Entries

The AI rules that keep almost arriving

Indonesia has two draft presidential regulations on AI, a national roadmap and an ethics rule. Officials have announced a finish line at least five times since January 2025, and both are still drafts.

Three risk tiers, not four

The draft ethics regulation sorts AI into low, high and unacceptable risk, one fewer tier than the EU AI Act. High risk means a system uses specific personal data, unacceptable means it could threaten security and safety, and a public-service chatbot is the example of low risk. Each ministry sets its own risk standards for its sector. The rule carries no criminal sanctions, relies on self-assessment, and requires incident reporting channels.

A 72-hour breach clock, and nobody to call

Government Regulation 33/2026, signed on 16 July 2026, sets out how Indonesia's 2022 personal data law works in practice. From 16 January 2027, organisations must notify affected people and the supervisory authority within 72 hours of confirming a breach, and the authority can fine up to 2% of annual gross revenue. But that authority has not been created. The presidential regulation needed to set it up has not been issued, and on 27 July 2026 the ministry opposed a court petition asking for a deadline.

Report everything, not just high risk

In a consultation on the draft, the US-ASEAN Business Council, the US Chamber of Commerce and US tech providers asked Indonesia to require incident reports only for high-risk AI. Komdigi refused and kept reporting for all incidents.

ASEAN's generative AI guide asks the region to explore incident reporting

On 17 January 2025, ASEAN unveiled an expanded guide on AI governance and ethics for generative AI, according to Singapore's Infocomm Media Development Authority. The guide is written for ASEAN policymakers, and Indonesia is an ASEAN member. It discusses foundation models, has a section on frontier and systemic risks, and makes nine policy recommendations. One is incident reporting, framed as an area for ASEAN to explore: a common understanding of how incidents are defined, tracked, documented and reported.

Circular Letter 9/2023 sets AI ethics guidance, with no incident duty

On 19 December 2023 the Minister of Communication and Informatics issued Circular Letter 9 of 2023 on AI ethics. It is addressed to businesses that build AI and to public and private electronic system operators, and it sets out ethical values, how to apply them, and responsibilities in using and developing AI. It says AI should not be used to decide policy or matters concerning humanity. It contains no incident reporting duty, no provision on general-purpose or generative models, and no sanctions.