Choosing an AI company in Thailand in 2026 is harder than it was two years ago, not easier. More firms now describe themselves as an AI development company in Thailand, the Personal Data Protection Act is being enforced, and a draft AI Act has been through public consultation. The demonstration is rarely the difficult part. What separates vendors is what happens to your data, your existing systems and your obligations once the demonstration is over.
This guide sets out what to check, roughly in the order it matters, whichever vendor you choose.
Start with personal data, not the model
Thailand's Personal Data Protection Act B.E. 2562 has applied in full since 1 June 2022. An AI system usually touches more personal data than the project brief suggests: customer messages, scanned identity documents, call recordings, staff records, supplier correspondence. For your use case, ask a prospective vendor to show you:
- which personal data the system will collect, and the lawful basis for each purpose;
- where consent is captured, and whether it is stored with the record it covers;
- how a request to access or delete data is handled inside the system, not only in a policy;
- how long each type of data is kept, and what deletes it;
- whether biometric and health data, which the Act treats as sensitive, are separated and given tighter access.
A vendor that answers with a privacy policy rather than a description of the system has not done this work yet. Our guide to PDPA and AI covers the obligations in more detail.
Ask where the infrastructure sits
Data residency is a design decision, not a footnote. Ask where the models run, where data and backups are stored, which subprocessors handle it and in which countries. If personal data leaves Thailand, the PDPA's rules on cross-border transfer apply, and your contracts and privacy notices need to reflect that.
Some workloads can run on shared infrastructure. Others, such as patient records or identity documents, may need private, on-premise or in-region deployment. A useful answer names the locations and the options. "It runs in the cloud" is a reason to keep asking.
Look for governed AI and a real audit trail
Ask what the system is allowed to do, and how you would prove what it did. Governed AI means the boundary is written down and enforced: the actions the system can take, the data it can see for each role, the limits on what it may decide alone, and the topics that always go to a person.
Every action should leave a record that someone who was not there can reconstruct: the inputs, the decision, the rule that allowed it and the result. That standard is moving into law. Thailand's draft AI Act, published for consultation by the Electronic Transactions Development Agency in July 2026, sorts systems into risk tiers and asks systems that talk to people to say they are AI and keep a record of what they did. Our note on what operators should build for now sets out the practical steps.
Ask, too, how quality is measured. An evaluation set built from real questions and expected answers, run before launch and again after every change, is what separates a tested system from a hopeful one.
Check integration with the systems you already run
Most of the value of AI comes from connecting it to records the organisation already keeps: a property management system (PMS) in a hotel, an ERP in a factory or distributor, an EHR and the finance systems in a hospital, a CRM in a sales team. Ask which systems of your kind the vendor has connected before, whether the integration only reads or also writes, and what happens when the source system is unavailable.
Be cautious about proposals that begin by replacing a working system of record. The gain is usually in a layer above it, one that reads from what is already there and adds the decisions it cannot make.
Test Thai-language support with your own material
"Supports Thai" can mean anything from a translated menu to a system that reads Thai documents and answers in Thai as accurately as in English. Test with your own material: Thai ID cards, supplier emails, staff instructions, customer messages that move between Thai and English in one conversation. If your customers or guests are international, test the other languages they actually use, and check that screens still work when the text runs longer than the English.
Ask for references you can verify
Ask for case studies with named clients, the scope described accurately and the status stated plainly: proposal, prototype, pilot, in development or live. A figure should say where it was measured. An award should name who received it. A vendor that is precise about what is not yet live is usually precise about the rest.
Prefer an engagement that starts with an audit
The lowest-risk way to begin is a paid, fixed-scope audit of the operation: where the data originates, what decisions are made and by whom, where things fail today, and what must be reconstructable if a decision is challenged. The deliverable should be a document you own and are free to take to any builder.
Some audits conclude that the right first step is not an AI system at all. A vendor willing to put that in writing is worth listening to. Opsian publishes anonymised sample audits, one per kind of operation, so you can see what the finished document looks like before commissioning one from anyone.
Where Opsian fits
Opsian is one option to consider. It is a US enterprise AI engineering and software company: delivery and infrastructure are based in the United States, and it works for clients wherever they operate, Thailand among them. Where data must stay in a particular place, systems can be deployed privately, on premise or in-region.
Its work in Thailand includes ENTRIX identity verification at RoomQuest, live across all RQ | Opsian Hotels properties; guest messaging and a LINE concierge for RQ | Opsian Hotels; an AI-enabled ERP with K.C. Metalsheet in Khon Kaen, planned in five phases to go-live; and a proposed hospital intelligence layer with a staffing prototype at Navavej International Hospital. The full range is on the Solutions page, and every engagement starts with an audit you can book here.
Sources
Questions
- What should I look for in an AI company in Thailand?
- Evidence on five points. How personal data is handled under the PDPA, where the infrastructure and data sit, how the system's actions are limited and recorded, how it connects to the systems you already run, and references you can verify with honest status labels. Thai-language support and an audit-first start matter as well.
- Does an AI development company need to be based in Thailand?
- Not necessarily. What matters is where your data is processed and stored, whether any transfer abroad is handled lawfully under the PDPA, and whether the vendor can support you in your language and working hours. Ask for locations, subprocessors and contract terms rather than an office address.
- How much does an AI project cost in Thailand?
- It depends on the scope, the systems involved and the obligations around the data. A fixed-scope audit first is the most reliable way to get a cost and a plan you can compare across vendors, because every proposal is then answering the same written findings.
- Is AI compliant with the PDPA?
- A model is not compliant or non-compliant on its own; the system around it is. Compliance depends on a lawful basis for each purpose, consent where it is needed, handling of data subject rights, retention, security and the rules for sending data outside Thailand.
