🔴Illinois HB 3773IN EFFECTUp to ~$70K/violation|🔴Texas TRAIGA (HB 149)IN EFFECTAG-enforced|🔴Utah AI Policy ActIN EFFECT$2,500/violation|⚠️Colorado AI Act (SB 205)Jan 1, 2027AG-enforced|⚠️California SB 942Aug 2, 2026$5K/day|⚠️EU AI Act Art. 50Aug 2, 2026€35M or 7% revenue|⚠️New York RAISE ActJan 1, 2027AG civil penalties|
European Union · EU AI ActNo AI-specific law — data-protection and cybercrime law bind

Philippines AI Law Deadlines

EU AI Act + GDPR + national-law dates that businesses serving this country must meet.

Deadline: No AI-specific deadline. The Data Privacy Act has been in force since 2012 and is continuously enforced by the National Privacy Commission.Penalty: No AI-specific penalty exists. The binding exposure is the Data Privacy Act's Chapter VIII, read from the Act's own text: unauthorised processing of personal information carries one to three years’ imprisonment and a fine of PHP 500,000 to PHP 2,000,000, and of SENSITIVE personal information three to six years and PHP 500,000 to PHP 4,000,000 (s.25). Section 35 imposes the maximum of the applicable scale whenever the personal information of at least 100 people is harmed, affected or involved.

How AI law works in Philippines

No enacted national AI-specific statute was identified in the official Philippine sources reviewed through 16 September 2026. Several AI bills have been filed, but this page does not treat a proposal as enacted law. What binds a business deploying AI in the Philippines is therefore the existing digital stack. The Data Privacy Act of 2012 (RA 10173) requires a lawful basis and consent for processing, imposes proportionality, transparency and security duties, gives data subjects rights of access, correction, erasure, damages and — directly relevant to automated systems — a right under section 16(c) not to be subject to a decision based solely on automated processing where it significantly affects them, and it is administered by the National Privacy Commission. The Cybercrime Prevention Act of 2012 (RA 10175) covers illegal access, data interference and computer-related fraud and identity theft. The Internet Transactions Act of 2023 (RA 11967) created the E-Commerce Bureau and imposes duties on online platforms and merchants. The Electronic Commerce Act (RA 8792) gives electronic documents and signatures legal effect.

Applicable laws

  • 📜 Republic Act No. 10173 — Data Privacy Act of 2012
  • 📜 Republic Act No. 10175 — Cybercrime Prevention Act of 2012
  • 📜 Republic Act No. 11967 — Internet Transactions Act of 2023
  • 📜 Republic Act No. 8792 — Electronic Commerce Act (2000)

The EU AI Act enters into force and becomes enforceable on August 2, 2026 — a fixed, non-negotiable deadline applicable across all 27 EU member states and the EEA. This is not a deadline for planning or preparation; it is the date on which regulators and private parties can begin filing complaints, triggering investigations, and seeking penalties. Unlike GDPR, which had a 2-year grace period before enforcement (May 2016 adoption, May 2018 enforcement), the EU AI Act's enforcement timeline is compressed: the directive was adopted in December 2023, and enforcement begins August 2, 2026 — less than 20 months from adoption to active penalty risk. Businesses should treat August 2 as the same kind of hard cutoff as GDPR's May 25, 2018: compliance is required from day one, and non-compliance creates daily exposure.

Within the August 2, 2026 deadline, nested compliance deadlines apply to different system categories. Prohibited AI systems (facial recognition in law enforcement, social credit scoring, subliminal manipulation) cannot be deployed at all after August 2 — deployment is not a compliance violation, it is an immediate prohibited activity. High-risk systems must have completed conformity assessments (including bias and fairness testing) before August 2, must document human-review processes, and must implement transparency disclosures to affected individuals by the enforcement date. Limited-risk systems must provide transparency disclosures by August 2. Prohibited systems already in deployment must be removed by August 2. The deadline structure means a single non-compliance — one high-risk system without pre-deployment assessment, one prohibited system still in operation, one missing disclosure notice — creates measurable enforcement exposure on day one of the deadline.

National implementation and enforcement begin immediately on August 2, 2026. Each EU member state has designated a national AI authority responsible for complaint intake, investigation, and penalty assessment. In Philippines, [National AI Authority details]. These authorities are staffed and equipped to begin enforcement on August 2 — they do not wait for national regulations to be finalized or enforcement guidance to be published. The first enforcement actions will likely target the highest-impact, most visible violations: prohibited systems still in operation, high-risk hiring systems without documented assessment, and chatbots that fail to disclose AI use. Smaller or less visible violations will be addressed through complaint-driven enforcement, but the baseline assumption should be that enforcement begins immediately.

The most urgent remediation timeline is now until August 2, 2026. Businesses should immediately: conduct a complete inventory of all AI systems, identify high-risk and prohibited systems, remove any prohibited systems from production, complete conformity assessments for high-risk systems, implement transparency disclosures, establish human-review processes, and document all compliance activities. For businesses with high-risk systems already in production, this timeline is extremely compressed — you must complete risk assessment, bias testing, and remediation of identified issues within months, not years. Attempting to compress months of work into weeks creates quality risk (assessment documents become rubber stamps, bias testing becomes superficial) that invites regulatory scrutiny.

After August 2, 2026, compliance obligations become ongoing and permanent. You must maintain conformity assessments for high-risk systems, re-assess annually, conduct bias re-testing after model updates, monitor human-review patterns and escalation rates, maintain audit logs, handle individual requests for explanation and appeal, and respond to regulatory inquiries. The deadline of August 2 is not the end of compliance work — it is the beginning of continuous compliance as a permanent operational function.

Philippines AI law deadlines

Already in effect
⚠️ EU AI Act prohibited-practices ban + AI literacy obligations (Art. 4) since February 2, 2025.
Already in effect
GPAI obligations (general-purpose AI models) since August 2, 2025.
August 2, 2026
⚠️ EU AI Act high-risk-AI obligations bite — full conformity assessment, CE marking, and registration required for systems serving Philippines users.
August 2, 2027
Final phase: high-risk AI embedded in regulated products covered by NLF legislation.
72 hours
Personal-data breach notification window under GDPR (notify the Philippines DPA).
Annual
Refresh DPIAs and bias assessments; review the supervisory authority's latest guidance for Philippines.

More Philippines resources

AI Compliance Checklist💰 AI Law Fines & Penalties📋 AI Compliance Requirements📖 AI Compliance Guide← All Philippines resources

Other countries

Germany (EU)France (EU)Netherlands (EU)Spain (EU)Italy (EU)Sweden (EU)
Editorial standards

Anchored to the primary government source (statute, bill text, or agency rule) and verified directly against it · Last verified Sep 16, 2026. See our methodology.

Primary sources · Philippines