1. Introduction

Autonomous Digital Governance in Thailand refers to the legal regulation of digital systems that independently collect information, process personal data, make decisions, execute transactions, manage services and influence the rights and obligations of individuals and organisations.

Examples include:

Artificial intelligence (AI) systems making decisions about loans, employment and insurance.

Automated government services and digital public administration.

Algorithmic management of online platforms.

Autonomous contract formation and execution through smart contracts.

Digital identity verification and biometric authentication.

Automated financial transactions and payment systems.

Data-driven consumer protection and dispute resolution.

Autonomous cybersecurity and information-management systems.

Thailand does not currently have one comprehensive civil-law statute specifically governing autonomous digital governance or granting independent legal personality to AI systems. Instead, liability and legal recognition are determined through existing civil legislation, electronic transaction rules, personal data protection, consumer protection and computer-related laws.

The central legal question is:

Who should bear civil liability when an autonomous digital system makes an incorrect decision, violates privacy, causes financial loss or interferes with an individual's legal rights?

Under Thai law, responsibility generally remains with identifiable natural persons, companies, service providers, data controllers, processors and other legally responsible organisations rather than the autonomous system itself.

2. Legal framework governing autonomous digital governance

A. Civil and Commercial Code of Thailand

The Thai Civil and Commercial Code (CCC) provides the principal foundation for civil liability arising from autonomous digital activities.

Section 420 – General tort liability

Section 420 establishes liability for a person who wilfully or negligently unlawfully injures another person's life, body, health, liberty, property or rights.

Its application includes:

Negligent AI decision-making.

Unauthorised digital surveillance.

Automated financial losses.

Algorithmic discrimination causing legally recognised harm.

Incorrect automated identification.

Negligent operation of autonomous digital services.

For example, if a company's automated credit-assessment system incorrectly identifies a customer as a fraud risk and causes demonstrable financial damage, the customer may pursue a civil claim against the responsible organisation where the requirements of Section 420 are established.

Section 421 – Exercise of rights contrary to their purpose

This provision addresses the wrongful exercise of rights. It may become relevant when a digital platform uses its contractual or technical powers abusively, such as manipulating access restrictions or exercising account-control rights in an improper manner.

Section 425 – Employer liability

An employer may be liable for wrongful acts committed by an employee in the course of employment.

This provision may become relevant where employees negligently configure, supervise or operate autonomous systems and cause damage to third parties.

Section 438 – Assessment of damages

Courts determine the amount and form of compensation according to the circumstances and seriousness of the wrongful act.

This may include financial losses resulting from defective digital governance, subject to proof and the applicable legal requirements.

B. Electronic Transactions Act B.E. 2544 (2001)

The Electronic Transactions Act recognises electronic data messages and electronic transactions.

It is particularly important for autonomous digital governance because automated systems can conclude transactions without continuous human intervention.

Its principal functions include:

Recognition of electronic contracts.

Recognition of electronic signatures.

Legal recognition of electronic records.

Determination of the dispatch and receipt of electronic communications.

Recognition of electronic transactions conducted through automated systems.

The Act's provisions concerning automated message systems are particularly relevant to contracts formed through automated ordering, booking, payment and acceptance mechanisms.

An organisation cannot ordinarily avoid contractual responsibility merely by arguing that its transaction was processed automatically.

C. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA), which became fully effective on 1 June 2022, is a central instrument for autonomous digital governance.

Important provisions include:

These provisions are relevant to AI-powered platforms, automated profiling, biometric identification, digital identity systems and algorithmic decision-making.

Important: Thailand's PDPA does not establish a general GDPR-style right to human review of every automated decision. Nevertheless, its general data-protection principles apply when autonomous systems process personal data.

D. Computer Crime Act B.E. 2550 (2007), as amended

The Computer Crime Act regulates computer-related offences, unauthorised access, interference with computer systems and certain forms of unlawful computer data activity.

It becomes relevant when autonomous digital governance involves:

Unauthorised access to digital platforms.

Manipulation of algorithmic records.

Cyberattacks against automated infrastructure.

Unlawful alteration of electronic information.

Interference with computer systems.

Digital evidence manipulation.

A violation may also create civil consequences under the CCC where the necessary elements of a wrongful act and damage are established.

E. Consumer Protection Act B.E. 2522 (1979)

This legislation protects consumers against unfair commercial practices.

Its relevance includes automated pricing, digital advertising, algorithmic recommendations, online subscription services, misleading platform information and automated customer-service decisions.

Where an autonomous platform causes consumer harm, the relevant trader or service provider may face contractual, tortious or statutory responsibility depending on the circumstances.

F. Digital government and cybersecurity legislation

Two additional laws are particularly relevant:

Digital Government Administration and Services Act B.E. 2562 (2019): supports digital government administration and public-service delivery.

Cybersecurity Act B.E. 2562 (2019): establishes a framework for cybersecurity governance, particularly concerning critical information infrastructure.

Together, these laws provide an institutional framework for digital administration and protection of essential digital systems.

3. Meaning and legal recognition of autonomous digital governance

Autonomous digital governance involves three major legal dimensions.

A. Recognition of autonomous digital actions

Digital systems may perform actions independently according to programmed instructions.

Examples include:

An AI system accepting an online purchase.

A digital platform automatically renewing a subscription.

A smart contract transferring digital assets.

An automated banking system approving transactions.

An AI-powered system issuing service notifications.

Under Thailand's Electronic Transactions Act, electronic communications and transactions can have legal effect. An automated system does not need to possess independent legal personality for its actions to produce contractual consequences.

The relevant legal question is whether the transaction can be attributed to the person or organisation operating or using the system.

B. Responsibility for autonomous decisions

Where an automated decision causes harm, responsibility may arise at several levels:

System owner: The organisation that owns or deploys the technology.

Developer: The organisation responsible for designing or programming the system.

Data controller: The entity determining the purposes and means of personal-data processing.

Data processor: The entity processing personal data on behalf of a controller.

Service provider: The entity offering the autonomous service.

Employer: An organisation responsible for qualifying employee misconduct under applicable law.

These parties are not automatically jointly liable. Their responsibility depends on the relevant statutory duties, contractual arrangements, causal connection and evidence.

C. Protection of individual legal rights

Autonomous governance must respect established civil rights, including:

Privacy and personal-data protection.

Property and ownership rights.

Contractual rights.

Consumer rights.

Reputation and personal dignity.

Access to lawful remedies.

Protection against wrongful interference.

An organisation cannot necessarily escape liability by arguing that its computer system independently generated the harmful decision.

4. Six important Thai judicial decisions and their relevance

Important legal qualification: Thailand has not yet developed six established Supreme Court precedents specifically dealing with autonomous AI governance. The following decisions are relevant Thai judicial authorities concerning the underlying principles of privacy, tort liability, electronic evidence, online wrongdoing and contractual responsibility. Their application to autonomous systems is by legal analogy, not because the courts directly decided AI-governance disputes.

Case 1. Supreme Court Judgment No. 4893/2558 (2015)

Important privacy precedent

Subject: Privacy rights and unlawful publication of intimate information

The dispute concerned the publication of intimate images and information identifying the individuals involved.

The Supreme Court recognised that private consensual conduct is protected by the right to privacy. The publication identifying the individual was held to constitute a wrongful act under Section 420 of the Civil and Commercial Code.

The Court also distinguished the right to privacy from the freedom of the press.

Legal principles:

Privacy is a legally protected right.

Public figures do not lose all privacy protection.

Disclosure of private information may constitute a tort.

Freedom of expression does not justify every form of disclosure.

A person responsible for unlawful publication may be required to compensate the victim.

Application to autonomous digital governance:

An AI platform that collects, analyses or publishes intimate personal information without an appropriate legal basis may create comparable privacy concerns.

An organisation responsible for such processing may face civil liability under the applicable law, including the PDPA where its requirements are satisfied.

Case 2. Supreme Court Judgment No. 1808/2561 (2018)

Subject: Concealment of material information and consumer protection

The dispute involved a property developer selling land and buildings without disclosing that part of the property had been expropriated.

The Supreme Court treated the concealment of material information as a wrongful act under Section 420.

Legal principles:

Material information must not be unlawfully concealed.

Conduct affecting a purchaser's legally protected interests may constitute a tort.

A seller or developer may be liable for resulting damage.

Consumer interests are relevant when assessing wrongful conduct.

Application to autonomous digital governance:

Consider an online property platform using an automated information system to advertise properties.

If the platform operator or responsible seller knowingly conceals important information through its digital operations, the automated nature of the publication does not necessarily eliminate civil responsibility.

The case provides an analogy for transparency and accountability in algorithmically managed marketplaces.

Case 3. Supreme Court Judgment No. 5374/2561 (2018)

Subject: Property rights, interference and tort liability

This decision concerned interference with a boundary wall in a property-development project. The Court considered the legal status and function of the wall as a common utility and examined whether the conduct interfered with protected property interests.

The decision applied Section 420 and considered the availability of relief to prevent continuing interference.

Legal principles:

Property interests receive civil-law protection.

Interference with legally protected property arrangements may constitute a wrongful act.

Civil remedies are not necessarily restricted to monetary compensation.

Courts may order conduct to cease where the legal requirements are satisfied.

Application to autonomous digital governance:

Digital property, access credentials and platform-controlled assets may generate disputes involving ownership, possession, use and interference.

For example, an autonomous platform that improperly blocks access to a legally protected digital asset may give rise to a civil dispute.

The case does not decide ownership of digital assets; it illustrates the broader principle that legally protected interests can receive judicial protection against wrongful interference.

Case 4. Supreme Court Judgment No. 4403/2566 (2023)

Important digital-evidence precedent

Subject: Revenge posting, online privacy and computer-related offences

This decision concerned the publication of intimate video material through Twitter, involving the unlawful dissemination of private content.

The Supreme Court considered both criminal defamation and offences under the Computer Crime Act.

The case also involved a civil compensation claim for the harm suffered by the victim.

The Court upheld the distinction between the separate offences arising from the conduct.

Legal principles:

Online publication can create serious legal consequences.

Digital evidence can establish responsibility for online conduct.

Disseminating intimate material may violate several legal protections.

A person cannot avoid responsibility merely by relying on the involvement of a digital platform.

Civil compensation may accompany criminal proceedings where the applicable requirements are met.

Application to autonomous digital governance:

This decision is relevant to autonomous content-moderation systems, automated publication tools and AI-generated or AI-distributed intimate content.

If an organisation's system facilitates unlawful dissemination, questions may arise concerning its own conduct, knowledge, statutory duties and causal contribution.

However, the decision does not establish automatic liability for every intermediary or AI developer.

Case 5. Supreme Court Decision No. 2162/2567 (2024)

Important electronic-contract precedent

Subject: Electronic messages, loan agreements and contractual evidence

The dispute concerned a series of bank transfers accompanied by LINE communications.

In several communications, the lender expressly described the transfers as loans and requested that the borrower reply with an acknowledgment. The borrower responded with an electronic acceptance.

The Supreme Court recognised the relevant electronic communications as written evidence bearing the borrower's electronic signature for purposes of Section 653 of the Civil and Commercial Code, read with the Electronic Transactions Act.

However, transfers without the necessary supporting electronic acknowledgment did not receive the same treatment.

Legal principles:

Electronic communications may constitute legally relevant written evidence.

Electronic acceptance may satisfy statutory requirements where the necessary conditions are met.

The content and reliability of digital records are important.

A bank transfer alone does not necessarily establish every element of a loan agreement.

Electronic communications can establish enforceable civil obligations.

Application to autonomous digital governance:

This decision is particularly useful for:

AI-assisted contract formation.

Automated loan platforms.

Electronic acknowledgments.

Digital payment systems.

Smart-contract documentation.

Automated commercial agreements.

It demonstrates that the legal effect of a digital transaction depends on the applicable statutory requirements and the evidence of the parties' agreement.

Case 6. Supreme Court Judgment No. 1824/2567 (2024)

Subject: Distance contracts and jurisdiction

The dispute concerned a sale transaction negotiated by telephone between parties located in different provinces.

The Supreme Court considered where the contractual cause of action arose and interpreted the applicable rules governing contracts made at a distance.

The Court recognised that the locations of both parties could be relevant to determining where the contract arose.

Legal principles:

Contracts can be concluded through communications at a distance.

The physical location of the parties remains relevant to certain contractual questions.

Electronic or telephone negotiations can generate enforceable contractual obligations.

Jurisdiction must be determined by applying the relevant procedural and contractual rules.

Application to autonomous digital governance:

This principle is relevant to cross-border digital marketplaces, automated booking systems, online service agreements and platform-based transactions.

For example, when an automated platform concludes a contract between parties in different provinces, disputes may arise regarding contractual formation, performance, jurisdiction and the appropriate forum.

The case provides an analogy for distance-based digital transactions rather than a ruling specifically about AI.

5. Civil liability arising from autonomous digital governance

A. Liability for algorithmic errors

Algorithmic errors occur when an autonomous system generates inaccurate information or makes an incorrect decision.

Examples include:

Incorrect identification of a customer.

Automated rejection of a loan application.

Wrongful suspension of a digital account.

Incorrect assessment of property values.

Automated denial of insurance claims.

Faulty allocation of public benefits.

Under Section 420 of the CCC, a claimant may establish liability by proving the relevant wrongful conduct, legally recognised damage and causal connection.

The organisation responsible for deploying the system may be liable if its conduct satisfies the requirements of the applicable law.

B. Liability for data breaches

Autonomous digital systems frequently process large quantities of personal information.

A data breach may involve:

Unauthorised access to customer information.

Exposure of biometric information.

Disclosure of financial records.

Unlawful sharing of personal data.

Failure to implement appropriate security safeguards.

Section 37 of the PDPA establishes important obligations for data controllers.

Section 77 provides civil liability for damage caused by non-compliant processing, irrespective of whether the conduct was intentional or negligent, subject to the statutory exceptions.

Section 78 permits punitive damages of up to twice the actual compensation awarded by the court.

C. Liability for autonomous contractual decisions

Automated systems may independently accept orders, generate contractual documents and execute payment instructions.

Disputes may arise when:

An automated system accepts an incorrect order.

A digital platform executes an unauthorised transaction.

A smart contract transfers assets incorrectly.

An AI system generates misleading contractual terms.

An automated system fails to perform an agreed obligation.

The Electronic Transactions Act and the CCC provide the relevant framework.

The court must examine the parties' agreement, electronic evidence, contractual authority and the circumstances of the transaction.

D. Liability for automated discrimination

An autonomous system may produce discriminatory outcomes because of biased training information, defective programming or inappropriate decision-making criteria.

Examples include:

Employment discrimination.

Unfair credit assessments.

Discriminatory insurance pricing.

Unequal access to digital services.

Unfair allocation of public resources.

Depending on the facts, such conduct may engage:

Section 420 of the CCC.

The PDPA.

Consumer protection legislation.

Applicable labour legislation.

Constitutional equality principles where government action is involved.

A claimant must identify the relevant legal protection and establish the necessary elements of liability. Not every statistically unequal outcome automatically constitutes a civil wrong.

E. Liability for autonomous financial systems

Automated financial governance includes AI-based banking, algorithmic trading, digital payments and automatic credit management.

Potential disputes include:

Unauthorised transactions.

Incorrect automated transfers.

System-generated financial losses.

Failure of digital payment infrastructure.

Defective automated fraud detection.

Inaccurate financial risk assessment.

The responsible financial institution or service provider may face contractual, regulatory or tortious responsibility, depending on the circumstances and applicable financial legislation.

6. Autonomous digital governance and contractual disputes

Thailand's civil-law framework recognises the legal significance of electronic transactions.

The following situations demonstrate how contractual disputes can develop.

Smart-contract liability

Smart contracts are digital arrangements that automatically execute specified instructions when predetermined conditions are satisfied.

For example, an automated system may transfer a digital asset when payment is received.

Potential legal questions include:

Was a valid contract formed?

Did the parties agree to the programmed conditions?

Was the code consistent with the contractual agreement?

Who authorised the transaction?

Who bears responsibility for a programming defect?

Can an incorrect transfer be reversed or compensated?

Thai law does not give every smart contract a separate legal status. Their enforceability must be assessed under ordinary contractual principles and the Electronic Transactions Act.

7. Autonomous digital governance and consumer rights

Digital platforms increasingly use autonomous systems to influence consumer behaviour.

Examples include personalised recommendations, automated pricing, digital advertising and automated complaint management.

The Consumer Protection Act and other applicable legislation provide protections against unfair commercial conduct.

Important legal concerns include:

1. Algorithmic pricing

A platform may use automated information to determine different prices for different customers. The legality depends on the circumstances, contractual terms and applicable consumer and competition rules.

2. Misleading automated advertising

Where automated systems distribute deceptive commercial information, the responsible trader may face legal consequences.

3. Unfair subscription practices

Automated renewals and cancellation restrictions may generate contractual and consumer disputes.

4. Defective digital services

A service provider may face responsibility when its digital service fails to satisfy applicable contractual or statutory obligations.

5. Automated complaint rejection

An organisation should not assume that an automated rejection of a complaint extinguishes the consumer's legal rights.

8. Autonomous governance in Thailand's public administration

Autonomous digital governance is also relevant to government institutions.

Thailand's digital government framework supports electronic public services, information exchange and digital administrative processes.

Potential applications include:

Automated government applications.

Digital registration services.

AI-assisted administrative decisions.

Electronic public procurement.

Digital tax administration.

Automated welfare administration.

Government identity verification.

However, government use of autonomous systems must remain consistent with applicable administrative and constitutional law.

Where an automated government decision adversely affects an individual, relevant questions include:

Whether the authority had legal power to make the decision.

Whether the decision followed the required procedure.

Whether relevant information was accurate.

Whether the individual received legally required procedural protection.

Whether the decision can be challenged before the competent authority or court.

Whether the government authority or another responsible party must compensate the injured person.

The Administrative Court system may be relevant where the dispute concerns an unlawful administrative act or exercise of public power. Ordinary civil courts may have jurisdiction over other civil disputes, depending on the parties and nature of the claim.

9. Important legal challenges

10. Civil remedies available under Thai law

Individuals affected by unlawful autonomous digital governance may have several possible remedies.

A. Compensatory damages

Under Section 420 of the CCC and Section 77 of the PDPA, qualifying claimants may seek compensation for legally recognised damage.

Examples include:

Financial losses.

Damage caused by unlawful disclosure of personal information.

Losses resulting from wrongful digital transactions.

Other legally compensable injuries.

B. Punitive damages

Section 78 of the PDPA allows courts to award additional punitive damages, subject to a maximum of twice the actual compensation awarded.

C. Injunctive and preventive relief

Where the legal requirements are satisfied, an injured party may seek judicial relief to prevent continuing unlawful interference.

D. Contractual remedies

Depending on the circumstances, remedies may include:

Damages for breach of contract.

Rescission where legally available.

Restitution.

Enforcement of contractual obligations.

Other remedies recognised under the CCC.

E. Class-action proceedings

Where numerous individuals suffer damage from the same or similar digital practices, collective proceedings may be available under Thailand's Civil Procedure Code, subject to the statutory requirements.

This is particularly relevant to large-scale data breaches and unlawful digital-platform practices.

11. Future development of autonomous digital governance in Thailand

Thailand could strengthen its legal framework through the following reforms.

1. AI accountability legislation

Introduce clearer obligations for organisations developing and deploying high-impact autonomous systems.

2. Mandatory algorithmic transparency

Require appropriate explanations and documentation for consequential automated decisions.

3. Human oversight

Establish safeguards for high-impact decisions involving employment, financial services, healthcare and public administration.

4. Digital consumer protection

Strengthen protection against manipulative interfaces, deceptive automated recommendations and unfair algorithmic practices.

5. Autonomous-system liability standards

Clarify responsibility among developers, manufacturers, operators, deployers and service providers.

6. Digital evidence standards

Develop consistent procedures for preserving algorithmic records, system logs, electronic signatures and automated transaction histories.

7. Cross-border digital accountability

Improve cooperation concerning international data transfers, digital transactions and online consumer disputes.

8. Judicial capacity

Develop specialist judicial training in AI evidence, algorithmic decision-making, cybersecurity and digital contractual disputes.

12. Overall conclusion

Civil Law and Autonomous Digital Governance in Thailand represents an emerging area of legal development involving the interaction of traditional civil-law principles with modern digital technologies.

The Civil and Commercial Code provides the foundation for contractual and tortious responsibility. The Electronic Transactions Act establishes legal recognition of electronic transactions. The PDPA protects individuals against unlawful personal-data processing, while the Computer Crime Act and consumer-protection legislation address additional digital risks.

The six judicial decisions discussed above provide useful foundations for interpreting privacy, property rights, electronic evidence, contractual obligations and online misconduct. However, they should not be mistaken for six direct precedents on autonomous AI governance.

Central legal principle

Autonomous digital systems may perform activities independently, but their operation does not eliminate the civil rights of individuals or the legal accountability of the persons and organisations responsible for them.

The future of Thai autonomous digital governance will therefore depend on balancing technological innovation with privacy, contractual certainty, consumer protection, transparency and effective civil remedies.

13. Important statutory and judicial references

For academic research and legal writing, the principal references are:

Civil and Commercial Code of Thailand, Sections 420, 421, 425 and 438.

Electronic Transactions Act B.E. 2544 (2001), as amended.

Personal Data Protection Act B.E. 2562 (2019), particularly Sections 19, 24, 26, 37 and 77–78.

Computer Crime Act B.E. 2550 (2007), as amended.

Consumer Protection Act B.E. 2522 (1979).

Digital Government Administration and Services Act B.E. 2562 (2019).

Cybersecurity Act B.E. 2562 (2019).

Supreme Court Judgment No. 4893/2558.

Supreme Court Judgment No. 1808/2561.

Supreme Court Judgment No. 5374/2561.

Supreme Court Judgment No. 4403/2566.

Supreme Court Decision No. 2162/2567.

Supreme Court Judgment No. 1824/2567.

Research qualification: Published PDPA civil precedents remain limited. Much of the practical enforcement has occurred through the Personal Data Protection Committee rather than reported higher-court judgments. Accordingly, statutory interpretation and careful application of established civil precedents remain particularly important.

The legal discussion is based on the relevant Thai statutory framework and identified decisions; it is an academic explanation rather than an opinion on a particular dispute.