This article first appeared on Global Legal Insights (2023)

Over the past several years, Thailand has been researching, developing, and applying artificial intelligence (AI) and machine learning (ML) in the public and private sectors through international collaborations with AI developers. Thailand is adapting to AI to leverage its benefits in various areas, as demonstrated by its efforts to keep pace with current trends and adapt them for practical purposes.

The role of AI has become increasingly common in various sectors. For example, in the financial industry, AI has been employed to analyze customer behavior to recommend appropriate investment and saving options for each customer. Furthermore, as Thailand is one of the global hubs for healthcare services, the health industry has applied AI to analyze and diagnose diseases. For instance, AI is utilized to aid in diagnosing lung disease by detecting abnormalities in chest X-rays and indicating the likelihood of tuberculosis (TB analysis score) during the early symptomatic phase. Additionally, IBM Watson’s AI technology has been employed to analyze cancer treatment. Moreover, the public sector, such as the Revenue Department, has also begun to use AI to analyze tax submissions. After the introduction of AI and ML, big data has been extensively utilized across both large and small organizations in Thailand to facilitate a competitive edge for businesses.

Currently, financial institutions are leaders in adopting AI/ML to analyze strategic and non-strategic functions. Financial institutions utilize AI/ML within three primary work groups: customer service, whereby they offer service products that align most effectively with the customers’ requirements; system improvement, wherein they verify the accuracy of documents; and risk management, whereby they evaluate the risk involved in loan provision and detect fraud through intricate forms. In practice, financial institutions will use AI from a third-party service provider. However, financial institutions that wish to use third-party services for essential strategic functions that financial institutions themselves must carry out may not comply with specific regulations. In such cases, financial institutions shall apply for approval or waiver from the Bank of Thailand (BOT) on a case-by-case basis. Nevertheless, the BOT prescribes considerations regarding the usage of AI/ML to be fair, non-discriminatory, accountable, transparent, secure, and reliable.

According to the Government Artificial Intelligence Readiness Index 2020, Thailand was ranked 60th due to the need for more AI policies and action plans. In consequence, the Cabinet approved the (Draft) Thailand National AI Strategy and Action Plan (2022–2027) (AI Plan) on 26 July 2022, under the vision “Thailand has an effective ecosystem to promote AI development and application to enhance the economy and quality of life within 2027”.

Ownership/protection

The status of AI as property or non-property is currently debatable in Thailand. However, the Thai Civil and Commercial Code (CCC) defines “property” as corporeal and incorporeal objects that have value and can be appropriated. Therefore, under Thai law, AI could be classified as property (an incorporeal object) if deemed valuable, and the creator will own an AI algorithm.

AI is a property that is protected under intellectual property law. Nonetheless, the Copyright Act B.E.2537 (1994) (CRA) covers computer programs, which it defines as instructions, sets of instructions or any other things used with a computer to operate the computer or generate an output, whatever the computer language is. Therefore, the CRA only protects the source code and not an algorithm. Further, if an employee creates an AI, the employee will generally own the copyright to that AI unless there is a written agreement stating otherwise between the employee and the employer. Regarding protecting AI inventions under the Patent Act B.E.2522 (1979) (PA), it’s important to note that the PA does not protect inventions related to computer programs or scientific and mathematical theories or rules. In academic circles, an “algorithm” is often considered a component of a scientific or mathematical theory. Therefore, the innovation of an AI may not be eligible for protection under the PA.

Data is protected under Thailand’s Personal Data Protection Act B.E.2562 (2020) (PDPA). The collection, processing, use, and disclosure of any personal data are subject to the obligations of the PDPA. To collect, process, use, or disclose personal data, the data controller must obtain consent from the data subject or have a legal basis, such as legitimate interests, public task, execution of a contract, etc.

Consent must be obtained in writing or electronically, and any fraudulent or misleading practices to obtain such consent are prohibited. The use or disclosure of personal data for purposes other than those initially consented to by the data subject is also prohibited unless permitted by law or the data controller obtains the data subject’s amended consent after informing them of the new purpose. A data subject has the right to withdraw their consent at any time unless restricted by law or an agreement beneficial to the data subject. For example, suppose a personal data controller fails to comply with the provisions of the PDPA. In that case, the data subject may request the deletion, destruction, temporary suspension, or conversion into an anonymous form of their personal data.

Board of Directors/Governance

There is no explanation for whether AI is harmful or not. However, AI could be defined as property that poses a danger under section 437 of the Civil and Commercial Code (CCC), which prescribes that a person possessing property that poses a danger is responsible for any resulting damages. Moreover, section 85 of the Public Limited Companies Act, B.E. 2535 (1922) (PLCA) prescribes that directors have fiduciary duties and the obligation to perform their responsibilities per the law. Therefore, if any director does any act or omits any action that causes loss to the company, a director will have liability.

As companies increasingly incorporate AI and big data into their operations, there are several Thailand corporate governance issues they (directors) need to be aware of, as follows:

(1) Data Privacy: Companies must collect data per privacy laws and regulations. The company must be transparent about using personal data and obtain user consent. Thus, a director should be fully aware, or appoint advisors that are fully aware, of how AI collects data, how the data is used, and the security of personal data.

(2) Explanation: AI systems have become more complicated, so it can be challenging to understand how they make decisions. Companies must be able to explain how AI systems execute those decisions.

(3) Accountability: Companies must be accountable for the decisions made by their AI systems. They need mechanisms to address any adverse consequences or damage resulting from their use, apart from the PLCA and CCC.

(4) Cybersecurity: Companies must protect their AI and big data systems from cyber threats.

Regulations/government intervention

As of April 2023, Thailand does not have specific AI and machine learning laws. However, the critical issues under the AI Plan are as follows:

(1) Building a foundation for AI development includes establishing a national database, improving digital infrastructure, and investing in education and research to cultivate AI talent and expertise.

(2) Promoting AI adoption in various sectors: The AI plan identifies several sectors where AI can be applied, including healthcare, transportation, agriculture, and manufacturing. The government aims to encourage the adoption of AI in these areas to improve efficiency, productivity, and quality of life.

(3) Encouraging innovation and entrepreneurship: The AI plan seeks to foster a culture of innovation and entrepreneurship in AI by providing support for startups, creating incentives for investment, and promoting collaboration between the public and private sectors. Ensuring ethical and responsible use of AI: The AI plan acknowledges the potential risks and challenges and emphasizes the need for moral and accountable development and deployment of AI technologies.

Overall, the AI Plan seeks to position the country as a leader in AI development and adoption, focusing on leveraging AI to drive economic growth and improve the quality of life for its citizens.

The approach that businesses must manage risks and potential liabilities is that they must determine which risks could significantly harm the organization’s business strategy or operations. Managing such risks involves monitoring internal and external operating and regulatory environments to identify any alterations to the underlying risk landscape and guarantee that the framework is still appropriate.

AI in the workplace

The advancement of technology leads to the various uses of AI in the workplace. AI has the potential to increase profits in many businesses. Moreover, AI can analyze customers’ needs from an information base, and the company will use those databases to respond to customers’ needs. Nonetheless, there are some concerns about AI replacing humans. A business can use AI-powered automation in numerous ways, such as automating repetitive tasks, analyzing large amounts of data mentioned above, and making decisions based on that data. For example, some manufacturing industries in Thailand use robots to automate tasks such as assembly, welding, and packaging. Chatbots automate customer interactions in the customer service industry and provide quick and accurate responses to common inquiries without violating labor law. According to Section 121 of the Labor Protection Act B.E. 2541, companies must compensate employees who have terminated an employment contract due to implementing machine automation to replace a worker. This obligation extends to machines such as chatbots or restaurant robots used for service. Companies must recognize and adhere to this legal requirement as Thailand has a Labour Relations Board that aggrieved employees may file complaints.

To address this issue, the AI Plan urges governments, businesses, and individuals to work together to develop strategies to help displaced workers. However, they must be aware that according to the guiding principle of AI set forth by the Berkman Klein Center for Internet and Society, the objective of creating AI is to support and promote human values. Therefore, AI technology must refrain from supplanting human workers.

Civil liability

There are no specific laws regarding AI civil liabilities in Thailand at the time of this paper. Nonetheless, AI technology may be considered as property that poses a danger under section 437 of the CCC, whereby any individual who owns or controls a property which poses a threat is responsible for any resulting damages. As an illustration, in cases involving smart cars (i.e., advanced driver assistance systems), the burden of proof is placed upon the owner or controller. It is important to note that this differs from general civil cases under the Civil Procedure Code, wherein the plaintiff bears the onus of providing evidence of wrongdoing on the part of the disputant. Another point that must be considered is whether the controller or owner would be liable under this provision if the damages are caused by an error in the AI system itself, such as a glitch or autonomous decision-making, without any involvement from the controller or owner. Currently, there are no court decisions regarding damage caused by this type of incident as force majeure. Therefore, if the controller or owner can prove that the injuries were caused by force majeure, they will not be liable for the damage. However, the burden of proof is on the controller or owner.

According to the Product Liability Act B.E.2551 (2008) (PL), AI may be considered unsafe goods resulting by design. “Goods” is all property produced or imported for sale, including agricultural products and electricity. Therefore, if AI is a tangible asset, movable, and not permanent, AI will be under this law, such as robots, drones, and cars. Other elements of AI, such as algorithms and source code, are not within the scope of enforcement under the PL. A violation under the PL includes determining compensation for the injured party, which may consist of double damages for actual damages or compensation for emotional injuries that the CCC does not provide. In addition, an agreement between a business and a customer to limit or exempt liability for damages resulting from the use of AI cannot be enforced. If there is such an agreement, the agreement shall be voided and unenforceable under PL.

Criminal Issues

As of this paper’s date, no specific criminal laws are related to AI. In addition, there is no supreme court decision to clarify the definition of AI. However, the Criminal Code can apply to an incident where an AI robot or system commits a crime. It is necessary to examine whether the owner or controller of AI intended to commit a criminal offense or acted negligently. If it is proven that the owner or controller of an AI had the intention to commit a crime or acted negligently, they will be held liable for any offense caused by the AI. Further, suppose an AI is compelling others to commit a crime. In that case, the AI may be considered a tool used to commit the crime, and the owner or controller of the AI may be held liable for the offense only if it is proven that they intended to commit the crime.

Discrimination and bias

As of the date of this paper, no specific laws in Thailand address the issue of bias in AI systems. However, some laws and regulations may apply to AI systems that produce biased results, particularly those that impact individuals’ rights and freedoms are as follows:

(1) PDPA: PDPA regulates the collection, use, and disclosure of personal data in Thailand. If an AI system collects and uses personal data in a way that results in biased outcomes, we believe it could violate the PDPA and anti-discrimination law and policy.

(2) Computer-Related Crime Act B.E.2550 (2007) and its amendments (CCA): Under the CCA, computer-related offenses in Thailand, as well as unauthorized access to computer systems and data, have criminal consequences. If an AI system is used to cause harm, damage, or discriminate against individuals intentionally, it could be considered a computer-related offense under this law.

National security and military

As of the date of this paper, Thailand has no specific laws and regulations regarding AI under national security laws. However, it is anticipated that the AI Plan will achieve the following objectives:

In a national security sense, in preceding years, there have been contentious matters concerning the transparency of employing software applications known as Pegasus, which originates from Israel. The Thai government used this application to monitor the activities of both anti-government groups and journalists. Numerous scholars and educators have extensively deliberated on the matter, concluding that the conduct mentioned above conflicts with the fundamental tenets espoused by the PDPA, the CCA, the Cybersecurity Act, and the violation of rights and freedom under the Constitution. Thus, a pressing need for a legal framework to govern and regulate the utilization of AI from an organic law perspective is possible.

Conclusion

The laws and regulations related to AI in Thailand are insufficient, which may pose challenges for parties in the event of an AI-related dispute that goes to court. However, it should be noted that specific sectors, such as banking and insurance, have particular guidelines that acknowledge AI use. Furthermore, lawmakers need to consider expanding the scope of AI regulation beyond these specific sectors to ensure the technology is used responsibly and ethically across all industries. By implementing clear legal frameworks and guidelines, Thailand can create an environment that fosters innovation while ensuring that AI is developed and deployed to benefit society.

For further inquiries, please contact John Formichella or Naytiwut Jamallsawat at [email protected]