The AI rules on the way: what Thai businesses that sell abroad need to prepare

1. Why Thai businesses should pay attention before customers start asking

What usually arrives before the law is a questionnaire from a large customer asking where you use AI, where customer data gets sent and who checks the results. Companies that can't answer within a week often lose the deal without realizing it.

Rules may apply according to the market and the impact, as well as where the developer is based. Corporate customers in Europe will send questionnaires and contract requirements down their supply chains before the rules take effect. A company with no list of its systems and no documentation may lose deals even when its product is good.

Besides the EU AI Act, there is Thailand's Personal Data Protection Act (PDPA), consumer protection law, intellectual property law and the rules of your industry. Each use case needs its own analysis. Saying “we're just an API user” doesn't mean you have no obligations.

2. The timeline to build into your product plans

The good news is that most of what you need to prepare is work a business should be doing anyway, such as knowing where data lives, who can access it and how to reverse things if the system makes a wrong decision.

According to official EU information, the rules are being phased in. Most transparency requirements and enforcement start in 2026. Requirements for some types of high-risk systems in Annex III are scheduled for late 2027, and those for high-risk AI embedded in certain regulated products are scheduled for 2028.

Companies shouldn't wait for the deadlines, because Data Governance, Quality Management, Technical Documentation and Monitoring all take time. Where a product has a long sales cycle in particular, customers may require readiness well in advance.

3. Know first whether your company is a Provider, a Deployer or an intermediary

Obligations differ by role. A company that builds a system under its own name may be a Provider. A company that uses it in its processes is a Deployer. Importers and distributors may have specific obligations of their own. If you make significant changes to a system or change its Intended Purpose, your role may change, so you need a Contract Map across the whole supply chain.

Build a Use-case Inventory that records the purpose, who is affected, the decision process, the data, the models, the markets and the Human Oversight. Then have Legal classify each one. Avoid classifying risk from the name of the technology alone. The same system may carry one level of risk in marketing and a very different one when it is used to select employees.

4. Evidence you should build whatever risk level you're assigned

• The approved purpose and limitations
• Data sources, rights, quality and retention
• Model and version, vendor and change history
• Evaluation by group and by high-risk case
• Human oversight and the authority to stop or correct
• Logs, incidents, complaints and corrective action
• Explanations for users and disclosure of AI-generated content where applicable

5. Vendor contracts must deliver evidence as well as an uptime SLA

6. Transparency has to live in the UX and the process

Tell users when they are interacting with AI, as fits the context, and explain what it covers and how to reach a person. For decisions with significant impact, show the data used and, where relevant, the right to object or ask for a review. Don't hide disclaimers in long terms and conditions.

Synthetic content should carry provenance and go through approval according to risk. Create labels and metadata that survive through downstream channels, train staff not to over-rely on AI, and have a script for explaining things to customers honestly.

7. Build a compliance program that doesn't become a bottleneck

8. What you can do today without waiting for every line of the law to be clear

1. Register every AI system and the markets it touches.
2. Name the owner, the intended use and an initial risk level.
3. Create data and model lineage and version records.
4. Define human oversight, incident handling and complaint handling.
5. Add AI clauses to procurement and vendor contracts.
6. Have Legal review the key use cases and your market roadmap.

In short: Thai businesses that sell abroad should prepare evidence and governance before customers or the rules force them to. Inventory, classification, lineage, evaluation and human oversight are a useful foundation however the law changes. The aim is a system that can be explained, controlled and corrected, rather than documents produced just to pass a checklist.