Indonesia: Building Trust in Public Use and Data Safety

Indonesia is building its AI governance framework from the ground up, with a landmark Presidential Regulation on AI Ethics and Safety expected in 2026 that will move the country from voluntary guidelines to mandatory governance for the first time. Currently, Southeast Asia's largest economy has no standalone AI-specific legislation — instead relying on the Personal Data Protection (PDP) Law enacted in 2022, the Electronic Information and Transactions (ITE) Law, and sector-specific guidance like OJK's banking AI governance guidelines published in April 2025. The Ministry of Communication and Digital (Komdigi) released a comprehensive National AI Roadmap whitepaper in August 2025, coordinated across 39 ministries and agencies, outlining Indonesia's AI development strategy through 2045. The government's approach prioritises ethics-first regulation, with ten foundational principles and plans for a National Data and AI Ethics Council, while preserving space for Indonesia's rapidly growing digital economy — one of the largest in ASEAN with over 200 million internet users.

The most significant pending development is the Presidential Regulation (Perpres) on AI Ethics and Safety, which will formalise Indonesia's AI governance from policy papers into binding regulation. Originally targeted for late 2025, the regulation was pushed back to early-to-mid 2026 to allow for more thorough stakeholder consultation. The Perpres will set direction on ethics, safety, and security, while detailed enforcement will sit with sector-specific rules drafted by individual ministries and agencies. Seven specialised working groups — covering ethics, policy, infrastructure and data, research and innovation, talent development, investment, and use cases — are coordinating the regulatory framework. In parallel, the government plans to establish a National Data and Artificial Intelligence Ethics Council (Dewan Etika Data dan Kecerdasan Artifisial Nasional) to provide institutional oversight. The financial services regulator OJK has moved ahead independently, publishing the Indonesian Banking Artificial Intelligence Governance guidelines in April 2025 as a sector-specific framework. Government Regulation No. 17 of 2025 (PP Tunas), signed in March 2025, also introduces age restrictions on high-risk digital platforms effective March 2026, intersecting with AI content moderation requirements.

The forthcoming Presidential Regulation will apply broadly across Indonesia's digital ecosystem. Technology companies operating AI systems in Indonesia — including global platforms like Google, Meta, and TikTok, as well as domestic players like GoTo, Tokopedia, and Bukalapak — will need to comply with ethics and safety requirements once promulgated. The banking sector is already directly affected through OJK's AI governance guidelines, which cover AI use in lending, credit scoring, fraud detection, and customer service automation. Government agencies deploying AI in public services, including the national digital identity system and smart city initiatives, fall within scope. AI developers and deployers across healthcare, education, human resources, and transportation will face sector-specific requirements as ministries develop detailed enforcement rules. Indonesia's massive gig economy workforce — particularly ride-hailing and delivery platform workers subject to algorithmic management — represents a significant affected population. With over 200 million internet users and one of the world's fastest-growing AI startup ecosystems, the regulatory framework will shape the operating environment for both domestic innovators and international companies entering the Indonesian market.

Indonesia's draft AI ethics framework establishes ten foundational principles: inclusiveness (ensuring AI benefits are accessible across diverse communities); humanity (maintaining human dignity and rights at the centre of AI development); safety (preventing harm through robust testing and monitoring); accessibility (bridging the digital divide in the archipelago's geographically dispersed population); transparency (clear disclosure of AI capabilities and decision-making processes); credibility (building trust through reliable and verifiable AI systems); accountability (establishing clear responsibility chains for AI outcomes); personal data protection (aligning with the PDP Law's consent and data rights framework); sustainable development and environment (incorporating environmental impact considerations into AI deployment); and intellectual property rights (protecting creators while enabling innovation). The legal foundation rests on the PDP Law (Law No. 27 of 2022), which provides comprehensive data protection covering consent, data subject rights, and cross-border transfer rules. The ITE Law serves as the broader digital governance backstop. Komdigi coordinates the multi-agency governance approach, while the planned National AI Ethics Council will provide ongoing ethical guidance and oversight.

For businesses operating in or entering Indonesia, the current regulatory environment presents a window to build compliance foundations before mandatory requirements take effect. Companies in the financial services sector should already be aligning with OJK's banking AI governance guidelines, which establish expectations around risk management, model validation, transparency, and consumer protection for AI-driven banking services. Organisations handling Indonesian personal data must comply with the PDP Law, which carries penalties of up to 2% of annual revenue for violations — a framework that directly intersects with AI training data and deployment practices. The forthcoming Presidential Regulation is expected to introduce mandatory AI ethics compliance, safety assessments for high-risk applications, and reporting obligations. Businesses should proactively develop AI governance frameworks aligned with Indonesia's ten ethical principles, particularly around transparency, accountability, and inclusiveness. The requirement for Electronic System Operators (PSEs) to register with Komdigi already creates a regulatory touchpoint for AI platforms. Indonesia's market size — the fourth most populous country globally — means that compliance is not optional for any company with serious ambitions in Southeast Asia's largest digital economy.

The timing and final content of the Presidential Regulation on AI Ethics and Safety is the single most important development to monitor. Watch for the formal establishment of the National Data and AI Ethics Council, which will shape enforcement culture and guidance interpretation. Sector-specific AI regulations from key ministries — particularly health (telemedicine AI), transportation (autonomous vehicles), education (AI tutoring systems), and labour (algorithmic management) — will define detailed compliance requirements. The operationalisation of PP Tunas age restrictions in March 2026 will test Indonesia's capacity to enforce AI-adjacent content moderation requirements. Indonesia's active participation in ASEAN AI governance harmonisation discussions, including the ASEAN Guide on AI Governance and Ethics, will influence how the domestic framework aligns with regional standards. The government's stated ambition to position Indonesia as a global AI hub by 2045 suggests that regulatory calibration — balancing protection with competitiveness — will remain a central policy tension. Watch also for developments in Indonesia's data localisation requirements and how they intersect with cloud-based AI services, as well as emerging guidance on generative AI content labelling and deepfake regulation.