The Complete Guide to Using AI in the Government Industry in Thailand in 2025

This guide lays out what public servants, investors, and civic technologists need to know to move Thailand from AI policy to practical, accountable deployment in 2025: a concise reading of the UNESCO‑partnered Thailand AI Readiness Assessment 2025 - which flags an 80,000‑person talent gap and notes 28,000+ public datasets that are underused - plus a plain summary of the ETDA's June 2025 draft AI law and risk‑based framework that aims to balance innovation with rights and sectoral oversight.

Expect clear chapters on legal gaps and enforcement, high‑risk vs. unacceptable AI, obligations for providers and deployers, inclusion and digital‑access strategies for rural and vulnerable groups, plus pragmatic tools like sandboxes and public‑cloud options to scale government AI projects.

Readers will leave with concrete next steps for procurement, data quality, workforce upskilling, and where to look for public comment and governance updates in Thailand's fast‑evolving AI landscape; start with the Thailand AI Readiness Assessment 2025 and the detailed draft AI law analysis.

The picture of Thailand's national AI readiness in 2025 is unmistakably mixed: the UNESCO‑partnered Thailand AI Readiness Assessment 2025 maps progress across five dimensions - legal, social, scientific, economic, and technical - but flags concrete gaps that should shape every government AI project, from procurement to pilot design.

The country has a national AI strategy, yet the assessment notes a lack of AI‑specific laws and risk‑based regulatory mechanisms; an 80,000‑person talent shortfall threatens scale; and more than 28,000 government datasets sit largely untapped because of uneven quality and limited reuse.

Rural communities, minorities, and older adults remain on the wrong side of digital access, even as public sentiment stays upbeat (the 2025 AI Index reports roughly 77% of Thais see AI as more beneficial than harmful).

Policymakers and investors can take heart from recent commitments - such as a major national investment tranche and sub‑sector planning - but the report's top prescriptions are familiar and urgent: build ethical oversight and testing infrastructure, strengthen cross‑sector coordination, and invest in human capital so Thailand can turn strategy into accountable, usable systems rather than islands of experiments.

For full context, read the Thailand AI Readiness Assessment 2025, the UNESCO RAM workshop summary, and the 2025 AI Index.

Dr. Chai Wutiwiwatchai: Thailand is advancing ethical and inclusive AI governance, anchored by the Thailand National Artificial Intelligence Strategy and Action Plan (2022–2027), developed by MHESI with MDES, promoting widespread AI adoption while ensuring responsible development aligned with human rights, transparency, and inclusive innovation.

Tackling Thailand's talent and inclusion bottlenecks is the hinge on which government AI success will turn: Intelify reports that 62% of Thai workers already use generative AI, and the state's ambitious plan to train 50,000 AI‑skilled people over five years - alongside private pledges like Huawei's 10,000 specialists per year - shows momentum, but supply still lags real demand; the Economist Impact survey finds Thais prioritise advanced digital skills (56%) and that 60.7% see AI/ML as “must‑have” capabilities, even as nearly a quarter still lack reliable internet, limiting rural participation and course access.

Structural hurdles amplify the gap - public agencies lose candidates to higher private pay, slower career paths, and legacy tech, while an ageing workforce and shifting contract work patterns make large‑scale reskilling urgent.

Practical fixes in the short term include targeted upskilling tied to on‑the‑job incentives, public‑private training hubs, and subsidised connectivity so AI literacy isn't confined to Bangkok; see Intelify's market review, the Economist Impact skills analysis, and the Public Sector Paradox for concrete evidence and program ideas.

“We must constantly learn with humility. Those in high positions must step down gracefully to allow forward progress. Maintaining motivation is crucial if the nation seeks meaningful change.”

Thailand's public‑data landscape is both an asset and a warning sign: government repositories - counted in the tens of thousands across agencies - offer raw material for useful AI services, yet many datasets lie underused or unevenly curated, like a vast public library without reliable cataloguing; the humanitarian hub on HDX alone lists 143 Thailand datasets and a network of 43 contributing organisations from UN agencies to specialist mapping groups, a reminder that useful building blocks exist but need stewardship (HDX - Thailand humanitarian datasets).

At the same time, recent data‑security incidents make the stakes concrete: investigative reporting documents massive PII exposures - including claims that vaccine registration records affecting as many as 55 million people were at risk and multiple high‑volume dumps of citizen and institutional records - underscoring why PDPA‑aligned governance, tighter access controls, and vetting for third‑party processors must be front and center when repurposing public data for AI (ReSecurity analysis of Thai PII leaks).

Pragmatic next steps for agencies: prioritize dataset inventories, publish clear metadata standards, and pair any public‑data AI pilot with privacy impact assessments and secure sandboxes so valuable datasets become usable, not risky.

The June 2025 ETDA / AIGC Draft Principles aim to stitch Thailand's caution and ambition into one practical playbook: a risk‑based law that borrows the EU AI Act's architecture while carving local space for innovation through AI Innovation Testing Centres, sandboxes, and limited text‑and‑data‑mining exceptions to speed model training.

At its core are two headline categories - “Prohibited‑risk” systems that may be banned outright and “High‑risk” systems that remain permitted but carry strict duties - yet the text delegates the precise lists to sectoral regulators so rules can stay current and context‑sensitive.

High‑risk providers and deployers face concrete obligations (human oversight, operational logs, data‑quality checks, serious‑incident reporting and the appointment of a Thai legal representative for foreign firms), while individuals gain rights to notice, explanation and meaningful appeal when AI affects their interests.

Innovation safeguards include safe‑harbor testing in regulatory sandboxes and contractual templates to lower transaction costs, but enforcement powers are robust - regulators may order suspensions, seek platform takedowns, block access or seize non‑compliant AI - so projects should be piloted in controlled environments and paired with clear governance.

For a practical read on the consolidated Draft Principles and the ETDA's approach, see the Norton Rose Fulbright analysis and the detailed overview by Mori Hamada.

Thailand's draft, ETDA‑informed risk model draws a clear line between High‑Risk systems - those that must run formal risk management, human oversight, operational logs and serious‑incident reporting - and Unacceptable‑Risk uses that sectoral regulators may ban outright (think EU‑style prohibitions such as real‑time biometric identification in public spaces), so classification will determine whether an agency can proceed, sandbox, or must stop a project; see Kudun and Partners' concise summary of the Draft Framework for the two‑tier approach (Kudun & Partners Draft Framework - High Risk vs Unacceptable Risk (Lexology)).

Practical consequences are concrete: high‑risk providers and deployers will face duties - from appointing a Thai legal representative and meeting PDPA obligations to keeping records and cooperating with probes - that, if ignored, can lead to stop orders, takedowns, ISP blocking or even seizure of non‑compliant systems, so overseas models serving Thai users must be designed for local compliance from day one (read the regulator‑focused breakdown in Lex Nova Partners' analysis for operational detail: Lex Nova Partners analysis - Thailand AI law draft: risks and responsibilities).

The “so what?” is sharp: classification choices aren't academic bureaucratic labels but the switch that decides whether an AI pilot stays onstage in a supervised sandbox or is cut off from Thai users overnight - making early risk mapping and sandbox testing essential parts of any government AI roadmap.

Obligations for AI providers and deployers in Thailand's public sector are concrete, operational and enforceable: high‑risk systems must run formal risk‑management frameworks (think ISO/IEC 42001:2023 or the NIST AI RMF), include mandatory human oversight, keep detailed operational logs, and ensure input data accuracy and quality so decisions are traceable and defensible; foreign providers also must appoint a Thai legal representative and register where required, while both providers and deployers must notify affected individuals and report serious incidents to regulators, cooperating fully with probes - see the practical breakdown from Lex Nova Partners: practical breakdown of Thailand AI law risks and responsibilities and the draft recap by Formichella & Sritawat with analysis at FOSR Law: AI and data privacy in Thailand (2025).

These are not mere paperwork requirements: non‑compliance can trigger stop orders, platform takedowns, ISP blocking or even seizure of non‑compliant systems, so early classification, sandbox testing under the ETDA framework, and PDPA‑aligned data governance are the practical steps that turn legal duties into manageable project controls - and prevent a pilot from going dark overnight.

Thailand's playbook for fostering AI innovation in government blends practical policy levers with hands‑on testing: limited copyright exemptions for text‑and‑data‑mining plus contractual “risk‑template” toolkits lower the legal friction for model training and early partnerships, while supervised regulatory sandboxes and government‑backed AI Innovation Testing Centres create a controlled “test track” where pilots can run real‑world experiments under oversight and safe‑harbor protections (noting civil liability still applies) - see Norton Rose Fulbright analysis of Thailand's Draft AI Law for the specifics on TDM, sandboxes and the ETDA's AI Governance Center.

Operational enablers matter too: clear government cloud and data‑classification guidance (the Cloud‑First push with “official / protected / highly protected” tiers and on‑shore requirements for the most sensitive records) gives agencies realistic paths to scale services without building costly data centres, and sectoral sandboxes can permit carefully governed reuse of public data for public‑interest AI projects as described in the Lex Nova Partners guide to Thailand AI law risks and responsibilities and Hogan Lovells analysis of Thailand government cloud adoption and data classification guidelines.

The combination - legal TDM carve‑outs, sandboxed testing, contractual templates, an AI Governance Center to advise agencies, and pragmatic cloud classification rules - turns abstract policy into concrete tools that shorten pilots, reduce procurement friction, and keep promising projects onstage rather than being cut off for non‑compliance.

Enforcement in Thailand's draft AI regime is deliberately muscular and vividly practical: regulators are empowered to issue administrative stop‑orders, force platform takedowns, block access via ISPs or even seize physical AI products if systems flout obligations, so a live pilot can be disconnected “overnight” unless governance is airtight (see the consolidated Draft Principles in the Norton Rose Fulbright analysis of Thailand's draft AI law).

Cross‑border providers face concrete compliance gates - PDPA duties continue to apply while the AI law is finalized, and foreign firms must appoint a Thai legal representative and reckon with Foreign Business Act constraints unless BOI routes apply - practicalities made plain in the operational guides from Lex Nova Partners operational guide to Thailand AI law compliance and local counsel.

Legal uncertainty remains significant because the law delegates the exact lists of “prohibited” and “high‑risk” systems to sectoral regulators and subordinate rules, creating timing and scope questions for projects; sandboxes and safe‑harbor testing ease entry but do not fully eliminate civil liability, so careful risk mapping, PDPA‑aligned data governance and early engagement with regulators are essential to keep promising pilots onstage rather than suddenly cut off (FOSR Law guide to AI, data privacy and PDPA compliance in Thailand (2025)).

The upshot is blunt: enforcement tools are strong, cross‑border obligations are real, and regulatory delegation means agility and legal counsel will be as strategic as technical design.

Practical next steps for government teams and investors are clear: treat the ETDA draft as a living checklist - map every pilot to the draft's risk categories, bake in human oversight and formal risk‑management (ISO/NIST‑style) from day one, and run early trials inside supervised sandboxes so experiments can scale without being cut off “overnight” by enforcement; for a concise read on the draft's innovation and enforcement mix see the Norton Rose Fulbright overview of Thailand's draft AI law.

Foreign providers and investors should resolve local accountability up front - appoint a Thai legal representative, check Foreign Business Act constraints and BOI routes, and prepare incident‑reporting and PDPA‑aligned governance so cross‑border models meet Thailand's operational tests (see Lex Nova Partners' operational guide).

Finally, close the human‑capital gap: pair short, practical upskilling (role‑based AI prompt and governance training) with sandboxed projects so civil servants and vendors learn by doing rather than by theory; this is how Thailand can turn a risk‑based framework into predictable, investable AI programs that protect citizens while letting useful services scale.