Three risk tiers, not four
The draft ethics regulation sorts AI into low, high and unacceptable risk, one fewer tier than the EU AI Act. High risk means a system uses specific personal data, unacceptable means it could threaten security and safety, and a public-service chatbot is the example of low risk. Each ministry sets its own risk standards for its sector. The rule carries no criminal sanctions, relies on self-assessment, and requires incident reporting channels.
01Safety lens
| Incident reportingDoes it require incidents to be reported? | Yes |
|---|---|
| Unacceptable usesDoes it name uses that are not acceptable? | Yes |
| General-purpose modelsDoes it address general-purpose models? | Unclear |
| EnforcementHow strongly is it enforced? | Soft |
| Who receives reportsIs a body named to receive incident reports, and does it exist? | Unclear |
| Cross-borderDoes it address AI systems or incidents that cross borders? | Unclear |
| Frontier AIDoes it address frontier AI, the most capable models and their control? | Unclear |
Why these values
Coded from ANTARA's report of officials' statements. Incident reporting is yes because ministries, agencies and sector players must provide incident reporting mechanisms. Unacceptable uses is yes because the draft names an unacceptable tier for AI that could threaten security and safety. Enforcement is soft because the rule relies on self-assessment and carries no criminal sanctions. The report names no single body that receives incident reports and says nothing on general-purpose models, systems built abroad or frontier models, so those stay unclear. The draft text is not public.
Lens checked on · How the lens is coded
02Compared with the EU
The EU AI Act uses four tiers (minimal, limited, high and unacceptable risk) with binding obligations attached, plus separate duties for general-purpose models. Indonesia's draft, as described so far, has three tiers, no criminal sanctions, and nothing found in public statements about general-purpose models.
03My take
The tiers look borrowed from Brussels, but the engine underneath is different. The EU attaches binding obligations to each tier and has separate duties for general-purpose models. Indonesia, as described so far, has neither: no penalties, and nothing I have found in public statements about frontier or general-purpose models. Defining high risk mainly by personal data also misses the risks that worry safety researchers most, like a capable model used for cyberattacks, which may involve no personal data at all. I want to see the draft text before judging it fully, and so far it has not been published.
04Sources
- Komdigi on the risk-based approach in the AI ethics regulationANTARA, Bahasa Indonesia · Archived copy 2026-10-22
Spotted an error? Report it on GitHub with a source and I will fix it in the open.
Report an error