AIWiki
Malaysia
Back to all articles
Malaysia Focusphilippinesaseanai policy

Artificial Intelligence in the Philippines

4 min readUpdated October 2026
AI in the Philippines
Country
Philippines
Lead agencies
DOST, DTI, DICT, NPC
Key policy
NAIS-PH (approved 20 May 2025)
AI-specific law
None enacted as of 2026
Binding rules
Data Privacy Act 2012; NPC, BSP, IPOPHL issuances
Related
ASEAN AI Governance, PDPA (Malaysia)
Artificial intelligence in the Philippines is shaped by a national strategy approved by President Ferdinand Marcos Jr. on 20 May 2025 — the National AI Strategy for the Philippines (NAIS-PH) — alongside the Data Privacy Act of 2012 and a small number of AI-specific regulator issuances. As of September 2026 the Philippines has no comprehensive AI statute: AI Act-style bills remain pending in Congress, and the binding rules come from general laws plus narrow sector guidance.[1][3]

Background

The Philippines began formalising AI policy with the Department of Information and Communications Technology's Philippine AI Roadmap 2021–2025, followed by the National AI Strategy Roadmap 2.0 (NAIS Roadmap 2.0) launched by the Department of Trade and Industry in 2024 alongside a Center for AI Research. NAIS-PH, developed by DOST with DTI sector roadmaps under a March 2025 presidential directive, organises whole-of-government action through five pillars — infrastructure, workforce, innovation, ethical policy frameworks and priority-sector deployment — targeting an "AI-powered" Philippines by 2028. DTI has projected AI could lift Philippine GDP by about 12% (roughly US$92 billion) by 2030.[2][4]

Legislation has lagged. Bills filed in the 20th Congress include Senate Bill No. 25, the Artificial Intelligence Regulation Act (AIRA), proposing risk-based classification, mandatory impact assessments for high-risk systems, and an expanded role for the National Privacy Commission as lead AI regulator; House Bill No. 7396 would create an AI Development and Regulation Authority (AIDA), and other proposals raise an "AI Bill of Rights". None has been enacted.[1][4]

Key Concepts

  • Data Privacy Act of 2012 (RA 10173) — the primary binding instrument, administered by the National Privacy Commission (NPC). NPC Advisory No. 2024-04 (19 December 2024) extends the Act expressly to AI systems, including training and testing: controllers must disclose the system's purpose, factors and risks, maintain accountability and governance mechanisms, run privacy impact assessments, enable human intervention, and monitor bias.[3]
  • Sectoral regulation — BSP Memorandum No. M-2026-034 (6 July 2026) treats AI as an operational and cyber-resilience risk for banks; IPOPHL Memorandum Circular No. 2026-007 addresses generative AI in copyright filings; COMELEC Resolution No. 11064 (effective 26 September 2024) required labelling and disclaimers on AI-generated content in the 2025 elections and banned deepfakes and bots.[3][5]
  • Voluntary principles — DICT endorses transparency, fairness, human oversight and security, aligned with the ASEAN Guide on AI Governance and Ethics; these are aspirational but increasingly referenced in public procurement.[2]
  • Synthetic likenesses — an NPC notice of 11 August 2026 treats generating and sharing AI images of an identifiable person as processing personal data.[3]

Applications and Impact

The Philippines' business-process outsourcing sector, fintech, agriculture and healthcare are the main adoption fronts; government pilots include AI chatbots for citizen services and AI-assisted permit processing. The absence of a risk-tier statute means obligations currently depend on whether a use case touches personal data, consumer protection, IP or a regulated sector — a situation regulators and law firms describe as "general laws plus three AI-specific issuances".[3]

>See Also

🇲🇾Malaysian Context

🇲🇾 Relevance to Malaysia: The Philippines and Malaysia sit at nearly the same regulatory stage — strategy documents plus data-protection law, no AI statute — so the two regimes are directly comparable. Malaysia's PDPA amendments on automated decision-making and the NPC's advisory track mirror each other, and both feed into the ASEAN AI Governance approach that MDEC and the National AI Office reference. For Malaysian firms operating cross-border — in fintech, e-commerce and shared services — the practical rule is that Philippine obligations bite through RA 10173 whenever personal data of Philippine residents is processed, just as the PDPA applies to Malaysian residents' data. Regional deployments should therefore map one compliance baseline (consent, purpose limitation, human review for significant decisions) and layer country-specific additions on top. NAIS-PH's 2028 horizon also creates collaboration openings for Malaysian AI firms, data-centre operators and universities in the ASEAN single digital market.

References

  1. ↑CyberCode. (2026). AI Law in the Philippines: Dated Status Tracker (status as at 6 September 2026). https://cybercode.ph/ai-law-philippines
  2. ↑Technica. (2026). AI Regulation in the Philippines 2026: What DICT, NPC, and BSP Are Doing. https://technica.ph/insights/ai-regulation-philippines-dict-npc-2026
  3. ↑National Privacy Commission. (2024). Advisory No. 2024-04 on the Application of the Data Privacy Act to Artificial Intelligence Systems Processing Personal Data. https://privacy.gov.ph/
  4. ↑World Watch / Philippines AI Policy. (2026). AI regulation in Philippines: laws & policy. https://anuragverma.co/worldwatch/philippines/ai
  5. ↑Morrison & Foerster. Artificial Intelligence Library — Philippines. https://www.mofo.com/artificial-intelligence/philippines
Back to all articles