The short answer
Philippine companies are adopting AI faster than the country’s laws, power grid and talent pool can keep up, but that does not leave them in a legal gray zone. There is no AI law yet, and the Data Privacy Act already makes a business accountable for any AI system that uses personal data. The National Privacy Commission has spelled out what it expects in Advisory No. 2024-04.
In practice, five things come before any deployment: a lawful basis for the data, plain-language notice to the people affected, a human who can overrule the system, NPC registration for automated decision-making, and a 72-hour breach plan. The checklist below covers all nine steps. The rest of this guide maps the market you are buying into and the risks to plan for: two operators hold about 59% of data center capacity, power costs are Southeast Asia’s highest, and only about 3% of firms use AI at all.
On this page
- Your AI compliance checklist: what the law already requires
- What to do next: your AI compliance path
- Why this matters now
- Who you will buy AI from: the biggest players
- Who is writing the rules: associations and stakeholders
- Where your AI runs: data centers and who owns them
- Where competitors already use AI
- What AI is worth to the Philippines
- Six risks to plan for before you deploy
- What to watch next
- Frequently Asked Questions
Your AI compliance checklist: what the law already requires
These duties apply to any AI system that uses personal data, including for training and testing, whether you build it or buy it. The steps below separate what the Data Privacy Act requires from what the NPC recommends in Advisory No. 2024-04. For a section-by-section walkthrough of the advisory, see our guide to NPC Advisory No. 2024-04 and AI systems.
- Map the data. List the personal data the system uses and leave out anything that will not improve it (Advisory, Sec. 2.E). Publicly available personal data is still protected (Sec. 2.F).
- Choose a lawful basis before processing. Use Sec. 12 of the Act for personal information and Sec. 13 for sensitive information, where consent specific to the purpose is the usual route.
- Register automated decision-making. A system that makes automated decisions or profiles people must be registered with the NPC “in all instances”, even below the usual 250-employee or 1,000-record thresholds (NPC Circular 2022-04, Sec. 5(A)). The record must describe the logic used and the decisions that may affect people (Sec. 26).
- Tell people, in plain language. Explain the purpose, the factors and inputs the AI considers, and the risks (Advisory, Sec. 2.A). The Act gives people a right to information on automated processes used as the sole basis for decisions that significantly affect them (Sec. 16(c)(6)).
- Keep a human who can overrule the machine. The advisory expects meaningful human intervention by staff with the competence and authority to act, plus a way for people to contest automated decisions whose effect “poses a significant risk” (Sec. 2.B.2(a)). The IRR gives a right to object to automated processing and profiling (Sec. 34(b)).
- Assess, test and monitor. The NPC lists privacy impact assessments, privacy by design, continuous monitoring and bias checks as expected governance (Sec. 2.B.2 and 2.C). An AI ethics board is one listed example, not a stand-alone requirement. A draft NPC circular would make assessments mandatory for AI.
- Bind your AI vendors by contract. You stay responsible for personal data sent to a third party, in the Philippines or abroad, and must use contracts to secure comparable protection (Act, Sec. 21).
- Do not overstate the AI. The advisory bans “AI washing”, overstating AI involvement to people’s detriment (Sec. 2.C). In one US case, a startup CEO was charged after his “AI” app turned out to rely on contractors in a Philippine call center (GMA).
- Have a breach plan ready. If a breach involves sensitive personal information or data that could enable identity fraud, and is likely to cause a real risk of serious harm, notify the NPC and affected people within 72 hours of knowing about it (NPC Circular 16-03, Secs. 11, 17(A) and 18(A)). The full report is due within five days (Sec. 17(C)).
The stakes are criminal as well as regulatory. Data Privacy Act offenses carry 6 months to 7 years in prison and fines of ₱100,000 to ₱5 million, and liability reaches the responsible officers of a company (Secs. 25–34).
Where to report AI-related harm
Each agency below handles a different kind of harm, so going to the right one first saves time and keeps your evidence usable. Start with the row that matches what happened.
| Problem | Where to go | First step |
|---|---|---|
| Misuse of your personal data by an AI system | National Privacy Commission | Write to the company first; file with the NPC if it does not act within 15 calendar days |
| AI-enabled scam, phishing or fraud | CICC Inter-Agency Response Center, hotline 1326 (PNA) | Call 1326 and keep screenshots, links and transaction records |
| Cybercrime such as deepfake extortion | NBI Cybercrime Division | File in person; no fee is charged |
| Cybercrime needing police action | PNP Anti-Cybercrime Group | Report at the nearest ACG office with your evidence |
What to do next: your AI compliance path
No Philippine statute regulates AI as such, so your duties come from the Data Privacy Act, the NPC’s rules and guidance, and any sector rules or contracts that already bind you. Sorting each item into a tier shows what is mandatory and what is good practice.
| Tier | What it covers | Basis |
|---|---|---|
| Legal minimum | Lawful basis, notice, security measures, vendor contracts, NPC registration of automated decision-making, breach notification | Data Privacy Act, Secs. 12, 13, 16, 20 and 21; NPC Circulars 2022-04 and 16-03 |
| Regulator expectation | Privacy impact assessment, meaningful human intervention, a way to contest automated decisions, bias monitoring, documented AI policies | NPC Advisory No. 2024-04, Sec. 2 |
| Contractual duties | Security, breach-reporting and AI-use terms agreed with clients, vendors and platforms | Your contracts; Data Privacy Act, Sec. 21(a) |
| Good practice, not required | An AI ethics board, an internal AI usage policy, a register of AI tools, testing in Filipino and regional languages | Editorial recommendation; an ethics board is one example the NPC lists |
For a starting document, see our free AI usage policy template.
First steps for a business
- Inventory your AI tools. List every AI system or AI feature that touches personal data, who supplies it, what data goes in and what decisions come out. This is the first concrete action; everything below depends on it.
- Check your NPC registration. If a tool makes automated decisions or profiles people, your registration must name the system and state the lawful basis, retention period, the methods and logic used, and the possible decisions about people (NPC Circular 2022-04, Secs. 5(A) and 26), within the periods the circular sets (Sec. 27). Our guide to automated decision-making and profiling rules covers this in detail.
- Assess high-impact uses. Run a privacy impact assessment on uses such as credit scoring, hiring, discipline or customer screening, and keep the result (Advisory No. 2024-04, Sec. 2.B.2).
- Fix the vendor contracts. Each AI vendor contract should give comparable protection for your data and require the vendor to report breaches to you (Data Privacy Act, Sec. 21(a); NPC Circular 16-03, Sec. 16). Use our AI vendor due-diligence checklist.
- Name a human reviewer with the competence and authority to overrule the system, and tell people how to contest a decision (Advisory, Sec. 2.B.2(a)).
- Update your privacy notice to explain the AI’s purpose, inputs, risks, expected output and impact in plain language (Advisory, Sec. 2.A).
Who regulates what
The NPC regulates personal data processed by AI systems; no agency has been given a general mandate to regulate AI. Banks, e-money issuers, lending companies and other licensed firms should also check their own regulator’s issuances, since sector rules can apply on top of the Data Privacy Act. Government agencies, and vendors selling AI to them, follow the DICT–CSC circular in the regulatory table below. Copyright in AI output is an IPOPHL matter. Foreign AI laws are not binding in the Philippines by themselves; they matter only if you operate in that market or a contract adopts them.
What to document
- A data map and lawful-basis record for each AI system (Data Privacy Act, Secs. 12 and 13)
- Your NPC registration record, including the automated-decision notification (Circular 2022-04, Sec. 26)
- Privacy impact assessments and bias-testing results (Advisory, Secs. 2.B.2 and 2.C)
- Written AI policies and procedures, which the NPC expects you to keep (Advisory, Sec. 2.B.1)
- Vendor contracts and data-processing terms (Act, Sec. 21)
- Human-review logs and records of contested decisions
- Breach records: what happened, actions taken and notifications sent (Circular 16-03, Sec. 9)
Deadlines to know
Notifiable breaches go to the NPC and affected people within 72 hours, with the full report within five days (Circular 16-03, Secs. 17 and 18). A person with a privacy complaint must first write to your company and can go to the NPC if you do not act within 15 calendar days (2021 NPC Rules of Procedure, as amended, Rule II, Sec. 2). Because there is no AI law, there is no AI-specific filing deadline.
If you were harmed by an AI system rather than running one, use the reporting table above. For an NPC complaint, bring your letter to the company and any reply, a statement of what the company did, your evidence and witness affidavits, and a certification against forum shopping (Rules of Procedure, Rule II, Sec. 3).
Why this matters now
The checklist applies whoever you buy from. The sections below map the market you are buying into: the vendors, the data centers your data will sit in, who is writing the rules, and six risks that can derail a rollout.
Who you will buy AI from: the biggest players
The largest footholds belong to firms that control distribution: schools and government for Microsoft and Google, customers for the telcos and banks. Local AI specialists are few, and the biggest one now resells a US model.
Global platforms
Most Philippine companies will not build their own AI models; they will use these platforms’ models and clouds. Their decisions on local data centers, pricing and language support shape what AI costs and how well it works here, and you remain responsible for personal data you send them (Data Privacy Act, Sec. 21).
| Player | What it is | Foothold in the Philippines |
|---|---|---|
| Microsoft | US software and cloud company; Copilot and Azure OpenAI | DepEd partnership (Aug 2026) to give public school teachers Copilot access; AI skilling with TESDA. No Philippine Azure region confirmed. |
| US search, cloud and Gemini maker | DICT rolled out Gemini Enterprise to 50,000+ public servants, targeting 200,000 in 18 months. | |
| Amazon Web Services | World’s largest cloud provider | Manila Local Zone since 2023; proposed US$5 billion, 15-year AWS Region, backed by the President in July 2026. Not yet committed. |
| OpenAI | Maker of ChatGPT | Sells ChatGPT Enterprise, Business and Edu locally through Thinking Machines, an OpenAI Advanced Partner. |
| Huawei Cloud | Chinese cloud and telecom equipment firm | Launched a Manila cloud region with three availability zones in December 2024. |
| Nvidia | US AI chip maker | No direct partnership found; YCO Cloud and Aolani plan 10,000+ Nvidia Blackwell Ultra GPUs from Q1 2027. |
Telcos, conglomerates and banks
The telcos own much of the network and data center capacity that AI runs on, and the banks and e-wallets already use AI to make decisions about people, such as credit scoring. Their deployments are where the NPC’s rules on automated decisions and human review meet customers at the largest scale.
| Player | What it is | Foothold in the Philippines |
|---|---|---|
| Globe Telecom | Ayala-led telco | Over 260 AI use cases; about 91% of H1 2026 capex went to data-related initiatives; co-owns STT GDC Philippines. |
| PLDT / ePLDT | Largest telco group | Owns VITRO, the biggest data center operator, including the 50 MW Sta. Rosa campus launched in 2025. |
| Aboitiz Data Innovation | Aboitiz group’s AI arm | AI for Republic Cement, DBM inflation forecasting and UnionBank credit scoring. |
| BPI | Ayala-owned universal bank | Moving its lending platform onto AI, with agentic AI to service some loan approvals. |
| GCash (Mynt) | Largest e-wallet | Uses AI for alternative credit scoring, fraud and scam detection, and a 24/7 customer-service chatbot. |
| Maya | Digital bank and wallet | AI across payments, credit and fraud; processes tens of thousands of loan applications a day. |
Local AI firms and BPO leaders
These are the firms most likely to build or run AI for other Philippine companies: consultancies and startups that implement it, and outsourcing firms that use it on client work. If you hire one, it processes your data as your vendor, so the contract duties in the checklist apply.
| Player | What it is | Foothold in the Philippines |
|---|---|---|
| Thinking Machines | Manila-born data and AI consultancy (2015) | 150+ clients served, 12,000 professionals trained; one of 30 OpenAI Advanced Partners worldwide; Temus investment in 2026. |
| Senti AI | Filipino conversational AI and NLP firm | Taglish-capable chat products; acquired by Kollab in January 2025. |
| Sprout Solutions | Filipino HR and payroll software | Markets itself as an AI platform for payroll and compliance; says 2,000+ companies use it. |
| NMBLR.ai | Filipino-founded enterprise AI platform | Chose Makati as its regional hub in July 2026. |
| Concentrix | Global customer-experience BPO | AI-led unit reports up to 20% less time to proficiency for agents. |
| DICT and DOST | Government ICT and science departments | DICT’s US$34.4B AI Infrastructure Master Plan (2026–2033); DOST targets 1 million Filipinos upskilled in AI. |
Not confirmed and left out: Meta, Oracle, IBM, SM, JG Summit and Jollibee had no sourced Philippine AI initiative we could verify.
Who is writing the rules: associations and stakeholders
Philippine AI policy is being shaped by four camps: industry bodies pushing for investment and skills, government agencies writing strategy and rules, labor and rights groups asking for protections, and international partners funding plans. IBPAP and the Analytics & AI Association of the Philippines (AAP) are the most active industry voices.
Industry associations
Associations speak for whole sectors in Congress and in agency consultations, and several run the AI training their members rely on. IBPAP’s forecasts shape how the outsourcing industry and government plan for jobs, and the bankers’ position on AI accountability tells lenders what their peers and regulators expect.
| Group | Who they represent | Recent AI move |
|---|---|---|
| IBPAP | IT-BPM companies, 1.9 million workers | Cut 2028 targets over AI (July 2026); aims for two million “AI-enabled” workers by 2028 |
| Analytics & AI Association of the Philippines (AAP) | 150+ institutional members; national industry board for analytics and AI | Signed an MoU with DOST on the national AI strategy (June 2026); UNDP report partner |
| Bankers Association of the Philippines | Universal and commercial banks | Pushed AI accountability at Finance Philippines 2026: responsibility stays with the bank, not the vendor |
| FinTech Alliance.PH | Fintech firms and digital banks | Proposed a regional anti-scam hub and discussed agentic AI at the ASEAN Tech Summit (Aug 2026) |
| Data Center Operators of the Philippines | VITRO, STT GDC, YCO, Digital Edge, Digital Halo, A-FLOW | Formed in December 2025 to attract cloud and AI investment |
| Data Center Association of the Philippines | Data center industry | Projects data center power demand reaching 1 GW by 2029 |
| Makati Business Club and AmCham | Big business and US companies | Coordinating private-sector role in the Pax Silica AI hub (July 2026) |
| PCCI | Philippine Chamber of Commerce and Industry | Called connectivity critical infrastructure for AI readiness (Sept 2025) |
| Management Association of the Philippines | Senior managers | Hosted the House AI bill’s presentation at its tech summit (June 2026) |
Government bodies and councils
These bodies write the rules your AI must follow and decide where public money goes. The NPC already applies the Data Privacy Act to AI, DOST and DICT steer research and infrastructure funding, and Congress will decide whether a dedicated AI law arrives.
| Body | Role on AI | Recent AI move |
|---|---|---|
| National Innovation Council | Top innovation body, chaired by the President | Approved an AI think tank led by DOST (March 2025) |
| DOST | Lead agency for AI strategy and research | Launched the National AI Center for Research and Innovation (Feb 2026) |
| DICT | ICT infrastructure and e-government | AI Infrastructure Master Plan (Sept 2026); “Kuya A” AI assistant in the eGovPH app |
| DTI / Center for AI Research | Industry AI roadmap | Launched NAISR 2.0 and CAIR (July 2024) |
| National Privacy Commission | Data privacy regulator | Advisory No. 2024-04 applying the Data Privacy Act to AI |
| House ICT Committee | Lawmaking | Consolidating 26 bills into the AI Development and Regulation Act |
| Senate Science and Technology Committee | Lawmaking | Holds the deepfake and AI regulation bills |
| BCDA | Manages former bases, including New Clark City | Host of the Pax Silica AI hub, to be governed by Philippine law |
Labor, civil society and research
These groups supply the pressure and the evidence behind new rules. Worker and digital-rights groups argue for protections in AI policy, while researchers such as PIDS and UNDP produce the data policymakers cite, including this guide’s figure that about 3% of firms use AI.
| Group | Type | Recent AI move |
|---|---|---|
| BIEN and CODE AI | BPO workers’ network and a digital workers’ coalition | Formed CODE AI (Jan 2025) to demand a labor seat in AI policy |
| Foundation for Media Alternatives | Digital rights NGO | Published an analysis of AI and deepfake bills in the 20th Congress (May 2026) |
| PIDS | Government think tank | Measured business AI readiness; source of the ~3% adoption figure |
| UNDP Philippines | UN development agency | Launched a Philippine AI competitiveness report with DOST, DTI, DICT and AAP (March 2026) |
| Asian Development Bank | Multilateral lender | Co-supported NAISR 2.0 and the AI infrastructure plan; regional AI technical assistance proposed (2026) |
The gap in this map is labor: BIEN and CODE AI are the only worker voices, while the House bill’s retraining and 60-day notice rules are the main protections under discussion.
Where your AI runs: data centers and who owns them
PLDT’s VITRO is the biggest operator, with about 33% of operating third-party capacity; STT GDC Philippines (Globe/Ayala, now under a KKR–Singtel parent) has about 26%. Both figures are Analysys Mason estimates cited in VITRO REIT’s June 2026 IPO filing (InsiderPH); the filing coverage gives no as-of date. Together the two hold roughly three-fifths of the market.
The main operators
These companies own the buildings and power supply where AI systems, and often your data, physically sit. Their capacity, locations and ownership decide how much AI computing is available locally, and knowing who hosts your data helps you meet the Data Privacy Act’s security and third-party duties (Secs. 20 and 21).
| Operator | Owner | Capacity and projects |
|---|---|---|
| VITRO (ePLDT) | PLDT | About 62–63 MW of IT capacity across its network; Sta. Rosa designed for 50 MW; 100 MW Cavite site due 2028. REIT IPO delayed to year-end or 2027. |
| STT GDC Philippines | Globe 50%, STT GDC 40%, Ayala 10% at formation (2022) | Seven facilities in Metro Manila and Cavite; Fairview campus to reach 124 MW of IT load when fully built. |
| YCO Cloud Centers | Ynchausti family 82%; SM a minority holder | 50 MW across two Malvar, Batangas sites; up to US$170M from IFC; Nvidia GPU cluster planned for Q1 2027. |
| Converge | Converge ICT | Fourth site in Angeles, Pampanga (₱5B), scalable to 36 MW; BOI green lane in August 2026. |
| Digital Edge | Digital Edge–Threadborne joint venture | NARRA1 in Biñan, Laguna, 10 MW, live since March 2023. |
| Equinix | Equinix (US) | Bought three Makati and Cavite data centers in 2025. |
Announced but not confirmed operating: SpaceDC’s 72 MW Cainta campus (announced 2022, no later news), Megawide–Evolution’s 69 MW Cavite campus (still seeking anchor tenants in 2024, per Inquirer), EdgeConneX with Aboitiz InfraCapital, UAE’s DAMAC Digital and G42, and Amazon’s proposed AWS Region.
Where the data centers are
Capacity is concentrated in Metro Manila and the industrial corridor south of it (Cavite, Laguna, Batangas, Rizal). BMI says most capacity “remains concentrated in Metro Manila and the southern industrial corridor of Luzon” (Bilyonaryo). PCIJ counts at least 40 operating and planned sites, most inside Meralco’s franchise area (PCIJ). Every large campus is in Luzon; Visayas and Mindanao have only small facilities.
| Region | Main sites | Largest stated capacity |
|---|---|---|
| NCR (Metro Manila) | STT Fairview and other Metro Manila sites; VITRO Makati, Pasig and Parañaque; Equinix Makati; Converge Caloocan and Pasig | STT Fairview campus, 124 MW IT load when built (Quezon City) |
| CALABARZON: Laguna | VITRO Sta. Rosa; Digital Edge NARRA1 in Biñan; DAMAC exploring a site | VITRO Sta. Rosa, 50 MW design |
| CALABARZON: Cavite | VITRO General Trias (planned); STT Cavite sites; two Equinix sites; Megawide–Evolution (planned) | VITRO Cavite, up to 100 MW by 2028 (planned) |
| CALABARZON: Batangas and Rizal | YCO Cloud Malvar 1 and 2 (Batangas); SpaceDC Cainta (announced, Rizal) | YCO Malvar, 50 MW combined |
| Central Luzon | VITRO Clark; Converge Angeles and Clark; VITRO Subic; YCO Bataan (planned) | Converge Angeles, 12 MW, expandable to 36 MW |
| Central Visayas | VITRO Cebu | Not stated in news coverage |
| Davao Region | VITRO Davao; STT Davao | Not stated in news coverage |
Site details come from InsiderPH on the VITRO REIT portfolio, Philstar on STT, DatacenterDynamics on Digital Edge, Inquirer on Converge and Manila Bulletin on VITRO Cavite. No source gives a percentage split of capacity by region, so none is stated here.
The clustering follows power and fiber: the Meralco grid, submarine cable landings and Manila’s enterprise customers. It also concentrates risk, since a Luzon grid red alert hits most of the country’s compute at once. New Clark City will not host one: BCDA said its Pax Silica project will not build AI or hyperscale data centers there, citing insufficient power (GMA).
Market size estimates
Estimates vary by method, so each is shown with its basis.
| Source | Estimate | Basis |
|---|---|---|
| BMI (Fitch Solutions) | 140 MW live, 43 MW building, 221 MW planned | 44 data centers nationwide, Sep 2026 |
| Cushman & Wakefield | 73 MW operational | 24 facilities, 2025 |
| DICT | Less than 200 MW | Secretary Aguda, Aug 2026 |
| DICT AI Infrastructure Master Plan | 1.5 GW of AI data center capacity by 2033, from 50 MW | Government target, not a forecast |
What the future looks like
The pipeline is large on paper but slow to build. Manila’s colocation vacancy was the highest of 15 Asia-Pacific markets in the first half of 2026, per Cushman & Wakefield data reported locally. BMI warns the country must compete for deployments rather than wait for spillover from Malaysia and Indonesia (Inquirer). Amazon’s US$33 billion Southeast Asia plan, announced in May 2026, covered Indonesia, Malaysia, Singapore and Thailand, not the Philippines.
Watch five things: the VITRO REIT listing, STT’s Fairview ramp and possible IPO, YCO’s GPU cluster, whether AWS commits to a region, and DOE’s promised data center energization policy.
Where competitors already use AI
AI adoption is deepest in finance, telecoms and BPO, where large firms have data and budgets. Public-sector use jumped in 2026; agriculture and health have early pilots.
| Sector | What AI is used for | Example |
|---|---|---|
| Banking and fintech | Credit scoring, fraud detection, loan processing, chatbots | GCash alternative credit scoring; BPI agentic AI for loan approvals; Maya’s AI loan processing |
| Telecoms | Network operations, customer service, internal copilots | Globe’s 260+ use cases |
| BPO and IT-BPM | Agent assist, quality audits, training | Concentrix’s AI-led performance unit |
| Retail and e-commerce | Product listings, recommendations, shopping assistants | Lazada’s “AI Lazzie” shopping assistant (Inquirer) |
| Logistics | Demand forecasting, routing, shelf audits | Ninja Van’s Vision AI shelf checks (Inquirer); K-Logistikus route and ETA optimization (Inquirer) |
| Government | Staff productivity, citizen services | Gemini for 50,000+ public servants (Computer Weekly) |
| Education | Teacher tools, AI degree programs | Mapúa’s BS in AI Engineering (Inquirer) |
| Agriculture | Farm advice in local languages | PhilRice’s Palai Messenger chatbot (PhilRice) |
| Healthcare | Diagnostic screening | AI TB X-ray reading at ₱877 vs ₱1,142 manual per person (Ateneo) |
Cost is a brake even where interest is high: in a Lazada–Kantar survey of Southeast Asian online sellers, “64 percent of respondents cite AI solutions as costly and time-intensive to implement” (InsiderPH).
AI is also changing how customers find Philippine businesses: in a 2026 study, AI engines named the tested Philippine brand on 83.2% of relevant buyer questions, yet only 5% of the citations behind those answers came from the brands’ own websites (see our takeaways from the Spiralytics AI search study).
What AI is worth to the Philippines
Studies put AI’s potential at ₱1.8 to ₱2.8 trillion a year by the early 2030s. These are sponsor-commissioned projections, not measured gains.
| Study | Estimate | Condition |
|---|---|---|
| Access Partnership for Google (2024) | ₱2.8 trillion in revenues and cost savings in 2030 | If AI products are widely adopted |
| Public First (2025) | ₱1.8 trillion (US$31B), 7% of gross value added | Includes ₱110,000 productivity gain per worker a year |
| AWS-commissioned study by Strand Partners (2025) | 21% of Philippine businesses (250,000) use AI; 64% of adopters report revenue up 18% on average | Self-reported survey; 45% of startups use AI vs 41% of large firms |
The value shows up in four places: cheaper credit through alternative scoring for the unbanked, faster public services, higher-value BPO work, and data center investment (BOI green-lane digital projects totalled ₱401.69 billion from February 2023 to end-2025, per Philstar).
Six risks to plan for before you deploy
Each national gap turns into a business risk. The cards show the number behind each one; under each gap, a “For your business” note ties the risk to a cited rule or finding.
1. Talent and brain drain
Companies are adopting AI faster than they can hire for it. In Aon’s 2026 study, 47% of Philippine firms had fully deployed AI and 25% were piloting it, but only 17% said they could recruit and retain enough AI-skilled workers (Manila Bulletin). A Swarm survey of 175 organizations found 57% citing talent scarcity and 65% stuck at proof of concept (Manila Bulletin).
Supply is starting to respond. Mapúa launched what it calls the first BS in AI Engineering (Inquirer). DOST wants about 1,000 master’s and PhD-level AI professionals and 1 million Filipinos upskilled (Philstar). Thinking Machines says it has trained 12,000 professionals (Manila Times). Senti AI’s founder moved to Kollab as Chief Scientist after its 2025 acquisition, a sign that local AI talent consolidates rather than scales.
We found no hard data on how many Filipino AI engineers emigrate or on the salary gap with foreign employers. That is a reporting gap worth filling with original interviews.
For your business: plan for the stage where most projects stall. In a survey of 175 Philippine organizations, 65% remained “stuck at the POC stage” and 57% of leaders named talent scarcity “the primary hurdle” (Manila Bulletin). Decide who will run and maintain the system after the pilot before you start it.
2. Power, connectivity and compute costs
The Philippines now has the highest average residential power rate in Southeast Asia: ₱12.43/kWh against Singapore’s ₱12.34, per DOE data for June 2026 (Philstar). The World Bank puts the Philippine average near US$0.21/kWh, against US$0.13 in Thailand and US$0.09 in Indonesia (GMA). Meralco argues large industrial users pay rates competitive with Malaysia, but it is an interested party.
Supply is also tight. On 15 May 2026, NGCP raised red alerts when Luzon had 12,075 MW available against 12,927 MW peak demand (Inquirer). The Philippines has 0.8 MW of data center capacity per million people, against 1.9 in Thailand. The Konektadong Pinoy Act (RA 12234) opens data transmission to new players without a franchise, which should cut connectivity costs over time.
For your business: where your data sits is a legal question, not only a cost one. The Data Privacy Act keeps you “responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally” (Sec. 21), and requires “reasonable and appropriate organizational, physical and technical measures” to protect it (Sec. 20(a)) (RA 10173). Ask your cloud or data center provider where your data is hosted and how it stays protected during outages.
3. The BPO paradox: displacement vs upskilling
The industry has 1.9 million workers, not the 1.5 million often cited, and earned about US$40 billion in 2025 (Inquirer). In July 2026 IBPAP cut its 2028 targets from 2.5 million jobs to 2.14 million (best case) or 1.85 million (downside), citing AI among the reasons (GMA). The downside case means the workforce shrinks.
The exposure is concentrated. The ILO counts 12.7 million Philippine jobs exposed to generative AI, the highest share in ASEAN, but only 3.6% of jobs in the highest-risk group (ILO). The IMF finds 14% of the workforce in high-exposure, low-complementarity roles, and places contact-center clerks, 73% of BPO workers, in that group (IMF).
Upskilling is small against that scale. IBPAP projects that government-funded AI training programs for 2026 “may cover approximately 68,000 learners, a small portion of the 1.9 million-strong workforce” (Philstar), about 3.6%. IBPAP says AI has not yet caused widespread layoffs and affected entry-level staff were redeployed (Inquirer). Its full 2028 roadmap is due in October 2026.
For your business: outsourcing the work does not outsource the liability. You must use contracts or other means to “provide a comparable level of protection while the information are being processed by a third party” (Data Privacy Act, Sec. 21(a)), and the NPC holds you “accountable for the processing of AI systems and for the outcomes and consequences of such processing” (Advisory No. 2024-04, Sec. 2.B). Write your BPO’s use of AI, its security measures and its breach reporting into the contract.
4. MSME exclusion and the digital divide
MSMEs are 99.63% of establishments and 65.1% of jobs (Manila Times, citing DTI). Formal AI use is far lower than the “under 15%” often quoted. That 14.9% figure comes from a 2021 survey; the same PIDS study puts the national AI adoption rate at about 3%, and 2.79% for micro firms (PIDS).
Adoption is urban but not only Manila: NCR holds 25.4% of AI adopters, Western Visayas 14.3% and CALABARZON 11.8%. Only about one firm in five is even aware of these technologies. The market gap is affordable, local-language tools for sari-sari stores, wet markets and provincial logistics. Most tools today are priced for banks and telcos. Note that no national survey newer than the 2021 data exists.
For your business: small firms are not exempt. NPC registration normally applies to organizations with 250 or more employees or sensitive data on 1,000 or more people, but a system “involving automated decision-making or profiling shall, in all instances, be registered with the Commission” (NPC Circular 2022-04, Sec. 5(A)). If an AI tool decides on your customers or applicants, register it.
5. Regulatory and policy lag
The Philippines has no AI law as of October 2026. What exists is a mix of binding Data Privacy Act rules, regulator guidance, strategies, drafts and pending bills. The Status column says which is which.
| Instrument | What it does | Status |
|---|---|---|
| DOST National AI Strategy (NAIS Ph) | National AI strategy phased 2024–2028; follows DTI’s 2024 NAISR 2.0 roadmap | Policy strategy, not binding; proposed April 2025 |
| NPC Advisory No. 2024-04 | Applies the Data Privacy Act to AI: transparency, accountability, human intervention, bias monitoring | NPC guidance on binding Data Privacy Act duties; issued 19 December 2024 |
| NPC Circular 2022-04 | Systems using automated decision-making or profiling must be registered with the NPC, whatever the company size | Binding NPC rule; in force |
| Draft NPC PIA circular | Would make privacy impact assessments mandatory for AI and other high-risk processing | Draft, not yet binding; public consultation 2026 |
| DICT–CSC Joint Memorandum Circular No. 003, s. 2026 | Every government agency must set up an internal AI oversight committee and issue an AI policy; vendors must ensure AI is “reliable, secure, and ethical” and are held accountable for flawed products | Binds government agencies, not private firms directly; signed June 9, 2026 |
| IPOPHL draft guidelines | Copyright only for works with enough human creative input | Draft, not yet binding; public consultation Sep 2026 |
| House AI Development and Regulation Act | Consolidates 26 bills; high-risk systems only; no dismissal by algorithm alone | Pending bill, not law; in a technical working group as of July 2026 |
The friction is clearest in lending. The NPC advisory requires meaningful human intervention in automated decisions and a way for people to contest them, while banks and e-wallets run AI credit scoring at scale. In the Senate, bills on deepfakes and AI regulation have been filed, including Senator Bam Aquino’s SB 758 on digital likeness (Inquirer); none has passed.
For your business: the likely direction of the law is already visible. Under the House’s consolidated bill, “registration and safety checks apply only to high-risk systems” that “decide on people’s loans, jobs and health,” and “no Filipino may be dismissed by an algorithm alone” (Philstar). The bill is not law yet, but if you use AI in lending, hiring or healthcare, document your human review now.
6. Local language and cultural context
Global models still underperform in Filipino. On the FilBench benchmark, GPT-4o scored 72.23%, and the best Southeast Asia-specific model, SEA-LION v3 70B, scored 61.07% (EMNLP 2025). The Batayan benchmark found Filipino under-represented in training data and a pervasive “translationese” bias in Tagalog and Taglish tasks (ACL 2025).
Local work exists but is thin. DOST’s language roadmap with Ateneo, AI Singapore and the Komisyon sa Wikang Filipino built text and speech corpora for 10 Philippine languages (DOST-PCIEERD). Senti AI built a Taglish-capable engine. Google’s own data show 90% of Filipino Gemini prompts are in English, which may mask how poorly models serve Tagalog, Bisaya and Ilocano speakers.
For your business: a model that works in English may not work for your customers. The Batayan study found “significant performance gaps that signal the under-representation of Filipino in pre-training corpora” (ACL 2025), and the NPC requires mechanisms “to identify and monitor biases in the AI systems and to limit such biases and their impact on the data subjects” (Advisory No. 2024-04, Sec. 2.C). Test chatbots and screening tools in Tagalog, Taglish and the regional languages your customers use before launch.
What to watch next
The Philippines is positioned as an AI user and service hub, not a model builder. The government’s plan needs US$34.4 billion, most of it private, to reach 1.5 GW of AI compute by 2033. Whether that happens depends on power prices, an AWS decision and Congress passing a workable AI law.
The likely near-term picture: Globe and PLDT keep most data center capacity while foreign operators (KKR–Singtel through STT, Equinix, UAE entrants) gain share. BPO headcount stays flat or dips as AI takes entry-level voice work. MSMEs remain the largest untapped market until local-language, low-cost tools appear.
Frequently Asked Questions
Is a Philippine business liable for AI if there is no AI law?
Yes, whenever the AI uses personal data. The Data Privacy Act makes the business accountable for the system’s processing and its outcomes, NPC Advisory No. 2024-04 applies those duties to AI, and violations carry 6 months to 7 years in prison and fines of up to ₱5 million.
What must a company do under the Data Privacy Act before using AI?
A company must have a lawful basis for the personal data it uses, tell people how the AI affects them, and keep a human able to review automated decisions. Systems that make automated decisions must also be registered with the NPC, and notifiable breaches must be reported to the NPC within 72 hours.
Who are the biggest AI players in the Philippines?
The biggest AI players in the Philippines are global platforms (Microsoft, Google, AWS, and OpenAI through its partner Thinking Machines), telcos and banks (Globe, PLDT, BPI, UnionBank, GCash, Maya), and a small group of local AI firms led by Thinking Machines.
Who owns the most data center capacity in the Philippines?
PLDT’s VITRO owns the most, with about 33% of operating third-party capacity, followed by Globe and Ayala’s STT GDC Philippines at about 26%. Both figures are Analysys Mason estimates cited in VITRO REIT’s 2026 IPO filing.
Where are most Philippine data centers located?
Most Philippine data centers are in Metro Manila and the South Luzon corridor of Cavite, Laguna, Batangas and Rizal. Every large campus is in Luzon; Cebu and Davao host only small sites.
Does the Philippines have an AI law?
No. As of October 2026 the Philippines has no AI law. The Data Privacy Act applies to AI that uses personal data, guided by NPC Advisory No. 2024-04, and a consolidated House AI bill was last reported in a technical working group in July 2026. A pending bill is not law.
Will AI replace BPO jobs in the Philippines?
AI has not yet caused mass BPO layoffs, according to IBPAP, but it is slowing hiring. IBPAP cut its 2028 target from 2.5 million workers to between 1.85 million and 2.14 million, and the IMF places most contact-center roles in the group most exposed to displacement.
Related guides
- NPC Advisory No. 2024-04: AI Systems and Data Privacy in the Philippines
- Privacy Impact Assessment in the Philippines: who needs one and how to run it
- AI-based hiring or discipline: privacy and due-process rules
- Customer data uploaded to ChatGPT: privacy rules and first steps
- Vendor or SaaS data breach: who is responsible?
- National Privacy Commission: powers, complaints and registration
- What is IBPAP? Its role in BPO jobs and AI readiness
- The future of Philippine BPO jobs with AI
- Pax Silica explained: the New Clark City AI hub
Sources and legal citations
Primary legal sources relied on in this guide:
- Republic Act No. 10173, Data Privacy Act of 2012 (NPC copy): Secs. 12, 13, 16, 20, 21 and 25–35
- Implementing Rules and Regulations of RA 10173 (2016): Sec. 34
- NPC Advisory No. 2024-04, Guidelines on AI Systems Processing Personal Data
- NPC Circular No. 2022-04, Registration of Data Processing Systems: Secs. 5, 26 and 27
- NPC Circular No. 16-03, Personal Data Breach Management: Secs. 9, 11, 16, 17 and 18
- 2021 Rules of Procedure of the NPC, as amended: Rule II, Secs. 2 and 3
- Draft NPC Circular on Privacy Impact Assessment (public consultation, 2026)
- DICT–CSC Joint Memorandum Circular No. 003, s. 2026, on ethical and responsible AI in government
- IPOPHL draft guidelines on copyright registration of AI-related works (2026)
Market figures, company facts and survey results are linked beside each claim above.
Sources rechecked as of: 2026-10-01 (legal and regulatory sources; market and company figures are as reported in the articles linked beside them).
This guide is general information about Philippine law and the AI market. It is not legal advice. For decisions about a specific AI system, consult a lawyer or the National Privacy Commission.