One framework, every sector
Thai regulators are at different stages: BOT and OIC have AI rules, others do not yet. Version 2.0 (September 2026) offers one volume with a 19-component Common Baseline, a CII overlay, seven sector modules (banking, insurance, health, energy, transport, telecom, government) and six lifecycle gates.
Which rule applies
Binding statute or regulator notification always prevails; a more specific regulator instrument prevails for its subject; where Part 1 and a module differ, the stricter applies; otherwise the Common Baseline applies.
Common Baseline in four layers
Direction · Classification · Control · Assurance.
Governance
Three lines of defense with a named refuser (CRO and CISO can veto high-risk deployment), independent validation, and accountability that never transfers to a vendor.
Risk classification
Impact × autonomy (L1 advisory to L4 autonomous); prohibited where impact is severe and no human can stop the system. A CII overlay (OT/SCADA, RTO, high-impact data, public-scale decisions) sets the floor to High.
Six gates
Intake → Classify → Assess → Test → Approve → Monitor → Retire.
Data zones
Zone A in Thailand only; Zone B NCSA-certified cloud after tokenization; Zone C external AI for public data. Tested against OWASP ML, LLM and Agentic Top 10.
Incidents
Detect → Classify → Stop → Fallback → Notify → Fix and retest.
18-month roadmap
Foundation (M0–3) → Control high-risk (M3–9) → Operate (M9–15) → Certify ISO/IEC 42001 (M15–18). Quick wins in 90 days: Board-approved policy, AI inventory, GenAI acceptable use policy, AI disclosure on customer chatbots.
Not legal advice.