CyberCode.ph · Philippines

AI Law in the Philippines: Existing Rules and Proposed Bills

Last updated October 10, 2026 · Practical privacy, cybersecurity and technology-law guidance
Artificial intelligence governance and technology concept

How Is Artificial Intelligence Regulated in the Philippines Right Now?

Artificial intelligence in the Philippines is regulated today by existing laws applied to AI, not by an AI statute. Four layers do the work: the Data Privacy Act (RA 10173) as explained by NPC Advisory No. 2024-04; sector rules from the BSP for supervised financial institutions and from IPOPHL for copyright registration; the Supreme Court’s own framework for judicial AI use; and general criminal, consumer, labour and intellectual-property law. A national AI strategy roadmap exists but creates no duties, and every AI bill before the 20th Congress is still pending.

The layers below are what an organisation is actually answerable for today. Each is expanded further down the page, and each row names the instrument you can check for yourself.

Layer What it actually binds Instrument to check
Data privacy Any AI system processing personal data, including during training and testing NPC Advisory No. 2024-04, 19 December 2024
Data scraping Collecting publicly available personal data, including to build a dataset NPC Advisory No. 2026-01, 13 April 2026
Financial services BSP-supervised institutions, as supervisory expectation on risk management BSP Memorandum No. M-2026-034 (see the verification limit below)
Copyright registration How a work is registered at IPOPHL — not whether AI output is copyrightable IPOPHL Memorandum Circular No. 2026-007
Courts The Judiciary, court users and relevant vendors Supreme Court A.M. No. 25-11-28-SC
National policy Nothing. A strategy document carrying no enforceable duty National AI Strategy Roadmap 2.0, launched 3 July 2024
Pending bills Nothing, until one is enacted into law House Bills 6028, 7627, 9601 and 11007, 20th Congress

Verify each layer at its own source: the NPC advisories index, IPOPHL administrative issuances and DEPDev on the AI roadmap launch. What each layer does and does not reach is set out in the rules that actually exist, and the limits of this review are recorded in the verification log.

Is There an AI Law in the Philippines?

AI use in the Philippines is subject to existing laws, especially the Data Privacy Act when personal data is involved. This tracker had not identified an enacted comprehensive Philippine AI Act at its full review on 21 September 2026. That is a dated finding, not an exemption from privacy, copyright, consumer, labour, cybercrime or sector-specific rules. The targeted check on 3 October 2026 confirmed the NPC guidance discussed below; current legislative status could not be fully re-verified.

The principal binding layer comes from existing laws and regulations. NPC Advisory No. 2024-04 is official regulatory guidance explaining how the Data Privacy Act, its IRR and NPC issuances apply to AI systems; it is not a separate AI statute. BSP Memorandum No. M-2026-034 and IPOPHL Memorandum Circular No. 2026-007 apply within their respective sectors and stated scope. Bills and strategy documents are not enforceable law unless enacted or formally issued under existing authority.

For the broader topic map covering privacy, workplace AI, deepfakes, security, intellectual property and governance, use Cybercode’s AI & Emerging Technology Philippines hub. See the page’s official-source list and dated verification log before relying on any instrument or pending measure.

What Republic Act Applies to AI?

For AI that processes personal data, start with Republic Act No. 10173, the Data Privacy Act of 2012. It is an existing privacy law, not a dedicated AI Act. NPC Advisory No. 2024-04 explains its application to AI development, training, testing and deployment. An advisory number or a House or Senate bill number is not a Republic Act number.

Choose the issue you need to resolve: AI and personal-data duties, ownership of AI-generated content, or harm involving deepfakes. For proposed legislation, check the AI bills section and its verification limits.

Evidence and action

RuleWhere an AI system processes personal data, including during training and testing, RA 10173 applies. NPC Advisory No. 2024-04 is official NPC guidance on how it applies, not a separate AI statute.
ExceptionFiled AI bills — House Bills 6028, 7627, 9601 and 11007 of the 20th Congress — are pending, not law. BSP Memorandum No. M-2026-034 applies only to BSP-supervised institutions, and IPOPHL MC 2026-007 covers copyright registration procedure, not whether AI output is copyrightable.
EvidenceKeep an AI system inventory, a data map with the lawful basis per system, dated privacy impact assessments, bias-testing and human-review records, and vendor terms. These may help show the NPC that effective policies are in place.
TimingPrivacy duties attach from training and testing, not only at launch (Advisory 2024-04, Sections 1 and 3(B)). Check the deadline and effectivity of each applicable instrument; the historical legislative review is dated 21 September 2026.
Next stepList every AI tool in use, including features switched on inside existing software. Flag those that process personal data or influence decisions about people for a privacy impact assessment.

Choose Your Route

  • Business deploying AI: review the procedure and next steps for privacy assessment, vendor controls, security and human oversight.
  • Developer or AI vendor: use the documentation and records section for training-data authority, testing, contracts and audit trails.
  • Employee or consumer affected by AI: check enforcement and realistic outcomes, including explanation, correction, complaint and other available routes.
  • AI-generated content or likeness: review overlapping legal regimes covering privacy, copyright, deception, cybercrime and platform rules.

Verification note — 10 October 2026. The National Privacy Commission’s advisories index and IPOPHL’s administrative-issuances index were both re-read in full on this date, and NPC Advisory No. 2026-01 was read in full for the first time. Four AI bills of the 20th Congress were confirmed against the House of Representatives’ own filed documents, which corrected a wrong bill number carried on this page. BSP issuance PDFs remained closed to automated retrieval, and the Supreme Court E-Library and Official Gazette refused access, so those rows are carried forward and expressly marked. Every host checked and what it returned is recorded in the verification log.

Key Takeaways

  • The 10 October 2026 review did not identify a comprehensive Philippine AI Act. Four AI bills of the 20th Congress were confirmed as filed and still pending, so existing law is what binds today.
  • Instrument scope matters. Alongside NPC and sector materials, Supreme Court A.M. No. 25-11-28-SC (18 February 2026) adopts an AI framework covering the Judiciary, court users and relevant vendors.
  • The NPC is the most active regulator. Its 11 August 2026 public notice treats generating and sharing AI images of an identifiable person as processing personal data.
  • IPOPHL lists MC 2026-007 on copyright registration. Detailed provisions previously reported here remain unverified against the circular text; do not treat reported wording as a confirmed rule.
  • At national level the instrument is a strategy, not a rule. DEPDev records the launch of the National AI Strategy Roadmap 2.0 and the Center for AI Research by the DTI on 3 July 2024, aligned to the Philippine Development Plan and carrying no enforceable duty.
  • AI training involving personal data is subject to existing privacy duties and NPC guidance. Advisory No. 2024-04 addresses AI directly; Advisory No. 2026-01, read in full on 10 October 2026, governs scraping publicly available personal data without mentioning AI at all, and still applies to a dataset built that way. Copyright questions about a particular training use require a separate analysis.
  • The compliance work that exists today is privacy, security, consumer, IP and sector compliance applied to AI systems.
  • Definitions are instrument-specific. The NPC advisory describes AI for privacy purposes; the Supreme Court framework also defines AI systems and tools for its own scope.
  • Advisory No. 2024-04 forecloses the most common vendor answer to a deletion request: it states that the fact personal data has been incorporated into data sets does not automatically make the exercise of data subject rights unreasonable.
  • The same advisory names AI washing — overstating the involvement of AI systems to the detriment of data subjects — as a practice controllers must not engage in.
  • Two further NPC advisories bear directly on how AI systems are built and sourced: Advisory No. 2025-02 on privacy engineering across the systems life cycle, and Advisory No. 2024-01 on model contractual clauses for cross-border transfers. Neither is an AI instrument; both apply to AI work.

On This Page

Decision Snapshot

The questions a Philippine business actually asks about AI regulation, answered in one line each. Every answer is expanded further down the page.

AI Act, regulator and registration

Question Short answer as at 10 October 2026 What governs it
Is there a comprehensive Philippine AI Act? Not identified in the 21 September 2026 review; current legislative status unverified. Check official legislative records; existing laws and scoped issuances still apply.
Who regulates the proposed AI use? Identify the activity and applicable mandate. NPC for personal-data processing; sector regulators and courts within their scope.
Do we have to register an AI system with anyone? Check the data-processing activity. A general AI licensing scheme is different from NPC registration duties. NPC Circular No. 2022-04, Section 5(A) requires registration of personal-data processing systems involving automated decision-making or profiling.

Privacy duties, human intervention and deletion requests

Question Short answer as at 10 October 2026 What governs it
Do privacy duties apply to our AI system? Yes, whenever it processes personal data — including during training and testing. RA 10173 and NPC Advisory No. 2024-04
Do we need a privacy impact assessment? It is one of the governance mechanisms the NPC names for AI processing. Advisory 2024-04, Sec. 2(B)(2); see the PIA guide
Must a human be able to intervene in an automated decision? Yes, where the decision poses a significant risk to rights and freedoms. Advisory 2024-04, Sec. 2(B)(2)(a)
Can we refuse a deletion request because the data is already in a training set? Not on that ground alone. Advisory 2024-04, Sec. 3(C)

Labelling, copyright, the EU AI Act and harm

Question Short answer as at 10 October 2026 What governs it
Must AI-generated content be labelled to the public? Check the applicable instrument, actor and use. Privacy transparency, judicial AI use, registration requirements, contracts and platform terms are distinct checks.
Is AI output copyrightable here? Not settled. Assess the IP Code and current case law; the detailed MC 2026-007 provisions remain reported pending text verification.
Does the EU AI Act apply to us? Possibly. Check whether you place an AI system or general-purpose model on the EU market, operate through an EU establishment, or produce AI output that is used in the EU. EU AI Act, Article 2; separate from Philippine law
Are we exposed if an AI system causes harm? Yes, under ordinary civil, criminal, labour, consumer and privacy law. Assess the elements and remedies of each applicable regime.

The Instrument Tracker

Status as at 10 October 2026, except where a row states an earlier verification date. On that date the NPC advisories index, IPOPHL’s administrative-issuances index, the House of Representatives’ filed AI bills and DEPDev’s record of the national AI roadmap were all re-read; the BSP and Supreme Court rows are carried forward because those hosts refused access, and the verification log says so row by row. “In force” = enacted or issued and operative. “Policy” = a strategy document creating no enforceable duty. “Bill” = filed and pending, not law. “Reported” = described in secondary reporting but not confirmed on the issuing body’s own site at this review.

Judiciary and court users

Verified 3 October 2026: Supreme Court A.M. No. 25-11-28-SC (18 February 2026) adopts the Governance Framework on the Use of Human-Centered Augmented Intelligence in the Judiciary. Part I.B and I.C.6–9 cover judges, court personnel, court users including lawyers, and relevant vendors. Court-user scope includes court-bound documents and evidence. This is a Supreme Court framework, distinct from a comprehensive Act of Congress or an economy-wide executive framework.

Part II.4 retains human control and responsibility; Part II.6 restricts processing confidential, privileged, sensitive or secret information without express authority and strict Court supervision. Part II.3 addresses transparency and specifies disclosure by judges and court personnel under guidelines to be issued by the Court. Do not transpose that disclosure paragraph into a universal filing form for every lawyer.

AI-specific instruments

Instrument Issuer Date Status What it does
NPC Advisory No. 2024-04 — Guidelines on the Application of RA 10173, its IRR and NPC issuances to Artificial Intelligence Systems Processing Personal Data National Privacy Commission 19 December 2024 In force Applies the Data Privacy Act to AI development and deployment, expressly including training and testing: transparency, accountability, governance mechanisms, bias monitoring and data-subject rights.
NPC Notice to the Public — Use of Real Persons’ Likenesses in AI-Generated Images National Privacy Commission 11 August 2026 Public notice explaining existing DPA duties; not a new statute A person’s face and likeness are personal information; creating or sharing AI images of an identifiable person is processing requiring a lawful basis. Notes criminal, civil and administrative exposure and the right to demand removal.
BSP Memorandum No. M-2026-034 Bangko Sentral ng Pilipinas Issued 6 July 2026 In force Guidance to BSP-supervised institutions on emerging AI risks: asset inventories, stronger access controls including multi-factor authentication, remediation of exposed systems, AI-enabled detection, and stronger incident response and continuity planning.
IPOPHL Memorandum Circular No. 2026-007 — Revised Rules and Regulations on Copyright Registration and Copyright Related Services IPOPHL Listed as a 2026 circular on IPOPHL’s issuances index; reported as issued 25 February 2026 (issuance date not shown on the index at this review) In force Revises copyright registration procedure. Reportedly requires a declaration of generative-AI use naming the specific program, adds a refusal ground where a work lacks human authorship, defines “Author or Creator” as the natural person who created the work or any portion of it, and makes registration cancellable for misrepresentation as to authorship.
Examination Guidelines of Inventions, Utility Model, and Industrial Design Applications Relating to Artificial Intelligence IPOPHL Undated on IPOPHL’s guidelines index In force (examination guidance) Examination guidance for AI-related patent, utility model and industrial design applications. Not a substantive rule on AI inventorship.
National AI Strategy Roadmap 2.0 and the Center for AI Research Department of Trade and Industry Launched 2024 Policy National AI strategy covering ethics, workforce, research and infrastructure. No directly enforceable obligation on private parties.
National AI governance framework / framework for ethical and responsible AI use in government Reported as an inter-agency effort; IPOPHL reporting of 8 August 2026 describes DEPDev as developing the national framework Reported mid-2026 Reported — not confirmed as an issued instrument No issued framework document could be located on a government site at this review.

BSP source check, 3 October 2026: The BSP memorandum PDF was reachable and its two-page text was read. It addresses frontier-AI cybersecurity risks for BSP-supervised institutions and refers to their existing technology-risk frameworks. Its scope is not a general licence or registration regime for all Philippine AI users.

IPOPHL Memorandum Circular No. 2026-007 — re-checked 21 September 2026: IPOPHL’s administrative-issuances index still lists the circular under exactly this title, still shows no issuance date, and the circular’s own text remains unreadable because IPOPHL hosts its circular PDFs on a document store closed to automated retrieval. The provisions in this row therefore remain labelled reported, not verified.

National AI governance framework — re-probed 21 September 2026 at the responsible agency itself: the Department of Economy, Planning and Development site was reachable and surfaced a Policy Note on Artificial Intelligence dated 7 February 2025. A policy note is analysis, not an issued instrument, and no national AI governance framework appeared on the pages reached. Treat citations to such a framework as unverified until an agency publishes the document itself.

Other NPC issuances that bear on AI systems

None of these is an AI instrument. Each applies to AI work because AI systems are built, sourced and operated like other data processing systems. All three were re-read in full on 21 September 2026.

Instrument Date Status and scope
NPC Advisory No. 2026-01 13 April 2026; reviewed 14 September 2026 Issued privacy guidelines applying existing DPA duties to scraping and further use of public personal data. Relevant to AI datasets, but not an AI copyright statute. No separate effectivity date identified in the reviewed advisory. Re-read 21 September 2026. Cybercode’s full treatment is in data scraping in the Philippines.
NPC Advisory No. 2025-02 — Guidelines on Privacy Engineering in Systems Life Cycle Processes 27 August 2025; read in full 21 September 2026 In force as guidance. Applies, in the Commission’s words, to all PICs and PIPs engaged in the processing of personal data through data processing systems, across five life-cycle stages: planning and requirements gathering, design and development, testing and evaluation, deployment and integration, and operation and maintenance. Section 3(D) defines privacy engineering as the integration of privacy concerns into engineering practices for systems and software engineering life cycle processes. The advisory does not mention artificial intelligence anywhere; it matters here because an AI system is a data processing system, so Section 4(A) to (E) is the closest thing the Philippines has to a build-stage privacy checklist for one. No effectivity clause appears in the document.
NPC Advisory No. 2024-01 — Model Contractual Clauses for Cross-Border Transfers of Personal Data 30 May 2024; read in full 21 September 2026 Guidance, and expressly voluntary. Section 6 states that the guidance is intended for voluntary adoption and does not impose any additional rights or obligations, and the advisory records that the NPC does not require contractual parties to adopt the use of MCCs. Relevant to AI because most Philippine deployments send personal data to a model provider abroad. Adopting the clauses does not discharge the controller’s own assessment; the advisory says it remains the PIC’s and PIP’s obligation to determine for themselves whether applicable laws impose additional obligations. No effectivity clause appears in the document.

General laws that already apply to AI

Instrument Issuer Date Status What it does for AI
Republic Act No. 10173, Data Privacy Act of 2012 Congress 2012 In force The central AI compliance statute in practice: applies whenever an AI system processes personal data.
Republic Act No. 8293, Intellectual Property Code Congress 1997, as amended In force Authorship tied to a natural person; Section 178 allocates ownership; Section 185 supplies the fair-use factors. Nothing addresses AI directly.
Republic Act No. 10372 Congress 2013 In force Amended Sections 171.3, 171.9, 185.1 and 190 of the IP Code. Did not amend Sections 172 or 178.
Republic Act No. 10175, Cybercrime Prevention Act Congress 2012 In force Applies where AI is used in covered offences, including computer-related fraud, forgery and identity theft.
Republic Act No. 8792, Electronic Commerce Act Congress 2000 In force Legal recognition of electronic data messages and documents, relevant to AI-assisted contracting.
Republic Act No. 11967, Internet Transactions Act Congress 2023 In force Online business and marketplace obligations applying to AI-driven commerce.
Republic Act No. 7394, Consumer Act Congress 1992 In force Deceptive and misleading representations, including claims about or by AI-driven services.
Labour law and anti-discrimination rules Congress / DOLE Various In force Apply to AI-assisted hiring, monitoring, evaluation and discipline. Check current labour, privacy and sector issuances for the proposed activity.
Sector regulation (banking, insurance, securities, health, education, telecommunications) BSP, IC, SEC, DOH, CHED, NTC and others Various In force Layered obligations on regulated entities deploying AI.

Pending measures — bills, not law

Measure Chamber Filed copy dated Status What it proposes
House Bill No. 6028 — AIRA House of Representatives, 20th Congress Filed copy stamped 17 November 2025 BILL — not law A National AI Commission under the DOST, a national registry of AI systems, high, moderate and low risk tiers, and penalties.
House Bill No. 7627 — National AI Code House of Representatives, 20th Congress Filed copy stamped 4 February 2026 BILL — not law A Bureau of Artificial Intelligence Systems under the DICT, AI disclosure, human review of AI decisions, sector rules and penalties.
House Bill No. 9601 — AI Development Act House of Representatives, 20th Congress Filed copy stamped 1 June 2026 BILL — not law An Artificial Intelligence Development Authority, promoting AI development alongside regulation.
House Bill No. 11007 — FAIR-AI Act House of Representatives, 20th Congress Filed copy stamped 27 August 2026 BILL — not law A Philippine AI Regulation Council, a technical compliance code, labelling, bias assessments, incident reporting and penalties.
Senate and other filed measures Both chambers Various, 2025 and 2026 BILLS — not law Deepfake, digital-likeness and AI-aided criminality measures. Text and scope can change in committee. None is enforceable.

Each House bill above was confirmed on 10 October 2026 against the filed copy on the House of Representatives’ own document host — HB 6028, HB 7627, HB 9601 and HB 11007. Two limits are worth stating plainly. The filed copies leave the bill-number line blank, so each number comes from the House’s own document reference and date stamp rather than from the face of the bill. Committee progress was not verified, because the House and Senate bill-tracking pages refused automated access on this date.

Correction made on 10 October 2026. This page previously listed “House Bill No. 10362 — national AI governance framework and AI Bill of Rights”. The filed copy of House Bill No. 10362 is a 19th Congress measure establishing senior citizens’ day care centres in every barangay. It is not an AI bill, and the row has been removed. Confirm current status of any measure at congress.gov.ph or senate.gov.ph before relying on it.

Governing Law and Authorities

Four bodies matter most, and it is worth knowing which owns which question.

  • National Privacy Commission. The most consequential AI regulator today, because most AI systems touch personal data. Advisory No. 2024-04 is the operative guidance; the 11 August 2026 notice covers synthetic likenesses.
  • IPOPHL. Copyright registration procedure and patent examination. Its copyright-registration requirements have their own scope; they should be distinguished from the Supreme Court framework governing AI use in court-related work.
  • Bangko Sentral ng Pilipinas. AI risk supervision for BSP-supervised institutions. M-2026-034 frames AI as a cyber-resilience and operational-risk matter, not a general AI code.
  • DTI, DICT, DOST and DEPDev. Strategy and inter-agency framework work — direction of travel, not enforceable duties on private parties.

A dedicated AI regulator and a general AI licensing scheme are different from the powers of existing regulators. In particular, NPC Circular No. 2022-04 provides for data-processing-system registration and notification concerning automated decision-making or profiling. Check those requirements for the actual processing activity; the absence of a comprehensive AI Act does not remove them.

The Rules That Actually Exist

Privacy: the binding layer

CyberCode’s Philippines AI privacy guidance explains that AI bias is not subject to a standalone AI penalty, but AI systems processing personal data remain subject to Data Privacy Act duties and NPC Advisory No. 2024-04 throughout training, testing, development and deployment.

Controllers must provide information about the nature, purpose and extent of processing, the system’s purpose, the factors considered, risks and impact. They remain accountable for outcomes, should use privacy impact assessments and privacy by design, provide mechanisms for human intervention, monitor bias, avoid overstating AI capability and keep data-subject rights meaningfully exercisable across the lifecycle. The NPC’s August 2026 notice applies the same privacy logic to AI images of identifiable people.

The August 2026 notice extends the same logic to synthetic media: fabricated depictions are treated as false personal data, and satire, parody and journalism protections attach only to the extent suitable and necessary. Detail in AI and data privacy in the Philippines.

Financial sector: risk supervision

BSP Memorandum No. M-2026-034, reported as issued on 6 July 2026, addresses emerging AI-related risks for supervised institutions through operational-resilience measures: current inventories of digital assets and systems, stronger controls including multi-factor authentication, closing unnecessary internet exposure, AI-enabled detection, and stronger incident response and continuity. Read it as supervisory expectation on risk management, not a licensing regime for AI.

Verification limit on this row, stated plainly. The memorandum’s text has not been retrieved from the BSP on any review of this page, including 10 October 2026, because the whole of bsp.gov.ph is closed to automated retrieval. The description above is therefore reported, not verified against the issuance. A BSP-supervised institution should treat its own supervisory correspondence and the memorandum obtained directly from the BSP as controlling, not this summary.

Intellectual property: a registration gate

CyberCode’s Philippines AI copyright tracker explains that AI-generated content is not conclusively settled as copyrightable under Philippine law. IPOPHL Memorandum Circular No. 2026-007 changes copyright-registration procedure, but it does not decide whether a particular AI output receives copyright protection. Its number and title — Revised Rules and Regulations on Copyright Registration and Copyright Related Services — were confirmed on 10 October 2026 against IPOPHL’s own administrative-issuances index. The circular text itself is published behind a document-sharing link that refused automated retrieval, so its provisions remain reported rather than read.

The reported procedural effect includes an AI-use declaration on the Copyright Registry Enrollment Form, a refusal ground where a work lacks human authorship, an author definition limited to natural persons and cancellation exposure for misrepresentation. Registration remains optional and protection arises at creation, so the circular is a registration gate rather than a complete answer to copyright eligibility or ownership.

Everything else: general law applied to a new fact pattern

Fraud committed with AI is fraud. A misleading advertisement generated by a model is a misleading advertisement. An AI-assisted dismissal is governed by labour law. None of this needs an AI statute, and the absence of one is not an enforcement gap for conduct already unlawful.

What NPC Advisory No. 2024-04 Actually Says

Advisory No. 2024-04 is the single most important AI instrument in the Philippines, and most summaries of it are paraphrases of paraphrases. It was read in full from the Commission’s own copy on 21 September 2026. What follows is the operative language, quoted, with the section numbers as printed. Cybercode’s dedicated treatment of the advisory is here; this section exists so the tracker can be cited without a second click.

The advisory is dated 19 December 2024 and was signed by Privacy Commissioner John Henry D. Naga with Deputy Privacy Commissioners Leandro Angelo Y. Aguirre and Nerissa N. De Jesus. It carries no effectivity clause, so this page states its date of issue and does not assert an effectivity date — the same treatment Cybercode gives NPC Advisory No. 2026-02.

Is there a Philippine legal definition of an AI system?

Use the definition in the instrument governing the activity. NPC Advisory 2024-04 describes AI systems for its privacy guidance. Supreme Court A.M. No. 25-11-28-SC (18 February 2026), Part I.C, separately defines AI systems and tools and describes covered use in the judicial context. A definition in guidance or a court framework should not be presented as an economy-wide statutory definition.

When does the advisory apply?

Section 1 is short and wide: “This Advisory applies when the processing of personal data is involved in the development or deployment of AI systems, including its training and testing.” The words “training and testing” are the operative ones. A common and wrong assumption is that privacy duties attach only when a model is live and serving users. On the Commission’s own text they attach while the model is being built.

Section 2 then applies the whole Act rather than a special AI regime: the obligations of personal information controllers and their processors “under the DPA, its IRR, and the issuances of the Commission, including adhering to the general privacy principles, upholding the rights of the data subjects, determining the appropriate lawful basis for processing, and implementing security measures, apply insofar as AI systems involve the processing of personal data.” There is no AI carve-out and no AI-specific penalty.

What must a controller be able to explain?

Section 2(A) on transparency lists what a controller “must be able to explain”, and the list is longer than most privacy notices currently carry: the purpose for the processing, the factors and inputs considered by the AI system, the risks associated with the processing, the expected output, the impact of the system on data subjects, and any applicable dispute mechanisms. The advisory also sets a plain-language standard — information must be “easy to access, concrete and definitive, understood by members of their target audience, and presented in a simple manner using clear and plain language while retaining necessary technical terms.”

Who is accountable when the AI is someone else’s?

The controller. Section 2(B) states that accountability “is imposed on the specific PIC undertaking the development or deployment of the AI system, including its training and testing”, and that “when such processing is subcontracted or outsourced, PICs shall remain accountable for the actions of their PIPs.” Section 2(B)(1) adds a demonstrability duty: controllers and, where outsourced, their processors “must be able to demonstrate that they have implemented effective policies and procedures to comply”. Buying a compliant-sounding model does not transfer the obligation. The practical consequence is in Cybercode’s AI vendor due diligence checklist.

What governance does the NPC actually name?

Section 2(B)(2) gives a non-exhaustive list, and it is worth reading as a menu rather than a mandate: “the conduct of Privacy Impact Assessments (PIA); integration of privacy-by-design and privacy-by-default; implementation of common industry security standards; continuous monitoring of the AI systems’ operations; creation of a dedicated AI ethics board; regular retraining and scrubbing of the AI systems; and mechanisms for humans to intervene in decision-making and review the output of AI systems.”

Two items there are rarely reflected in Philippine compliance programmes: a dedicated AI ethics board, and regular retraining and scrubbing of the systems. Neither is a standalone legal requirement — the advisory frames them as examples of appropriate mechanisms — but a controller that has adopted none of the listed measures will struggle with the demonstrability duty in Section 2(B)(1).

When is human intervention required?

Section 2(B)(2)(a) ties it to consequence, not to technology. Where automated decisions “pose a significant risk to the rights and freedoms of data subjects”, controllers “shall implement mechanisms to allow for meaningful human intervention carried out by persons with the necessary competence and authority”, and separately “mechanisms to allow their data subjects to question and contest automated decisions” in the same circumstances. Competence and authority are the load-bearing words: a reviewer who cannot in practice overturn the output is not the mechanism the advisory describes. Cybercode’s fuller treatment is in automated decision-making and profiling.

What does the advisory say about bias?

Section 2(C) on fairness requires controllers to “implement mechanisms to identify and monitor biases in the AI systems and to limit such biases and their impact on the data subjects”, and to consider systemic bias, human bias, and statistical bias when assessing or auditing a system. Naming three kinds is more useful than it looks: it forecloses the defence that a model was audited for one of them.

What is AI washing, and is it prohibited?

AI washing is the NPC’s own term for overstating the involvement of AI systems to the detriment of data subjects, and the advisory says controllers shall not do it. Section 2(C) reads: “Consistent with the Principle of Fairness, PICs shall not utilize AI Washing, the practice where PICs overstate the involvement of AI systems to the detriment of their data subjects, and other deceptive practices.” This sits inside a privacy advisory rather than an advertising rule, so the exposure it creates is a data-privacy compliance failure, in addition to any consumer-protection exposure for a misleading representation.

Can a deletion request be refused because the data is already in the model?

Not on that ground alone. Section 3 addresses data subject rights across AI systems, and Section 3(C) states plainly: “The fact that personal data has been incorporated into data sets does not automatically make the exercise of data subject rights unreasonable.” Section 3(A) requires controllers to implement “effective mechanisms or alternative measures to give effect particularly to the right to object, the right to rectification, and the right to erasure or blocking”, and Section 3(B) requires that rights be exercisable “before, during, and after the development or deployment of AI systems, including its training and testing.” The advisory also points to privacy-enhancing technologies as one route to squaring rights with model behaviour.

Why this matters more than any bill: the standard industry answer to an erasure request — that removing one person from a trained model is technically infeasible — is not, on the Commission’s text, a complete answer. The advisory contemplates alternative measures where a requested technical action cannot be performed, which means the controller has to show what it did instead, not simply that it could not comply.

What Is Not Settled

This is the part most country guides skip. Each item below was still genuinely open in the Philippines at the 10 October 2026 review.

Legislative status and activity-specific regulation

The 10 October 2026 review did not identify a comprehensive AI Act, and confirmed that the four House AI bills then on file were still pending. This is a limited, dated research finding; it does not prove the absence of every AI-related rule, registration requirement or penalty. Check the current legislative record and the specific activity. The NPC regulates covered data processing, and the Supreme Court framework has its own judicial scope.

Are There Philippine Rules on AI Training Data?

Yes, when training data contains personal information, existing Philippine privacy duties apply. NPC Advisory No. 2024-04 expressly covers AI development and deployment, including training and testing. If the data is scraped from public sources, Advisory No. 2026-01 addresses the collection and further use. These privacy rules do not resolve every copyright question about using protected works in model training. Sources: Advisory 2024-04, Sections 1–3; Advisory 2026-01, Sections 1–7.

Question Rule or issue Practical implication
May we train on personal data? DPA lawful basis, transparency, minimization, security and rights apply. Advisory 2024-04 includes training and testing. Identify the data and purpose, document the applicable basis and build rights handling into the workflow.
May we scrape public profiles for a dataset? Advisory 2026-01 addresses lawful collection, notices, PIAs, source restrictions and accountability. Public availability does not provide blanket permission. Review collection separately from downstream model use.
May we buy a scraped dataset? Section 7(A) of Advisory 2026-01 addresses verification of data obtained from independent scraping controllers. Check provenance and lawful processing; an invoice or vendor assurance alone does not settle compliance.
Does privacy compliance authorize copying copyrighted works? Copyright involves a separate analysis of protected material, restricted acts, permission and exceptions under the IP Code. Assess licensing and any fair-use claim on the actual facts. An NPC advisory is not a copyright licence.
Does a copyright licence authorize personal-data processing? A copyright licence does not replace the DPA lawful-basis assessment. Check both regimes where a work also identifies people.

Privacy authority: Advisory 2024-04, Sections 2–3; scraping authority: Advisory 2026-01, Sections 3–7; copyright authority: IP Code, Sections 172, 175, 177 and 185, reproduced in IPOPHL’s own Copyright Reference Book. The unresolved issue is how copyright law applies to a particular training workflow—not whether privacy duties exist.

What should an AI team document before using a dataset?

  1. Origin and access: sources, collection method, applicable restrictions and supplier evidence.
  2. Personal-data assessment: identifying fields, sensitive data, affected groups and the lawful basis for each intended use.
  3. Purpose and notice: what people were told, who receives the data and whether training changes the originally declared purpose.
  4. PIA and safeguards: aggregation risks, minimization, access controls, retention and vendor processing.
  5. Rights handling: how objections, corrections and erasure or blocking requests will be assessed before, during and after use. If a requested technical action is infeasible, explain why and consider effective alternative measures as the AI advisory requires.
  6. Separate rights review: permission to copy and use protected works, any exception relied upon and the limits of vendor terms.

This is a practical evidence checklist, not a standalone AI certification or government approval. See Advisory 2024-04, Sections 2(B), 2(F) and 3. For role-specific implementation, use the website-host, scraper and dataset-buyer checklists.

Hypothetical: An SME buys public professional profiles to fine-tune a recruitment tool. The supplier’s claim that every profile was online does not settle lawful collection, disclosure or the SME’s own use. The team should verify provenance, evaluate sensitive information and profiling risks, document the PIA and assess notices and meaningful rights handling before deployment. It must also assess any separately protected text or images.

Authorship and liability require current case research

This review has not established a comprehensive current case-law position on AI authorship or liability. It should not be read as proof that no relevant Philippine decision exists. Check the actual judgment and its later treatment before relying on it.

Disclosure depends on the instrument and activity

Separate public content labelling, privacy transparency, copyright registration and judicial AI use. The IPOPHL registration provisions remain reported pending access to the circular text. The Supreme Court framework contains its own transparency provisions; review Part II.3 and any implementing guidelines for the actor and task involved.

Employment and national policy require separate checks

AI hiring and performance scoring require assessment under applicable labour, anti-discrimination and privacy rules. The status of an economy-wide national framework was not fully re-verified in this targeted review. The adopted Supreme Court framework is a distinct judicial instrument and must not be omitted because an executive framework remains unconfirmed.

Foreign law is not Philippine law

The EU AI Act, US executive actions and foreign training-data decisions do not become Philippine law by analogy. A foreign rule can still bind a Philippine business through the rule’s own territorial scope, an EU establishment or a contract. Philippine privacy, intellectual-property, consumer, labour, cybercrime and sector rules continue to apply separately.

When Can the EU AI Act Reach a Philippine Business?

Short answer: location in the Philippines does not by itself keep a business outside the EU AI Act. Article 2 can reach a provider outside the EU that places an AI system or general-purpose AI model on the EU market, and a provider or deployer outside the EU when the system’s output is used in the EU. An EU-based subsidiary or office using an AI system may also be a deployer in the EU. A customer contract can allocate AI Act tasks even where direct statutory scope is uncertain.

Philippine business scenario Likely EU AI Act connection Immediate check
A Manila company develops and sells an AI product under its own name to EU customers. Direct scope is likely. It may be a provider placing an AI system or model on the EU market. Identify whether it is an AI system or GPAI model, its risk category, the EU importer or authorised representative, and the applicable provider duties.
A Philippine BPO or SaaS company runs AI for an EU client and sends predictions, rankings or generated content back to the EU. Article 2 may apply. A non-EU provider or deployer can be in scope where the output is used in the EU. Map the intended output, who controls use of the system, where the output is acted on, and whether the use is high-risk or subject to transparency rules.
A Philippine parent has an EU subsidiary that uses AI for recruitment, credit, education or another sensitive decision. The EU entity is likely an EU deployer. The Philippine parent or vendor may also have provider or contractual responsibilities. Separate each entity’s role; do not treat group-wide compliance as one undifferentiated duty.
A Philippine company uses an off-the-shelf AI tool only for internal work in the Philippines, with no EU establishment, EU market offering or output intended for EU use. Direct scope is less likely on those facts. The vendor’s terms or an EU customer contract may still require controls. Confirm the actual users, output destinations, branding, resale, integration and contract promises before concluding that the Act does not apply.
A Philippine team creates chatbot, synthetic media or public-interest text for EU users. Transparency duties may apply. The duty depends on role, content type and the applicable exceptions. Check Article 50 and current Commission transparency guidance; do not assume every AI-assisted item needs the same label.

Which Dates Matter After the 2026 EU Amendments?

  • 2 August 2025: governance rules and obligations for providers of general-purpose AI models began applying.
  • 2 August 2026: the Act became generally applicable, with stated exceptions; transparency rules for certain AI systems and content now apply.
  • 2 December 2027: after the AI Omnibus amendments entered into force on 27 July 2026, the high-risk rules for specified sensitive areas, including employment, education, biometrics, critical infrastructure, migration and border control, apply from this date.
  • 2 August 2028: the high-risk rules for systems embedded in regulated products, such as some machinery, lifts or toys, apply from this date.

Evidence and action: preserve the product description, intended purpose, entity and role map, EU customer and distribution contracts, locations of users and affected persons, output destinations, risk classification, testing records, human-oversight design, logs and incident process. Record separately which duties arise under the EU AI Act and which arise under Philippine law. For a system offered in the EU or used for sensitive decisions there, obtain role-and-scope advice from qualified EU counsel rather than relying only on a vendor’s compliance statement.

Status checked 3 October 2026 against the consolidated EU AI Act and the European Commission’s implementation timeline. This section is general information, not legal advice.

Bills Before Congress — Not Law

Filing a bill creates no legal duty. After congressional passage, a bill may become law through presidential signature, lapse after the constitutional veto period, or a two-thirds override in each House. The enacted text’s effectivity and transition provisions then govern compliance. Check the final law rather than relying on the filed bill. Source: 1987 Constitution, Article VI, Section 27.

Two practical points. Do not build a compliance programme against a bill’s text. But do watch the direction: the recurring themes across the 2026 filings — transparency, human oversight, accountability for automated decisions and worker protection — are already largely reflected in NPC Advisory No. 2024-04. An organisation complying with existing privacy guidance is not starting from zero if a framework law arrives.

Overlapping Regimes and Boundaries

  • Privacy vs. IP. An AI image can be lawful under copyright and unlawful under data privacy, or the reverse. The two are decided separately.
  • Contract and platform terms. Provider terms allocate use rights, cap liability and set indemnity conditions. They bind you and the provider — not a rights holder, a data subject or a regulator.
  • Consumer protection. Claims about what an AI product does are subject to ordinary rules against misleading representations, and Advisory No. 2024-04 cautions against overstating AI capability.
  • Cybercrime. AI-assisted impersonation, fraud and forgery fall within existing RA 10175 offences. See are deepfakes illegal in the Philippines.
  • Sector rules. A BSP-supervised institution answers to M-2026-034 as well. Insurers, hospitals and schools have their own regulators.

Philippine Scenarios (Hypothetical)

Illustrative hypotheticals, not decided cases.

Hypothetical 1: a lender deploys AI credit scoring

A Philippine lending company buys a cloud service that scores applicants using transaction history and device data. Its team should make three separate checks:

  1. Processing authority: document the lawful basis, data sources, necessary fields, retention and privacy assessment for this actual scoring use.
  2. Registration: assess the system under NPC Circular No. 2022-04, Sections 5(A)–(B). Personal-data systems involving automated decision-making or profiling require registration; using a vendor’s SaaS does not by itself discharge the controller’s registration duty.
  3. Decision challenge: where decisions pose significant risks, give applicants a way to contest them and assign a competent reviewer with authority to change the outcome. Keep the reviewer’s reasoning, not just a checked approval box. See Advisory No. 2024-04, Section 2(B)(2)(a).

Check the lender’s actual regulator separately before applying BSP rules. An NPC registration certificate is evidence of registration, not approval of the model’s accuracy or fairness; Section 13 expressly distinguishes registration from verification of its contents.

Hypothetical 2: a marketing team generates a spokesperson

A brand generates a photorealistic “model” for a campaign. If the face is not an identifiable real person, the privacy analysis is limited and the live questions are copyright ownership and consumer-protection accuracy. If it closely resembles an identifiable person, the NPC’s 11 August 2026 notice is engaged: processing of personal data needing a lawful basis, with a right to demand removal and complain. The brand’s copyright position is irrelevant to that outcome.

Hypothetical 3: a startup registers copyright in AI-assisted assets

A startup wants IPOPHL certificates for illustrations produced with substantial human direction. It completes the Copyright Registry Enrollment Form and, under MC 2026-007 as reported, declares generative-AI use and names the program, with a named natural person as author and an accurate description of the portion that person created. Overstating human authorship to clear the gate creates cancellation exposure. The safer route is a filing describing only the human-authored portions. See AI governance for Philippine businesses.

Documentation and Records

Obligations come from several regimes at once, so the records that matter are those that demonstrate compliance to whichever regulator asks. Advisory No. 2024-04 is explicit that a controller must be able to demonstrate effective policies and procedures.

  • AI system inventory, including embedded features in SaaS products, with owner, purpose and data touched.
  • Data map per system: what personal data enters at training, fine-tuning, inference and logging, and the lawful basis for each.
  • Privacy impact assessments, dated and revisited when the system changes.
  • Transparency artefacts. The privacy notice text shown to data subjects and how purpose, factors and risks are explained.
  • Human-oversight and monitoring records. Who reviews what and at which decision points, with evidence that review happens; plus dated bias and performance evaluations and what was done about findings.
  • Vendor file: contract, data-processing terms, sub-processors, retention and deletion, model-training terms, security attestations, and the version of provider terms relied on.
  • Incident records, including breach-notification analysis, and an employee AI policy with acknowledgements and exceptions granted.
  • Authorship and AI-use records for content assets — the checklist in who owns AI-generated content sets these out.

Procedure and Next Steps

  1. Inventory first. Every AI tool actually in use, including features switched on inside existing software.
  2. Classify by data and decision. Identify whether the system processes personal data during development, testing or use; that is the scope condition in Advisory No. 2024-04, Section 1. Separately assess whether automated decisions create significant risks to people and what sector-specific rules apply.
  3. Run privacy impact assessments on systems touching personal data; record lawful basis, proportionality and retention. Guidance on the NPC site.
  4. Fix transparency. Update privacy notices to describe the AI processing, the factors considered and the impact, in language a data subject can act on.
  5. Install human oversight where decisions have consequences — credit, employment, benefits, discipline — and document that it operates.
  6. Assess vendors on training use, retention, sub-processors, deletion, security and incident commitments; capture the terms version relied on.
  7. Issue an employee AI policy covering approved tools, prohibited data, disclosure and accountability.
  8. Handle IP separately. Record human authorship and AI use for content assets, and read MC 2026-007 from IPOPHL’s Administrative Issuances page before filing.
  9. If you are BSP-supervised, map your controls against Memorandum No. M-2026-034 and record the gap analysis.
  10. Assign monitoring. Name someone to check NPC, IPOPHL, BSP and congressional sources on a fixed cadence, and record each check.

Enforcement and Realistic Outcomes

  • NPC. The realistic route today: it investigates complaints, issues compliance orders and requires remediation, and the Data Privacy Act carries criminal penalties for defined offences prosecuted in the ordinary courts. The 11 August 2026 notice confirms removal demands for likeness misuse.
  • BSP. Supervisory action against regulated institutions — not consumer redress against an AI system.
  • IPOPHL. Refusal or cancellation of a registration and its own IP enforcement processes. Not a forum for AI policy questions.
  • Courts. Ordinary civil and criminal remedies for fraud, defamation, infringement and breach of contract, applied to AI-assisted conduct. Identify the actual cause of action and its elements.
  • What you should not expect: a regulator ruling that an AI system is “compliant” in the abstract, or penalties for missing a framework that has not been issued.

Common Mistakes

  • Waiting for the AI Act. The obligations binding you today already exist in privacy, IP, consumer and sector law.
  • Citing a bill as law, or citing the reported national framework as issued — it could not be confirmed on a government site at this review.
  • Treating MC 2026-007 as settling copyrightability. It changes registration procedure.
  • Treating BSP M-2026-034 as a general AI code. It is risk guidance to supervised institutions, centred on cyber resilience.
  • Applying the EU AI Act here. It reaches Philippine businesses only through its own extraterritorial scope or a contract, never by analogy.
  • Assuming a vendor’s compliance covers you. Under the Data Privacy Act, accountability stays with the controller.
  • Undated status claims. Any statement about Philippine AI regulation without a date is unusable within months.

Verification Log — 10 October 2026

A status tracker is only as good as the checking behind it, so the checking is published. Every government host consulted at each review is listed below with what was asked of it and what it returned. Where a row above says reported or not re-verified, this table is why.

Checks made on 10 October 2026

Source What was checked Result on 10 October 2026
NPC — advisories index Whether any AI issuance postdates Advisory No. 2024-04, and the full 2024 to 2026 advisory list Reachable. Advisory No. 2024-04 remains the only AI advisory. The 2026 advisories are 2026-01 (data scraping), 2026-02 (breach notification) and 2026-03 (incident reports).
NPC Advisory No. 2026-01 Full text, date, signatories and whether it addresses AI training Read in full. Dated 13 April 2026, reference PDD-26-00093. It sets conditions for scraping publicly available personal data and does not mention AI or model training.
IPOPHL — administrative issuances Whether Memorandum Circular No. 2026-007 exists and its exact title Confirmed. Listed as “Revised Rules and Regulations on Copyright Registration and Copyright Related Services”. The circular PDF itself refused retrieval.
House of Representatives — filed bill documents Bill numbers, authors, titles and filing dates for the AI measures listed on this page Confirmed. HB 6028, HB 7627, HB 9601 and HB 11007 read from the House document host. HB 10362 proved to be a senior-citizens measure, so its row was removed.
DEPDev — AI roadmap launch Whether a national AI instrument has been issued, or only a strategy document Reachable. The National AI Strategy Roadmap 2.0 and the Center for AI Research were launched by the DTI on 3 July 2024 as policy, with no enforceable duty stated.
BSP — issuances Text of Memorandum No. M-2026-034 Refused. The whole of bsp.gov.ph is closed to automated retrieval, as on every previous review. The BSP row stays marked reported.
Supreme Court E-Library and Official Gazette Re-reading A.M. No. 25-11-28-SC and the current Republic Act list Refused. Both hosts declined access. The Supreme Court framework is carried forward from the 3 October 2026 reading and was not re-read on this date.

The checks recorded below were made at the earlier reviews named in each heading and are kept so the history of this tracker stays auditable.

NPC and IPOPHL

Source What was checked Result on 21 September 2026
NPC — advisories and circulars index Whether any AI-related issuance postdates Advisory No. 2024-04, and whether 2024-04 carries a repeal notation Reachable. The most recent issuances listed are Advisory No. 2026-02 (11 May 2026, breach notification) and Advisory No. 2026-01 (April 2026, data scraping). No AI-specific issuance postdates 2024-04, and no repeal notation appears against it
NPC — Advisory No. 2024-04 (PDF) Full text, signatories, effectivity Reachable; read in full. Quoted above
NPC — Advisory No. 2025-02 (PDF) Full text, scope, whether it addresses AI Reachable; read in full. Dated 27 August 2025. Contains no mention of artificial intelligence
NPC — Advisory No. 2024-01 (PDF) Whether the model contractual clauses are mandatory Reachable; read in full. Section 6 makes adoption voluntary
IPOPHL — administrative issuances index Whether MC 2026-007 now shows an issuance date, and whether any 2026 circular addresses AI Reachable. MC 2026-007 is listed under the same title with no date shown. No 2026 circular in the list addresses AI by title
IPOPHL — circular document store The text of MC 2026-007 Closed to automated retrieval. The circular’s provisions remain labelled reported

DEPDev, DTI, BSP and the Senate

Source What was checked Result on 21 September 2026
DEPDev Whether a national AI governance framework has been issued Reachable. A Policy Note on Artificial Intelligence dated 7 February 2025 is listed. No issued framework appeared on the pages reached
DTI Current AI strategy and Center for AI Research material Reachable, but no AI item appeared on the pages reached at this review
BSP — issuance PDFs The text of Memorandum No. M-2026-034 Closed to automated retrieval. The BSP row was not re-verified
Senate Legislative Reference Bureau — topics index A subject page for artificial intelligence Reachable, but no AI topic exists. The published topics are agriculture, children, disaster, education, energy, investment, government reorganisation, accountability, telecommunications, transportation, water and women
Senate Legislative Reference Bureau — Senate bills index A keyword search for AI measures Reachable, but not keyword-searchable by URL. The index filters by congress, year filed and sort order only, across 2,524 bills
Senate of the Philippines — main site A bill-tracking facility Reachable, but the pages reached carried institutional and news content rather than a searchable bill tracker

House of Representatives, Supreme Court and Official Gazette

Source What was checked Result on 21 September 2026
House of Representatives Status of the 2026 AI bills Refused automated access. No bill status could be re-verified
Supreme Court and the Judiciary e-library Any Philippine decision on AI authorship or AI liability Not reachable. No jurisprudence is asserted on this page from a primary source
Official Gazette Any AI-related executive issuance Refused automated access

The scope of the negative finding, stated plainly: this page does not claim that no Philippine AI statute exists anywhere. It claims that on 21 September 2026, across the fourteen government sources above, no enacted AI statute, no AI regulator and no issued national AI framework could be found, and that the Commission’s own issuance index shows nothing on AI more recent than December 2024. Two routes that would settle the legislative question — the House of Representatives and the Official Gazette — refused automated access, so the bill rows below remain carried forward from secondary reporting and are labelled as such.

What Changed Since the Last Review

10 October 2026 — current-position rewrite and bill correction: Added an opening answer and a layer-by-layer table answering how AI is regulated in the Philippines right now, and a matching FAQ entry. Corrected a wrong citation: the pending-measures table listed House Bill No. 10362 as an AI governance bill; the filed copy of that 19th Congress bill is a senior citizens’ day care centre measure, and the row was removed. Replaced it with House Bills 6028, 7627, 9601 and 11007, each read from the House of Representatives’ own filed documents. Read NPC Advisory No. 2026-01 in full for the first time and recorded that it does not mention AI. Confirmed IPOPHL Memorandum Circular No. 2026-007’s exact title on IPOPHL’s index. Replaced the reported national AI framework with DEPDev’s own record of the National AI Strategy Roadmap 2.0 launch. Marked the BSP row as never yet verified against the issuance. Removed two review claims the page was not entitled to make and left a single honest source-recheck date.

3 October 2026 — legal freshness audit: Added the Supreme Court AI framework after reading its E-Library text. Corrected overbroad statements about definitions, regulators, disclosure and legislative absence. Rechecked the NPC AI advisory and IPOPHL index. Current bill status, the full IPOPHL circular text and a comprehensive case-law review remain outstanding. Historical verification logs below retain their original dates.

3 October 2026 — targeted search and clarity update: Reworked the opening answer and added a Republic Act explanation. Re-read NPC Advisory 2024-04 and Circular 2022-04; corrected the blanket statement that AI systems never need registration. The BSP PDF was reachable in this check. House and Senate status pages could not be opened, so this update does not reset the full legislative-review date.

3 October 2026: Added a Philippine-business decision table for the EU AI Act, Article 2 scope, provider/deployer scenarios, evidence steps and the revised 2027–2028 high-risk implementation dates. Philippine and EU duties remain separately labelled.

Dated, so a reader can see whether anything material has moved since they last looked.

Review date What changed
21 September 2026 No change to the legal position. Advisory No. 2024-04 re-read in full and quoted verbatim, including the NPC’s working description of an AI system, the Section 2(A) explainability list, the Section 2(B)(2) governance menu, the three categories of bias, the prohibition on AI washing and the Section 3(C) rule on data subject rights over data already in a training set. Two further NPC advisories added to the tracker: 2025-02 on privacy engineering and 2024-01 on model contractual clauses. The DEPDev site probed directly for the reported national framework — a policy note exists, an issued framework does not. This verification log added. Statutory citations re-routed to IPOPHL’s own reference edition, and the earlier case citation marked as not re-verified.
14 September 2026 Privacy and training-data sections updated to reflect NPC Advisory No. 2026-01 on data scraping.
6 September 2026 Tracker established. Three AI-specific instruments confirmed; the reported national framework recorded as unconfirmed.

How This Tracker Is Maintained

The table above is the point of this page, so the method behind it is stated openly.

  • Sources checked each review: IPOPHL Administrative Issuances and Laws and Rules; NPC issuances and notices; BSP issuances; DTI, DICT and DEPDev publications; congress.gov.ph, senate.gov.ph and the Senate Legislative Reference Bureau for bill status; and, for statutory text, the administering agency’s own reference edition before any legislative host.
  • Source ladder. Each fact is routed to the agency that administers it first, then that agency’s reference or e-learning host, then the Senate hosts. Only government and primary sources are cited. Commercial legal-information sites and law-firm publications are read as research, never cited as authority, and no secondary legal publisher is used as a substitute for a statute the run could not open.
  • Status labels are limited to In force, Policy, Bill and Reported. Nothing is listed as in force unless seen on the issuing body’s own site.
  • Where a source could not be reached, the row says so. At this review IPOPHL’s document store, bsp.gov.ph PDFs, dict.gov.ph and congress.gov.ph were not machine-readable.
  • Reported provisions are labelled reported. MC 2026-007’s existence and title are confirmed; its detailed provisions are not.
  • Recheck cadence: sources are rechecked on the date given in the About This Guide block, and the page is updated when an instrument is issued, amended or enacted.

Frequently Asked Questions

How is artificial intelligence regulated in the Philippines right now?

Through existing laws applied to AI, not through an AI statute. The binding layer for most organisations is the Data Privacy Act, as explained by NPC Advisory No. 2024-04, with NPC Advisory No. 2026-01 covering the scraping of publicly available personal data. On top of that sit sector instruments — a BSP memorandum for supervised financial institutions, an IPOPHL circular on copyright registration — and the Supreme Court’s framework for AI use in the Judiciary. General criminal, consumer, labour and intellectual-property law applies to AI conduct as it does to any other conduct. The national AI strategy roadmap creates no duties, and the AI bills before the 20th Congress are not law until enacted.

Does the Philippines have an AI law?

No comprehensive AI Act was identified at the 10 October 2026 review. Existing laws and scoped issuances apply to AI activities instead, and four AI bills of the 20th Congress — House Bills 6028, 7627, 9601 and 11007 — were confirmed as filed but still pending, which means none of them creates a duty today. For judicial use, also check Supreme Court A.M. No. 25-11-28-SC (18 February 2026). Identify the activity, data and affected people before selecting the applicable rules.

Is it legal to use ChatGPT or other generative AI in the Philippines?

Legality depends on the task, data, applicable rules and any restrictions on the user or organisation. The legal questions are what data goes in, what decisions come out and what the output is used for. Entering personal data engages the Data Privacy Act and Advisory No. 2024-04; commercial use engages copyright and consumer rules; use in a regulated business engages sector rules.

Do I have to disclose that content was made with AI?

Check the applicable instrument and actor: public labelling, privacy transparency, copyright registration and judicial AI use are different questions. Part II.3 of the Supreme Court framework addresses judicial transparency; the reported IPOPHL registration provisions still need verification against the circular text. Check contracts and platform policies separately.

Can a company be penalised for AI bias in the Philippines?

There is no AI-specific bias offence. Exposure comes from existing regimes: Advisory No. 2024-04 requires controllers to monitor bias and keep human intervention available, so a biased system processing personal data can be a Data Privacy Act compliance failure. Discriminatory outcomes in hiring engage labour and anti-discrimination law on their own terms.

Is training an AI model on Philippine content legal?

It depends on the data, collection method, permissions and actual use. Personal data is already covered by the DPA and NPC Advisory 2024-04, including training and testing. Public-source scraping and further use also engage Advisory 2026-01. Copyright permission or an applicable exception must be assessed separately; privacy compliance does not establish fair use. Read the NPC AI advisory and scraping guidelines.

Is there a legal definition of an AI system in the Philippines?

There are instrument-specific descriptions and definitions. The NPC advisory describes AI for privacy purposes; Part I.C of the Supreme Court framework defines AI systems and tools for covered judicial use. Read each definition with that instrument’s scope.

Do privacy duties apply before our model goes live?

Yes, if personal data is involved. Section 1 of NPC Advisory No. 2024-04 applies it to the development or deployment of AI systems, “including its training and testing”, and Section 3(B) requires data subject rights to be exercisable before, during and after development or deployment. Waiting until launch to identify a lawful basis, run a privacy impact assessment or fix a privacy notice is late on the Commission’s own text.

Can we refuse an erasure request because the data is already in the training set?

Not on that ground by itself. Section 3(C) of Advisory No. 2024-04 states that the fact personal data has been incorporated into data sets does not automatically make the exercise of data subject rights unreasonable, and Section 3(A) requires effective mechanisms or alternative measures to give effect to objection, rectification and erasure or blocking. If a requested technical step genuinely cannot be performed, the controller has to show what alternative measure it applied instead.

Do we need an AI ethics board, and must a human review every decision?

Under the NPC advisory, neither is an absolute requirement for every AI use. The Supreme Court framework separately requires human review and approval of outputs in its covered context. An AI ethics board appears in Section 2(B)(2) of Advisory No. 2024-04 as one example in a non-exhaustive list of governance mechanisms, not as a mandate. Human intervention is tied to consequence rather than to every decision: Section 2(B)(2)(a) requires meaningful human intervention, by persons with the necessary competence and authority, where automated decisions pose a significant risk to the rights and freedoms of data subjects, together with a route for the person to question and contest the decision.

Is there a risk in marketing a product as AI-powered when it barely uses AI?

Yes, and the exposure is a privacy one as well as a consumer one. Section 2(C) of NPC Advisory No. 2024-04 says controllers shall not use “AI Washing”, which it defines as overstating the involvement of AI systems to the detriment of data subjects, and treats it alongside other deceptive practices as a fairness failure. Separately, ordinary rules against misleading representations apply to claims made about a product.

Official Sources

Consolidated EU Artificial Intelligence Act (current version 27 July 2026), especially Article 2 on territorial scope.

European Commission AI Act overview and application timeline, last checked 3 October 2026.

NPC Advisory No. 2026-01 (13 April 2026), Sections 1–7: public personal-data scraping, hosting and dataset use. Verified for the targeted privacy update on 14 September 2026.

About This Guide

Author: Cybercode.ph Editorial Team. Sources rechecked as of: October 10, 2026. Next scheduled review: when an AI instrument is issued, amended or enacted, and otherwise on the tracker’s standing cadence.

Review status: this page has not been reviewed by a named external legal reviewer. Cybercode does not attribute review to a person who has not carried it out, so no reviewer is named rather than a credential being implied. Verified claims link to primary sources; reported provisions and incomplete legislative or case-law checks are expressly qualified, and the verification log records the sources that could not be reached.

Corrections: if an instrument on this tracker has been issued, amended, superseded or repealed, or if a date or number here is wrong, the correction will be made and the change recorded in what changed since the last review.

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.