Monsoon LedgerIndonesia AI governance

Laws, drafts and guidance

Instruments

The laws, regulations, drafts and guidance this ledger refers to, with the legal force of each, what it says, how far the author has read it, and its closest EU counterpart.

Instrument map

Where each instrument sits between announcement and legal force, and which entries discuss it. Select an instrument to trace its entries.

01Announced
02Draft
03Signed
04In force
Binding
None
Not binding
None
None

Entries

Select an instrument to see its status, legal force and the entries that discuss it.

How legal force is decided

Article 7(1) of Law 12 of 2011 on lawmaking sets the order of Indonesian legislation, from the highest to the lowest, and Article 7(2) gives each rule legal force according to its place in that order [1].

  1. aThe 1945 Constitution (UUD 1945)
  2. bDecrees of the People's Consultative Assembly (Ketetapan MPR)
  3. cLaws and government regulations in lieu of law (UU, Perppu)
  4. dGovernment regulations (PP)
  5. ePresidential regulations (Perpres)
  6. fProvincial regulations
  7. gDistrict and city regulations

Article 8 recognises other rules, such as ministerial regulations, and makes them binding only when a higher regulation orders them or when they are made within the issuer's authority [2]. A circular letter (surat edaran) is in neither list. It guides administration but does not bind the public, which is why Indonesia's only AI-specific instrument in force is coded Not binding.

Texts are checked in the BPK legal database and, where possible, against the issuing agency's own copy, because BPK itself says its documents should be confirmed with the issuing agency [3].

Instrument dossiers

One card per instrument. "Read in full" means the author has read the complete text. Everything else is drawn from official statements or secondary analysis, as the entries show.

Ministerial Circular Letter 9/2023 on AI ethics

In forceNot bindingRead in full by the author
Type
Circular letter, 2023-12-19
Issued by
Minister of Communication and Informatics (Kominfo, now Komdigi)
Legal form
Circular letter. Outside the hierarchy in Article 7(1) of Law 12/2011 and outside the ministerial regulations recognised in Article 8.
Key points
  • Addressed to businesses that build AI and to public and private electronic system operators (PSE).
  • Organised in three parts, ethical values, how to apply them, and responsibility in using and developing AI.
  • Describes itself as ethical guidance. It creates no sanctions.
EU counterpart
No binding EU counterpart. In function it resembles soft-law codes such as the OECD AI Principles.
Sources
Source Archived copy [4, 1, 5]See every link in the ontology
Entries

Draft Presidential Regulation on the National AI Roadmap 2026 to 2029

DraftBindingNot yet read in full
Type
Presidential regulation, not yet
Issued by
President of the Republic of Indonesia, drafted by Komdigi
Legal form
Presidential regulation, Article 7(1)(e) of Law 12/2011. Binding once signed and promulgated.
Key points
  • Draft text not published. What is known comes from official statements.
  • Officials say a task force will oversee implementation once the President signs.
EU counterpart
No direct counterpart. The AI Act is a regulation with duties, not a national roadmap.
Sources
Source Archived copy [1, 6]See every link in the ontology
Entries

Draft Presidential Regulation on AI Ethics

DraftBindingNot yet read in full
Type
Presidential regulation, not yet
Issued by
President of the Republic of Indonesia, drafted by Komdigi
Legal form
Presidential regulation, Article 7(1)(e) of Law 12/2011. Binding once signed and promulgated.
Key points
  • Draft text not published. What is known comes from official statements.
  • Described as risk-based, with three tiers, low, high and unacceptable risk.
  • Described as carrying no criminal sanctions, relying on self-assessment, and requiring incident reporting channels.
EU counterpart
The AI Act sets binding prohibitions (Article 5), high-risk duties (Article 6 and Annex III), transparency duties (Article 50), serious incident reporting (Article 73) and fines (Article 99).
Sources
Source Archived copy [1, 6, 7]See every link in the ontology
Entries

Expanded ASEAN Guide on AI Governance and Ethics, Generative AI

In forceNot bindingNot yet read in full
Type
Regional guidance, 2025-01
Issued by
ASEAN Digital Ministers
Legal form
Regional guidance. Not part of Indonesian law and not binding on member states.
Key points
  • Expands the ASEAN Guide on AI Governance and Ethics, adopted on 2 February 2024, to cover generative AI.
  • The 2024 guide sets seven guiding principles, including transparency, fairness, security and safety, and accountability.
EU counterpart
Comparable in status to EU guidance documents rather than to the AI Act itself.
Sources
Source Archived copy [8, 9]See every link in the ontology
Entries

Project NUSA (Indonesia and Singapore AI governance initiative, Korika and AI Singapore)

AnnouncedNot bindingNot yet read in full
Type
Bilateral initiative, 2026-10-21
Issued by
Korika (Indonesia) and AI Singapore
Legal form
Bilateral initiative. Not a legal instrument.
Key points
  • Launched on 21 October 2026 as an AI governance initiative between Indonesia and Singapore.
EU counterpart
No counterpart in EU law.
Sources
Source Archived copySee every link in the ontology

Personal Data Protection Law (Law 27/2022)

In forceBindingRead in full by the author
Type
Law, 2022
Issued by
House of Representatives (DPR) and the President
Legal form
Law, Article 7(1)(c) of Law 12/2011. Binding.
Key points
  • Article 46 requires written notice of a personal data protection failure within 3 x 24 hours, to the data subject and to the agency.
  • Article 58 provides for an agency that is set up by, and answerable to, the President.
  • Article 74 gave controllers and processors two years to adjust, until 17 October 2024. The law sets no date for forming the agency, and it had not been formed by then.
EU counterpart
GDPR Article 33 requires breach notice to the supervisory authority within 72 hours. GDPR Article 51 requires independent supervisory authorities.
Sources
Source Archived copy [10, 11, 12, 13]See every link in the ontology

Government Regulation 33/2026 implementing the PDP Law

SignedBindingNot yet read in full
Type
Government regulation, 2026-07-16
Issued by
President of the Republic of Indonesia
Legal form
Government regulation, Article 7(1)(d) of Law 12/2011. Binding once in effect.
Key points
  • Implements the Personal Data Protection Law. Signed on 16 July 2026, in effect from 16 January 2027.
  • Known so far from law firm summaries. The text has not yet been read for this ledger.
EU counterpart
The GDPR is directly applicable and needs no implementing regulation in this sense.
Sources
Source Archived copy [1, 13]See every link in the ontology
Entries

The wider legal framework

These instruments are not AI-specific, but they decide how AI can be used in public life in Indonesia, so the ledger cites them.

InstrumentWhy it matters for AI governance
Law 12/2005 ratifying the International Covenant on Civil and Political Rights [14]Makes Article 19 of the Covenant, the freedom to seek, receive and impart information, binding on Indonesia. The UN Human Rights Committee reads its limits narrowly in General Comment 34. [15]
Law 14/2008 on Public Information Disclosure [16]Gives everyone the right to request information from public bodies, including how a ministry uses AI. The route to unpublished drafts and procurement records.
Law 1/2024, the second amendment to the Electronic Information and Transactions Law [17]Governs online content and electronic systems, the legal ground on which AI services and online speech meet. Parts were read down by the Constitutional Court in Decision 115/PUU-XXII/2024.
Law 27/2022 on Personal Data Protection [10]The only binding law in force that sets duties for systems trained on or processing personal data, including breach notification. Its supervisory agency has not been formed.

References

  1. Undang-Undang Nomor 12 Tahun 2011 tentang Pembentukan Peraturan Perundang-undangan, sebagaimana telah diubah terakhir dengan Undang-Undang Nomor 13 Tahun 2022. https://peraturan.bpk.go.id/Details/39188
  2. Hukumonline, Klinik Hukum. Bolehkah Peraturan Menteri Memuat Sanksi Pidana? (on Pasal 7 and Pasal 8 UU 12/2011). https://www.hukumonline.com/klinik/a/bolehkah-peraturan-menteri-memuat-sanksi-pidana-lt5264d6b08c174
  3. JDIH Badan Pemeriksa Keuangan (BPK). Database Peraturan, peraturan.bpk.go.id. https://peraturan.bpk.go.id/
  4. Surat Edaran Menteri Komunikasi dan Informatika Nomor 9 Tahun 2023 tentang Etika Kecerdasan Artifisial. https://web.kominfo.go.id/sites/default/files/kominfo-Surat-Edaran-Kecerdasan-Artifisial.pdf
  5. OECD (2019, updated 2024). Recommendation of the Council on Artificial Intelligence (OECD AI Principles). https://oecd.ai/principles/
  6. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). OJ L, 2024/1689. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
  7. Orrick (July 2026). EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes (on Regulation (EU) 2026/1744). https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes
  8. ASEAN (2024). ASEAN Guide on AI Governance and Ethics. Adopted at the 4th ASEAN Digital Ministers Meeting, 2 February 2024. https://asean.org/wp-content/uploads/2024/02/ASEAN-Guide-on-AI-Governance-and-Ethics_beautified_201223_v2.pdf
  9. ASEAN (2025). Expanded ASEAN Guide on AI Governance and Ethics, Generative AI. https://asean.org/wp-content/uploads/2025/01/Expanded-ASEAN-Guide-on-AI-Governance-and-Ethics-Generative-AI.pdf
  10. Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi. https://peraturan.bpk.go.id/Details/229798
  11. Undang-Undang Nomor 27 Tahun 2022, Pasal 46 (pemberitahuan kegagalan pelindungan data pribadi), pasal.id. https://pasal.id/peraturan/uu/uu-no-27-tahun-2022/pasal-46
  12. ANTARA (2024). Masih ada waktu, Presiden Jokowi bentuk Komisi PDP. https://www.antaranews.com/berita/4343699/masih-ada-waktu-presiden-jokowi-bentuk-komisi-pdp
  13. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). OJ L 119, 4.5.2016. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
  14. Undang-Undang Nomor 12 Tahun 2005 tentang Pengesahan International Covenant on Civil and Political Rights. https://peraturan.bpk.go.id/Details/40261/uu-no-12-tahun-2005
  15. UN Human Rights Committee (2011). General Comment No. 34, Article 19: Freedoms of opinion and expression. CCPR/C/GC/34. https://digitallibrary.un.org/record/715606
  16. Undang-Undang Nomor 14 Tahun 2008 tentang Keterbukaan Informasi Publik. https://peraturan.bpk.go.id/Details/39047
  17. Undang-Undang Nomor 1 Tahun 2024 tentang Perubahan Kedua atas Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik. https://peraturan.bpk.go.id/Details/274494