Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
June 3, 2026
Originally published in ACTIO E-Magazine Edition 29 (June 2026). Law as of June 2026.
Indonesia does not yet have a comprehensive umbrella law for artificial intelligence. Governance is fragmented across the Electronic Information and Transactions Law, Government Regulation No. 71 of 2019, the Personal Data Protection Law, sectoral oversight, and non-binding ethical guidance. The next step is not necessarily an immediate all-encompassing statute, but a move from fragmented soft law toward a coherent, risk-based framework, with ethical certification and PDP compliance as its operational anchors.
Indonesia currently does not have a comprehensive “umbrella” legislative framework specifically dedicated to artificial intelligence. This contrasts with the EU AI Act, which establishes a centralised and risk-based regulatory regime. In Indonesia, AI governance remains fragmented across general digital and data protection instruments, including the EIT Law, GR 71/2019, and the PDP Law. Oversight is further dispersed across sectoral authorities, such as OJK, and non-binding ethical instruments, most notably Circular Letter No. 9 of 2023 on Artificial Intelligence Ethics issued by the Ministry of Communication and Informatics (Kominfo).
At the policy level, Indonesia has articulated a national vision through Stranas KA 2020-2045, issued in 2020 by the Agency for the Assessment and Application of Technology (BPPT), a body established under Presidential Decree No. 103 of 2001 and later integrated into the National Research and Innovation Agency (BRIN) in 2021. Stranas KA sets out a 25-year roadmap emphasising talent development, data infrastructure, governance and ethics, and AI deployment in priority sectors such as healthcare, public administration, education, food security, and smart mobility. Nevertheless, it does not establish binding legal norms or a risk-based regulatory architecture. Subsequent sectoral instruments, such as Kominfo’s AI Ethics Circular and OJK’s Artificial Intelligence Governance for Indonesian Banking (2023-2025), reflect a gradual shift toward sector-specific, risk-oriented AI governance.
International organisations such as the OECD and UNESCO helped shape the early global discourse on AI governance by articulating foundational ethical principles centred on transparency, fairness, accountability, and human oversight. These frameworks marked an important normative milestone, but they operate primarily as instruments of “guidance”, offering a voluntary framework without binding legal force. Their main weakness is the absence of binding enforcement mechanisms: they lack statutory obligations, supervisory mechanisms, or punitive sanctions capable of compelling compliance in high-risk or commercially sensitive contexts.
The EU AI Act reflects a move from principle-based guidance toward binding regulatory obligations. It adopts a risk-based model that categorises AI systems according to their potential impact and imposes differentiated obligations accordingly. High-risk AI systems are subject to mandatory ex ante conformity assessments, documentation requirements, transparency obligations, and human oversight safeguards before market deployment. The Act further establishes centralised enforcement mechanisms and administrative fines of up to 7% of global annual turnover or EUR 35 million, whichever is higher.
AI-related issues in Indonesia are mainly addressed through the Electronic System Operator (PSE) framework under GR 71/2019, PDP compliance obligations, and general civil liability principles under the Indonesian Civil Code. However, this structure does not yet provide detailed mechanisms for AI-specific supervision. Indonesia has not yet introduced a statutory AI definition, a formal risk-classification model, a specialised AI supervisory authority, or mandatory algorithmic audit obligations. AI systems are therefore generally treated as part of the electronic systems regime, rather than regulated as a separate category with risk-based supervision. That leaves risk regulation misaligned, makes accountability more difficult where AI opacity complicates attribution of responsibility, and limits ex ante safeguards such as risk assessments and oversight.
First, the electronic systems approach. AI technologies are legally categorised as electronic systems, subjecting developers to the requirements of Electronic System Operators (ESOs/PSEs), centred on platform responsibility, mandatory PSE registration, and general system reliability. While this provides a foundational duty of care, reinforced by Article 40A of the EIT Law (2024 Amendment), which mandates a safe and accountable digital ecosystem, the focus is structurally oriented toward administrative compliance and content moderation rather than the autonomous risks inherent in AI, such as deep-learning opacity or algorithmic bias.
Second, the data protection approach. The PDP Law introduces the accountability principle, which is vital for AI training sets, yet its scope is naturally confined to personal data privacy. It does not specifically cover broader algorithmic harms, such as socio-economic discrimination or automated decision-making errors that do not involve personal identifiers.
Third, sectoral licensing and ethics. AI ethics is integrated into the business licensing lifecycle through the Risk-Based Business Licensing (OSS RBA) framework, as regulated by Government Regulation No. 5 of 2021 and updated by PP No. 28 of 2026. This system uses industrial classifications, moving from KBLI 62015 to the more granular KBLI 62194 under the 2025/2026 transition, to mandate that AI-based programming and consulting activities meet defined technical and ethical standards. Within this framework, maintaining an internal AI ethics policy is increasingly categorised as a Standard of Service (PB-UMKU), a compliance benchmark during post-audit monitoring. In finance, OJK has integrated AI governance into formalised standards through POJK No. 10/2022 and POJK No. 30 of 2025 on Governance and Risk Management for Financial Technology Innovation, requiring automated underwriting systems to be explainable and free from discriminatory bias.
No binding legislation provides a comprehensive legal definition of AI. The most explicit formulation appears in Circular Letter No. 9 of 2023, which defines AI as “a form of programming in a computer system that enables it to process and/or analyze data accurately”, but as a circular letter it constitutes soft law. OJK guidance conceptualises AI as technology that mimics human intelligence, encompassing machine learning, deep learning, predictive AI, generative AI, and agentic AI, but that formulation is descriptive rather than normative. The absence of a unified definition generates enforcement uncertainty, allows inconsistent classification across regulatory contexts, and may lead to divergent standards between authorities such as Kominfo and OJK. Unlike the EU AI Act, Indonesia’s framework also does not legally differentiate AI systems by risk: a low-risk system such as a spam filter or chatbot is subject to broadly similar obligations as higher-impact systems used for credit scoring, biometric identification, or medical diagnostics.
The EU AI Act codifies Trustworthy AI principles into a mandatory framework, with the most stringent requirements for “High-Risk” systems, operationalised through Article 10 (non-discriminatory data governance), Article 13 (transparency and explainability), Article 14 (meaningful human oversight), and Article 15 (technical robustness and accuracy), enforced by the European AI Office, National Supervisory Authorities, and third-party Notified Bodies. Indonesia relies primarily on ethical guidance and sectoral instruments: Circular Letter No. 9 of 2023 outlines transparency, accountability, fairness, security, and human oversight, without binding force, while OJK guidance sets out practical standards for risk management and governance. Together they resemble the foundations of an “AI ethics certification” model, whereby organisations demonstrating adherence to recognised ethical standards could receive formal recognition or trust signals. In the absence of binding requirements, companies may adopt internal GRC frameworks as an interim compliance strategy until a more formalised framework, potentially including certification or cross-sector supervision, emerges.
Does Indonesia have an AI law?
No. As of June 2026, Indonesia has no comprehensive umbrella law for AI. Governance is fragmented across the EIT Law, GR 71/2019, the PDP Law, sectoral oversight, and non-binding ethical guidance.
What is Stranas KA 2020-2045?
The National Artificial Intelligence Strategy 2020-2045, issued in 2020 by BPPT. It sets a 25-year roadmap for talent, data infrastructure, governance and ethics, and AI deployment in priority sectors, but does not establish binding legal norms.
What is missing from the current framework?
A statutory AI definition, a formal risk-classification model, a specialised AI supervisory authority, and mandatory algorithmic audit obligations.
What is AI ethics certification, and does Indonesia have it?
Not as a binding regime. The source describes a model in which organisations adhering to recognised ethical standards could receive formal recognition or trust signals. In Indonesia, the building blocks exist in soft law and sectoral guidance, but certification itself is not yet a formal requirement.
What should companies do while waiting for a formal framework?
Adopt internal GRC frameworks, formalise an AI ethics policy, document risk assessments, and align internal practices with Circular Letter No. 9 of 2023 and sectoral guidance, as an interim compliance strategy.
The question of Indonesia’s AI regulatory readiness is essentially a question of how we harmonise our existing tools. Risk-based governance, conformity assessments, and continuous oversight are already appearing in specialised forms within our current legal architecture, such as in the financial and data privacy sectors. The immediate task is to transition from this fragmented model into a more cohesive and enforceable framework, bridging existing sectoral strengths into a unified national standard. Businesses must therefore pivot toward a robust GRC strategy: voluntary compliance can help manage legal exposure under the EIT Law and PDP Law while enhancing market trust in anticipation of possible future audit or supervisory requirements.
