Preparing for Indonesia's AI Regulation: What Companies Should Do Before Deploying Artificial Intelligence

Artificial intelligence is increasingly becoming part of everyday business operations. Companies use AI to generate content, analyse data, serve customers, rank information, support recruitment, prepare documents, develop software, and produce recommendations that may influence business decisions.

Its growing use also creates legal questions that are not always straightforward.

What information may employees enter into an AI system? Who is responsible when an AI-generated result is wrong? Can customer data be used to develop or improve a model? What happens if AI-generated content resembles a third party's protected work? To what extent should important decisions be delegated to automated systems?

These questions are becoming increasingly important as Indonesia prepares a more comprehensive AI governance framework.

Indonesia Is Preparing an AI Regulatory Framework

The Government is currently preparing two principal instruments: a proposed Presidential Regulation on Artificial Intelligence Ethics and a proposed Presidential Regulation on the National Artificial Intelligence Roadmap 2026–2029.

Cross-ministerial discussions on the two drafts were completed in May 2026 before they were submitted for the Presidential approval process. In July 2026, the Ministry of Communication and Digital Affairs stated that the instruments had been prepared and were awaiting Presidential approval. As recently as 17 September 2026, the Ministry continued to describe the National AI Roadmap 2026–2029 and AI ethics regulation as instruments being prepared by the Government.

Companies should therefore distinguish between regulations that are already in force and policy instruments that remain in the process of enactment.

The final contents of the two Presidential Regulations should not yet be treated as binding legal obligations.

Nevertheless, the direction of policy is increasingly clear. Government statements consistently refer to ethical, safe, inclusive, responsible, and transparent AI use while maintaining space for innovation. The Government has also indicated that regulation through a Presidential Regulation may be an initial stage before the development of a more comprehensive AI Law.

AI Is Already Subject to Existing Law

The absence of a comprehensive AI Presidential Regulation does not mean that the use of AI currently takes place in an unregulated environment.

Where AI processes personal data, Law No. 27 of 2022 on Personal Data Protection continues to apply.

Where AI operates through an electronic system, the Electronic Information and Transactions Law and Government Regulation No. 71 of 2019 may also become relevant.

Copyright, trade secrets, contractual obligations, consumer protection, and sector-specific regulations continue to apply depending on the activity concerned.

Indonesia also already has Minister of Communication and Informatics Circular Letter No. 9 of 2023 on Artificial Intelligence Ethics.

The guidance identifies principles including inclusivity, humanity, security, accessibility, transparency, credibility and accountability, personal data protection, sustainability, and intellectual property.

Companies therefore do not need to wait for the next AI regulation before establishing internal governance.

1. Map AI Use across the Organisation

The first step is understanding where AI is actually being used.

In many organisations, AI use does not originate solely from the technology department.

Marketing teams may use generative AI for content. Human resources departments may use software with candidate-ranking features. Legal teams may use AI to review contracts. Customer service departments may use chatbots, while finance teams may use systems that produce forecasts or identify particular transactions.

Companies should consider creating an inventory recording at least the AI system being used, its intended purpose, internal users, technology provider, categories of data processed, outputs produced, and whether the output is used in decisions affecting customers, employees, vendors, or other parties.

Without such an inventory, it becomes difficult to identify where the organisation's actual AI risks exist.

2. Classify AI Use according to Risk

Not all AI applications present the same level of risk.

Using AI to summarise meeting notes creates a different risk profile from using it to assess credit eligibility, screen job applicants, determine prices, process claims, or generate recommendations that directly affect an individual.

Companies can therefore begin classifying AI use according to its potential impact.

Applications involving sensitive data, decisions concerning individuals, material transactions, safety, or public-facing services should generally be subject to stronger controls.

A risk-based approach also helps determine when additional testing, management approval, legal review, or human supervision should be required before deployment.

3. Maintain Human Oversight for Important Decisions

One of the risks of AI arises when system outputs are accepted without meaningful human review.

That risk becomes greater where AI is used for decisions that affect an individual's rights or interests.

Indonesia's Personal Data Protection Law expressly gives data subjects the right to object to decision-making based solely on automated processing, including profiling, where the decision creates legal consequences or has a significant impact.

The law also identifies automated decision-making with legal or significant effects as a form of high-risk personal data processing relevant to a data protection impact assessment.

Companies should therefore determine which decisions may be assisted by AI and which decisions still require human validation.

Human oversight does not necessarily mean manually checking every AI output.

The level of review can be proportionate to risk. However, as the consequences of a decision become more significant, it becomes increasingly important to have a person who can review, challenge, correct, or override the system's result.

4. Review the Use of Personal Data

AI systems frequently process large amounts of information.

Risks arise when employees enter customer names, contracts, employee information, financial data, internal correspondence, or other information into external AI services without understanding how that information will be processed.

The Personal Data Protection Law regulates the obligations of personal data controllers and processors, including processing purposes, security, data subject rights, and responsibility for personal data processing.

An internal AI policy should therefore clearly distinguish information that may and may not be entered into AI services.

Companies should also understand whether information is retained by the provider, used to improve its models, transferred to another jurisdiction, or accessed by subprocessors.

5. Address Intellectual Property Risks

AI creates intellectual property risks in two directions.

First, prompts or other inputs may contain copyrighted works, software, images, databases, trade secrets, or other materials owned either by the company or by third parties.

Second, AI outputs may resemble existing protected works or may be commercially used even where their ownership status is not entirely clear.

Ministerial Circular Letter No. 9 of 2023 expressly identifies intellectual property protection as a principle relevant to AI use. Indonesia's Copyright Law also continues to govern the use of protected works.

Companies should therefore avoid assuming that every AI output is automatically safe for publication or commercial exploitation.

Review procedures become particularly important where AI is used for design, advertising materials, software, music, photographs, video, reports, and other commercially valuable content.

6. Review Contracts with AI Providers

Dependence on third-party AI providers may create contractual risks that are easily overlooked.

Before adopting an AI platform across the organisation, companies should understand:

• who owns the inputs and outputs;

• whether customer or company information may be used to train the provider's model;

• how long data is retained;

• where data is processed;

• whether subprocessors are involved;

• responsibility for security incidents;

• whether intellectual property indemnities are available;

• whether audit logs are accessible;

• how model changes or changes to terms of service are handled; and

• what happens to company information when the relationship ends.

For AI used in material business processes, simply accepting standard terms of service may not be sufficient.

Data-processing terms, security standards, service levels, audit rights, and allocation of liability may be equally important.

7. Determine When AI Use Should Be Disclosed

Transparency is becoming a recurring feature of Indonesian AI governance.

The 2023 AI Ethics Circular already identifies transparency, credibility, and accountability as relevant ethical principles.

In electronic commerce, this development has already moved into binding regulation.

Minister of Trade Regulation No. 19 of 2026 provides that businesses using AI in electronic commerce are responsible for its use.

Among other requirements, businesses must provide information and/or labels so consumers are aware when goods or services generated, displayed, recommended, or promoted involve AI.

Electronic commerce platform operators are also required to provide internal AI governance proportionate to the risks involved and a mechanism for complaints or corrections relating to AI-generated information or recommendations.

This development is significant because it demonstrates that AI regulation in Indonesia is not developing solely through one overarching national regulation. Sector-specific requirements are already emerging.

Companies should therefore determine when customers, employees, or other parties need to be informed that they are interacting with an AI system or receiving AI-generated content.

8. Maintain Documentation and Audit Trails

When problems arise, one of the first questions is how a particular result or decision was produced.

Documentation of AI use is therefore important.

Companies may record the system used, model version where relevant, key instructions or parameters, data sources, internal approvals, testing results, risk findings, and changes made after implementation.

For higher-risk AI applications, such records can assist the company in demonstrating that reasonable oversight, testing, and mitigation measures were undertaken.

Audit trails can also become important where a customer or employee requests a correction, discrimination is alleged, a dispute arises, or an AI output causes harm.

9. Establish an AI Incident-Response Process

AI may produce information that is inaccurate, incomplete, biased, or inappropriate to its context.

Companies should therefore treat AI incidents in a similar manner to other technology risks.

There should be a route for reporting errors, suspending the system when necessary, conducting an investigation, correcting data or system behaviour, and informing affected parties where a material impact has occurred.

Such mechanisms become increasingly important where AI is used for customer services, product recommendations, finance, employment, healthcare, or other processes directly affecting individuals.

10. Develop an Internal AI Policy

One practical measure companies can take immediately is to develop an internal AI policy.

The document does not necessarily need to be extensive.

Its purpose is to give employees clear rules for acceptable AI use.

The policy may cover approved AI services, categories of information that may not be entered into AI tools, use of AI in important decisions, review of outputs, protection of trade secrets, ownership of work product, use of AI in software development, transparency toward customers, and procedures for responding to errors.

Ministerial Circular Letter No. 9 of 2023 itself is intended, among other purposes, to guide companies and electronic system operators in developing internal policies concerning data and AI ethics.

Companies Do Not Need to Wait for the Final Regulation

Indonesia's AI regulatory framework continues to develop.

The final text of the proposed AI Ethics Presidential Regulation and National AI Roadmap 2026–2029 will need to be reviewed once formally enacted before their legal obligations can be determined.

Companies, however, do not need to wait until that point before establishing governance.

Most of the foundations are already sensible risk-management measures under the current legal environment: knowing where AI is used, understanding what data it processes, maintaining security, preserving human oversight, protecting intellectual property, governing vendor relationships, and providing mechanisms for accountability.

Companies that establish these structures now should be in a stronger position to adapt once Indonesia's national AI framework is formally introduced.

Conclusion

AI allows companies to perform activities that previously required substantially greater human and technological resources.

As AI becomes more deeply embedded in business processes, however, the need to ensure that its use remains accountable also increases.

Ahead of Indonesia's emerging AI regulatory framework, companies should consider not merely whether a particular technology can be used, but how it is used, what information it processes, who reviews its output, who is responsible when errors occur, and whether the rights of other parties remain protected.

Effective AI governance ultimately serves more than regulatory compliance.

It can help companies protect customer trust, safeguard information assets, reduce the risk of disputes, and ensure that the technology creates sustainable value for the business.