AI Compliance for HR

Using AI in HR touches several laws: PDPA, labour law and anti-discrimination. The compliance framework Thai HR teams need to understand in 2026.

In 2026, Thai companies using AI in HR processes are starting to face questions from legal counsel that they can't answer. Is the AI we use now compliant with PDPA? How does it affect labour law? If a candidate sues over discrimination, how is the company liable? These questions have no single answer, but HR teams that understand AI compliance well put guardrails in place before a crisis and invest in a framework that complies with Thai and international law.

Laws That Affect AI in HR

Using AI in HR in Thailand falls under several laws.

Key Laws

1. PDPA, the Personal Data Protection Act, which covers every stage of AI that uses personal data
2. Labour law, regarding decisions that affect employees' rights
3. Anti-discrimination law, which prohibits bias in hiring and evaluation
4. Industry-specific regulations, such as in highly regulated sectors like finance and healthcare
5. International laws that apply if the company has employees in Europe or the US, such as GDPR and EEOC rules

Complying with several laws at once requires a systematic governance framework, not case-by-case responses.

PDPA and AI in HR

PDPA covers every stage at which AI touches personal data.

What You Must Comply With

• A lawful basis for processing data, usually consent or legitimate interest
• Purpose limitation: use data only as stated in the privacy notice
• Data minimisation: collect only what is necessary
• Retaining data no longer than the defined period
• Data subject rights: the right to access, correct, delete and withdraw consent
• Cross-border transfers, which require adequate protection
• Breach notification within 72 hours

When using AI from overseas vendors, you need to check whether cross-border transfer is permitted under the PDPA framework. AI hosted in Thailand is safer, but there may be fewer options.

Managing Consent for AI

Compliant consent must clearly state at which stages AI is used.

What Consent Should Cover

• The types of data the AI processes
• The purpose of using AI
• How the AI makes decisions, to an explainable level
• The effect of AI decisions on candidates or employees
• The right to request human review
• The data retention period
• Sharing with third parties, including AI vendors

Consent that is too broad and doesn't mention AI is not compliant. Specific, easy-to-understand consent is the new standard the market expects. Read PDPA and Candidate Data for a deep dive.

Managing Bias Risk

Thailand's anti-discrimination law is not on par with the US, but it is moving in a progressive direction.

Reducing Bias Risk

• Test AI output by demographic every quarter
• Keep a traceable audit log of AI decisions
• Have human review that can override decisions
• Document the AI design so it can be disclosed if audited
• Have a retraining process when bias drift is detected

Having no audit log is the biggest risk when you are sued. A company that can't explain how its AI made a decision loses the case automatically. Investing in logging from the start is cheaper than fixing it later.

AI compliance isn't about banning AI. It's about designing processes that are transparent and accountable.

Defining Accountability

The question legal counsel always asks HR is: who is responsible when AI makes a wrong decision?

Accountability Framework

1. The HR Leader who approves deploying the AI
2. The Data Protection Officer who oversees PDPA compliance
3. The AI vendor, as specified in the DPA
4. The person making the final decision using the AI's output
5. The audit committee, which reviews quarterly

Clear accountability isn't about finding someone to blame. It's about everyone knowing their role and having a process that makes AI decisions safe.

Preparing for Incidents

An AI incident is not a matter of if, but when.

Being Prepared

• An incident response plan that sets out the steps to report, investigate and remediate
• A communication plan for affected candidates or employees
• Contact with internal and external legal counsel
• Notifying the PDPA Commission where the breach criteria are met
• Pausing the AI tool during the investigation
• Documenting every step for later audit

Practising incident response annually helps the team be ready when it really happens, instead of scrambling for a response during a crisis.

Choosing a Compliant AI Vendor

A compliant vendor reduces the company's legal burden.

Vendor Selection Criteria

• A DPA (Data Processing Agreement) that covers PDPA
• An up-to-date bias testing report
• An audit log that customers can access
• ISO 27001 or an equivalent security standard
• Insurance covering damages
• References from Thai companies already using it
• Thai-language support and knowledge of the Thai legal context

A vendor that can't answer these points is not a safe partner for enterprise HR. Read Responsible AI in HR for a broader frame.

Connecting to HR Strategy

AI compliance isn't separate work; it is part of the entire AI deployment.

It connects with Responsible AI in HR, the overarching framework, and Agentic AI in HR, which is the future.

Using AI for background checks requires care. Read Background Checks in Thailand and AI Candidate Screening.

For HR professionals who want to understand the legal framework, see compliance courses for HR in Plants.work Learn or talk to an AI legal adviser on the Mentors page. In summary, AI compliance in HR isn't about blocking AI; it's about deploying it safely. Organisations that set up this framework from the start avoid crises and can scale AI for the long term.