In July 2026 the Electronic Transactions Development Agency published a draft Artificial Intelligence Act for public consultation. The draft follows the shape regulators elsewhere have converged on: AI systems are sorted into risk tiers, the highest tier faces licensing and ongoing supervision, and systems that talk to people, chatbots included, carry a duty to say that they are AI and to keep a record of what they did.
The consultation closed in August. The text will change before it passes, and the timetable is not fixed. None of that changes what an operator should do now, because the obligations the draft describes are the same ones a well-run system needs anyway.
Three things the draft asks for that you should already have
Know which of your systems make or shape decisions about people. A check-in kiosk that verifies identity, a hospital scheduler that assigns beds, an ERP that scores suppliers: each one is a decision system, and each will sit in a tier. The first job is an inventory. Most organisations we audit cannot produce one on the first day.
Be able to reconstruct a decision. The draft's transparency and record-keeping duties come down to one test: if a decision is challenged a year from now, can you show the inputs, the rule or model that acted, the output, and who was told? A log line does not pass that test. A record does. This is the same requirement Thailand's Personal Data Protection Act already applies to the data behind the decision, and the same one ISO 42001 formalises.
Tell people when they are talking to a machine, and give them a way to a person. For guest messaging, patient enquiries and customer support this is a design decision, not a compliance afterthought. A system that escalates cleanly to a human is also the one that produces fewer complaints.
What we would not do
We would not wait for the final text to start. The organisations that struggled with the Personal Data Protection Act were the ones that treated the enforcement date as the start date. We would also not buy a compliance layer to bolt on top of systems that keep no record of their own. The record has to be produced where the decision is made.
Where Opsian starts
Every Opsian engagement begins with an audit the organisation owns: where the data originates, what decisions are being made, where they fail today, and what must be reconstructable. That last question is the one the draft AI Act will eventually ask in law. Answering it first is cheaper than answering it under enquiry.
