🇮🇩Indonesia

Overview

Indonesia’s approach to artificial intelligence (AI) regulation is defined by a strategic transition from aspirational policy and non-binding ethical guidelines toward a formal, risk-based legal framework. The foundational vision is articulated in the Strategi Nasional Kecerdasan Artifisial 2020–2045 (Stranas AI), which positions AI as a primary driver for the 'Golden Indonesia 2045' national development goal. This strategy identifies five priority sectors: healthcare, bureaucratic reform, education, food security, and smart cities. The government’s philosophy emphasizes 'Digital Sovereignty,' ensuring that AI development is inclusive, safe, and aligned with the national ideology of Pancasila. This involves balancing the need for rapid technological innovation to boost economic growth with the necessity of protecting fundamental rights and public safety. The roadmap also highlights the importance of talent development, data infrastructure, and research collaboration to ensure Indonesia is not merely a consumer of AI but a significant global contributor to the digital economy. As of 2025 and early 2026, the regulatory landscape is maturing rapidly. While early governance relied heavily on 'soft law' instruments like Ministerial Circulars and industry codes of conduct, the government has moved to consolidate these into binding executive and legislative acts. The Ministry of Communication and Digital (Komdigi) is the central coordinating body, leading the development of a National AI Roadmap and a Presidential Regulation (Perpres) on AI Ethics and Safety. This evolution reflects a growing recognition that as AI systems become more autonomous and impactful, voluntary guidelines must be supplemented by mandatory risk assessments, transparency requirements, and clear institutional oversight to mitigate harms related to bias, security, and data privacy.

Regulatory approach

Indonesia utilizes a hybrid regulatory model that combines horizontal, cross-cutting laws with vertical, sector-specific mandates. The horizontal layer is anchored by the Personal Data Protection Law (UU PDP) and the Electronic Information and Transactions Law (UU ITE), which provide the baseline for data handling and electronic system security. Above this, the government is implementing a risk-based classification system, similar to international models like the EU AI Act. This approach distinguishes between prohibited AI practices, high-risk applications (such as those in healthcare, critical infrastructure, and biometric identification), and limited or minimal-risk systems, with compliance obligations scaling according to the potential for harm. The regulatory strategy is also characterized by a 'phased implementation' framework. The initial phase focused on building awareness and ethical baselines through instruments like the Ministerial Circular No. 9 of 2023. The current phase involves the formalization of these rules into a Presidential Regulation (Perpres) and eventually a dedicated AI Act (RUU AI). This allows the government to remain agile in the face of rapid technological shifts while providing the legal certainty required for large-scale investment. Sectoral regulators, most notably the Financial Services Authority (OJK), have been empowered to issue their own authoritative manuals, ensuring that high-stakes industries like banking have granular, lifecycle-based governance that complements the national horizontal standards. This co-regulatory model encourages industry associations to develop technical standards that align with government-mandated safety thresholds. The governance of AI in Indonesia is a multi-agency effort led by the Ministry of Communication and Digital (Komdigi). Komdigi acts as the primary steward for digital policy, responsible for issuing technical standards, managing the registration of Electronic System Operators (PSEs), and coordinating the National AI Roadmap. Under the proposed Perpres and RUU AI, Komdigi is expected to host a national coordination secretariat or advisory council that brings together representatives from industry, academia, and other government agencies to ensure a unified approach to AI market surveillance and policy updates. This body will likely oversee the certification of AI models and the monitoring of algorithmic transparency. Complementing Komdigi are several specialized agencies with distinct mandates. The National Cyber and Crypto Agency (BSSN) is responsible for the cybersecurity and technical resilience of AI models, providing frameworks for security-by-design and incident response. The Financial Services Authority (OJK) holds absolute mandate over AI applications in the financial sector, including credit scoring and automated trading. Furthermore, the National Research and Innovation Agency (BRIN) oversees the development of national standards and research ethics, ensuring that AI innovation is grounded in rigorous scientific validation and ethical testing protocols. These agencies work in concert to ensure that AI deployment does not compromise national security or financial stability.

Enforcement & penalties

Enforcement of AI-related obligations in Indonesia is currently managed through a tiered system of administrative and criminal sanctions derived from the UU ITE and UU PDP. Under the Personal Data Protection Law, entities that fail to secure data or violate processing principles can face administrative fines capped at 2% of their annual global revenue. Other administrative measures include written warnings, temporary suspension of AI processing activities, and the mandatory deletion of illegally processed data. The government has signaled that the forthcoming Perpres and RUU AI will introduce specific 'AI-conformity' penalties for providers who fail to register high-risk systems or perform mandatory impact assessments. Criminal penalties are reserved for the most serious violations, such as the intentional misuse of personal data, the creation of AI-generated content that disturbs public order (under narrowed definitions by the Constitutional Court), or unauthorized access to electronic systems. The 2024 amendment to the ITE Law clarified the administrative enforcement regime, allowing the Ministry to terminate access to platforms that do not comply with safety standards. Appeals against regulatory decisions are typically handled through the Administrative Court (PTUN), while constitutional challenges regarding the scope of enforcement powers are adjudicated by the Constitutional Court (Mahkamah Konstitusi). The enforcement landscape is expected to become more rigorous as the Data Protection Authority reaches full operational capacity.

Data protection

The Personal Data Protection Law (UU PDP No. 27/2022) is the cornerstone of Indonesia's AI data governance. It classifies personal data into general and specific (sensitive) categories, with the latter including biometric, genetic, and health data—all of which are frequently utilized in AI training and deployment. AI controllers are required to establish a lawful basis for processing, such as explicit consent or contractual necessity, and must conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities. The law also mandates the appointment of a Data Protection Officer (PPDP) for organizations that process large-scale data or handle sensitive information. This framework ensures that AI models are trained on legally obtained data and that data subjects retain their rights to access and correction. Data localization is a significant component of the Indonesian framework, particularly for public-scope Electronic System Operators (PSEs). Under Government Regulation No. 71 of 2019 (PP 71/2019), public bodies must store and process data within Indonesia, whereas private-scope PSEs are generally permitted to process data abroad provided they ensure compliance with Indonesian law and allow for lawful access by authorities. The PDP Law also introduces strict requirements for cross-border data transfers, requiring the recipient country to have a level of protection at least equivalent to Indonesia's, or for the controller to obtain specific authorization from the data subject and the regulatory authority. These rules are critical for AI companies operating globally while serving the Indonesian market.

Sector-specific rules

The financial sector is the most advanced in terms of AI-specific regulation in Indonesia. The Otoritas Jasa Keuangan (OJK) has issued comprehensive guidance for both traditional banks and fintech entities. The 2025 Buku Panduan Tata Kelola AI Perbankan requires banks to implement a 'human-in-the-loop' approach for high-risk applications like credit decisioning and fraud detection. It also mandates the creation of internal AI Committees and the maintenance of detailed audit trails to ensure that algorithmic decisions can be explained to both customers and supervisors. This is supplemented by the 2023 Code of Ethics for Fintech, which focuses on fairness and the prevention of algorithmic bias in digital lending. Beyond finance, the government is prioritizing the development of sectoral rules for healthcare and public administration. In healthcare, AI applications for diagnostics and telemedicine are expected to follow strict clinical validation standards set by the Ministry of Health, in alignment with the Stranas AI priorities. For bureaucratic reform, the focus is on 'Smart Government' initiatives where AI is used to automate public services; these systems are subject to transparency requirements to ensure that automated administrative decisions do not infringe on citizens' rights to due process. Each of these sectors is encouraged to develop 'regulatory sandboxes' to test AI innovations under controlled supervisory conditions, allowing for safe experimentation before full-scale deployment.

International alignment

Indonesia’s AI regulatory strategy is heavily influenced by international norms, particularly the OECD AI Principles and the risk-based architecture of the EU AI Act. The government has actively participated in the development of the ASEAN Guide on AI Governance and Ethics, seeking to ensure that its domestic rules are interoperable with regional neighbors to facilitate digital trade. Official documents, such as the OJK Banking Guidance and the Komdigi White Paper, explicitly reference international benchmarks to ensure that Indonesian AI systems are 'trustworthy' and 'globally compatible.' This alignment is intended to reduce compliance burdens for multinational firms operating in the region. Furthermore, Indonesia is a signatory to various international agreements that emphasize ethical AI and cybersecurity cooperation. The Ministry of Communication and Digital has stated its intent to align the forthcoming Presidential Regulation with global safety standards, including those related to generative AI and synthetic media labeling. By adopting these international frameworks, Indonesia aims to attract foreign investment in its digital economy while maintaining the ability to enforce its own national security and data sovereignty requirements. This alignment is viewed as essential for the 'Indonesia 2045' vision, which requires the nation to be a leader in the global digital value chain and a hub for ethical AI innovation.

What's next

The year 2025 and 2026 are expected to be a landmark period for AI legislation in Indonesia. The most significant pending development is the promulgation of the Presidential Regulation (Perpres) on AI Ethics and Safety, which will move the country from voluntary guidelines to a mandatory governance framework for high-risk AI. This Perpres is expected to establish the national registration system for AI models and define the technical standards for 'model cards' and transparency disclosures. Simultaneously, the government is finalizing the Buku Putih Peta Jalan Kecerdasan Artifisial Nasional (National AI Roadmap), which will set the investment and infrastructure priorities for the next decade, including the development of national AI compute resources. In the legislative branch, the Rancangan Undang-Undang tentang Kecerdasan Buatan (RUU AI) remains a high priority for the House of Representatives (DPR). While the Perpres provides immediate executive oversight, the RUU AI is intended to provide a permanent statutory basis for AI liability, intellectual property rights in the context of AI-generated content, and the establishment of a permanent National AI Authority. Stakeholders should also monitor the full implementation of the PDP Law’s enforcement phase, as the newly established Data Protection Authority begins to issue its first rounds of audits and administrative fines, which will set the precedent for how AI-related data breaches and algorithmic harms are handled in the future.