What is AI regulation in Taiwan?

How it works

The 2024 draft has become enacted law

Many summaries still talk about Taiwan's "draft AI Basic Act". That is no longer the current position. The National Science and Technology Council opened a draft for consultation in July 2024, but Taiwan now has an enacted Artificial Intelligence Basic Act. It was promulgated on 14 January 2026 and took effect the same day.

That change matters because older commentary often describes a proposal, not the law now in force. If you are checking Taiwan's AI position today, the starting point is no longer the consultation draft. It is the enacted Basic Act, read together with the sector rules and the Personal Data Protection Act.

The act is a framework statute rather than a full product code

The AI Basic Act is designed to set direction, principles and institutional responsibilities. It defines AI broadly as a system capable of autonomous operation that, through input or sensing and by means of machine learning and algorithms, can generate predictions, content, recommendations or decisions that affect physical or virtual environments.

Its core logic is constitutional and administrative rather than product-by-product. The act says AI policy should be human-centred and follow principles including sustainable development and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability.

That makes it important, but it also shows its limits. The act does not read like a single licence or conformity framework for every AI deployer. It expressly says that matters not stipulated in the act are governed by other laws. In practice, this means the basic act frames the system, while older laws and sector regulators do much of the concrete work.

Roles are split across NSTC, MODA, the Executive Yuan and sector regulators

Taiwan has chosen a coordinated model instead of putting all AI powers in one specialist regulator. Under the act, the National Science and Technology Council is the central competent authority, while local governments are the local competent authorities. But where a matter falls within a specialist field, the relevant central sector authority handles it.

The Executive Yuan must establish a National AI Strategic Committee, chaired by the Premier, to coordinate, promote and supervise national AI affairs and to formulate National AI Development Guidelines. On 21 May 2026, the Executive Yuan announced that it would formally establish this committee and that NSTC would lead the drafting of Taiwan's first National AI Development Guidelines.

MODA has a distinct operational role. The act assigns it responsibility to promote an AI risk taxonomy and assessment framework aligned with international norms and to help sector authorities build risk-based management rules. The same structure also gives MODA and other relevant agencies a role in assessment and verification tools for high-risk AI.

For businesses, the practical message is simple: there is no single answer to "Who regulates my AI use in Taiwan?" The answer depends on whether your issue is system-wide governance, public sector use, data protection, finance, health, telecoms, procurement or another regulated field.

The act sets deadlines and immediate public sector duties

The AI Basic Act contains principles, but it also creates a timetable. It says government agencies must review laws, regulations and administrative measures under their jurisdiction and, within two years of the act taking effect, complete the needed enactment, amendment, repeal or administrative improvement work. Because the act took effect on 14 January 2026, that implementation window runs to January 2028.

The act also includes two practical ideas that operators should watch closely. First, where a sector authority, after consulting MODA, identifies an AI product or system as high-risk, the product or system must carry advisory notices or warnings. Second, when government uses AI to perform duties or provide services, it must conduct risk assessments and plan risk responses, then establish usage guidelines, regulations or internal control mechanisms suited to the task.

The Executive Yuan then made this more concrete in May 2026. It directed government agencies at all levels to complete risk assessments for official AI use by July 2026 and to finish internal control rules within one year. It also told sector regulators to issue management rules, industry guidance, or legal adjustments for AI applications in their own domains by January 2028.

So the act is not merely symbolic. It creates a real implementation programme. The point, however, is that much of the heavy compliance detail is still being built and will arrive through sector-specific instruments rather than through one giant follow-on AI statute.

Data protection remains the main hard-law control for many AI deployments

For many real-world deployments, the most immediate legal risk in Taiwan is still personal data law. Taiwan's Personal Data Protection Act is not AI-specific, but it governs many of the activities that make AI deployment legally sensitive: collecting training data, using customer records, enriching profiles, prompt inputs containing personal data, model monitoring, incident response, and cross-border data transfers.

The PDPA requires a lawful basis for collection and processing, and it imposes notice duties when personal data is collected directly or indirectly. It gives data subjects rights to inquire, review, obtain copies, supplement or correct data, demand cessation of collection, processing or use, and demand erasure. It also requires security and maintenance measures to prevent theft, alteration, damage, loss or leakage of personal data.

The breach side matters too. Where an organisation becomes aware that personal data has been stolen, altered, damaged, lost or leaked, it must notify the data subject, and some cases must also be reported to the competent authority. The law also allows restrictions on cross-border transfers in specified circumstances.

Enforcement powers are substantial. The competent authority may inspect organisations, require documents and explanations, order rectification, prohibit collection, processing or use, order deletion or destruction of unlawfully handled data, and publicise violations. Depending on the breach, fines can escalate materially, especially for failures in security and maintenance. In serious misuse cases, criminal penalties can also apply.

Two further points are easy to miss. First, the amended PDPA names the Personal Data Protection Commission as the competent authority, but it also allows a transition in which some announced sectors may remain supervised by their industry regulators for part of the enforcement architecture. Second, the PDPA can apply outside Taiwan, because it also covers government and non-government agencies outside the territory of the Republic of China when they collect, process or use the personal data of ROC nationals.

That means foreign AI vendors, group entities and cross-border service providers should not treat Taiwan as relevant only when they have a local subsidiary.

Sector rules and public sector controls already shape practice

Taiwan's sector regulators are already using guidance and product law to govern AI in practice. In finance, the Financial Supervisory Commission issued Guidelines for Artificial Intelligence Applications in the Financial Industry in June 2024. They are administrative guidance rather than a standalone AI statute, but they set supervisory expectations across the AI life cycle. The guidelines tell financial institutions to apply core principles in a risk-based way, manage third-party operators contractually, consider independent review where needed, minimise personal data, preserve explainability, and keep human judgement in the loop where a third-party generative model cannot be fully controlled for fairness or reliability.

In healthcare, AI is already being pulled into existing medical device law. The Ministry of Health and Welfare states that the Medical Device Act is the anchor statute and that TFDA has issued digital health guidance covering AI and ML, software as a medical device, cybersecurity and registration. That means an AI diagnostic or decision-support tool is not treated as a free-floating software feature if it falls within regulated medical-device territory. It is dealt with through medical-device approval and post-market controls.

Taiwan's public sector posture is also unusually important because the government is using itself as the first large controlled deployment environment. In August 2023, the Executive Yuan released reference guidance for the use of generative AI by the Executive Yuan and affiliated agencies. The stated purpose was to let agencies use generative AI while preserving confidentiality and professionalism in official work, on principles including responsible and trustworthy use, safety, privacy and data governance, accountability, and control over the technology.

MODA then built this into operational machinery. Its Government AI Application Sandbox, called TryAI, gives agencies a dedicated testing environment so they can trial models and tools before procurement. By late 2025 it was already being used by more than 30 agencies. This matters not only for ministries. It matters for vendors selling into government, because the state is signalling the kind of controlled testing, procurement discipline and documentation it expects.

Taken together, these features show Taiwan's broader governance posture. It is not waiting for one exhaustive AI code before acting. It is using a framework law, data protection, sector oversight, public sector guidance and controlled experimentation to move from principle to practice.