that affects people in Thailand, even if it happens abroad, and foreign providers would need a local representative or coordinator. Some commentary adds that the national committee could require certain data processing to remain in Thailand. For a firm that buys its AI tools from overseas vendors, this turns vendor compliance into a due diligence question, and it connects directly to the data sovereignty concerns discussed earlier in this series.

The Contested Question of Strict Liability

The most debated element is liability. Summaries report that providers and deployers would face strict liability for AI-related damage, meaning that a claimant would not have to prove intent or negligence. Defences are reported to be narrow, such as force majeure, the victim’s own act, or compliance with an official order, and contractual disclaimers are not expected to protect a provider.

Industry groups are reported to argue that broad strict liability will discourage the deployment of beneficial AI in Thailand, and commentary says ETDA has indicated the provision may be revised before finalisation. A firm cannot assume the provision will be removed, and it cannot assume it will survive. The sensible response is to treat it as a reason to strengthen practices that are valuable anyway.

For professional services the point is sharper still. The signing lawyer or accountant already carries professional responsibility for the work that goes out, as discussed in the article on human-in-the-loop ethics. A statutory strict liability regime would sit on top of that. The best protection in either world is the same: documented human review of everything AI produces.

Penalties and Enforcement, With Caution

Reports describe administrative fines in the range of THB 1 million to THB 5 million per violation, along with escalating regulatory steps such as orders to rectify, suspend services, recall products, and ultimately to block a system in Thailand. These figures come from secondary summaries of a draft, and they could change. They are useful as an indication of seriousness, not as numbers to quote to a client as current law.

Preparing Without Waiting

Because the final text is uncertain, the most useful preparation is the work that pays off under any version.

Keep a register of AI tools in use. List every tool that touches client work, who uses it, and for what purpose. Many firms discover tools in use that nobody approved, which is a finding in itself.

Record what each tool is used for and what it must not be used for. A short internal policy, covering which data may be entered and which tasks require senior review, is the foundation for any later compliance exercise.

Preserve evidence of human review. A dated record showing that a qualified person checked AI output before it reached a client is the strongest single defence under any liability regime.

Know where client data is processed. Where a tool sends data, and under whose terms, is the question regulators and clients are both increasingly asking.

Ask vendors direct questions. Is the vendor following the draft, would it appoint a local representative, where does it process data, and can it supply logs and citations? A vendor that cannot answer is a risk to the firm that relies on it.

Review contracts and insurance. If liability does shift, a firm should know what its professional indemnity cover says about AI-assisted work.

Follow the process. ETDA and the Ministry are the primary sources, and a firm that checks them periodically will see changes before clients ask about them.

FirmFlow and the Evidence a Firm Will Want

Whatever shape the final Act takes, the practical preparation is the same: know which AI tools touch client work, keep a record of human review, and know where data is processed. FirmFlow’s citation links and matter record give a firm that evidence by default, rather than something to reconstruct after a question is asked.

Firms do not need to wait for the legislation to behave as though accountability matters. The ones that build the habits now, a register, a review record, vendor questions, will find the final rules a matter of adjustment rather than reinvention, and will be able to tell clients, with evidence, how AI is used on their work.