AI & Emerging Technology Philippines

Employees are using ChatGPT or AI at work

Can employees use ChatGPT or other AI tools for work in the Philippines? Yes, where the task complies with applicable law, company rules and confidentiality obligations. Company permission alone does not authorize personal-data disclosure or copyright infringement.

• Confirm the approved tool, account and permitted task with your employer.
• Use fictional examples or properly anonymized material for initial drafts.
• Check facts, citations and output rights before sharing or publishing.
• Assign human review for consequential decisions; escalate uncertain data use to the DPO or responsible manager.

Example: drafting a generic meeting agenda is different from uploading named employees’ medical records.

Source: Data Privacy Act, Sections 11–13 and 20–21.

Explore AI, AGI and Philippine jobs →

Someone created a harmful deepfake

Are deepfakes illegal in the Philippines?

A deepfake is not automatically illegal merely because AI created it. Using a real person’s identifiable likeness without a lawful basis can violate privacy law. Fraud, identity theft or online sexual harassment may also be involved if the relevant offense’s elements are met. Satire and public-interest claims require a fact-specific assessment.

Source: NPC notice on real persons’ likenesses, 11 August 2026.

What should I do if someone made a harmful AI deepfake of me?

1. Record the evidence: save the URL, account identifier, dates, messages and report numbers. Avoid reposting the harmful content.
2. Request removal: report it through the platform’s impersonation or intimate-content channel and, where safe, send the poster a documented removal request.
3. Choose the complaint route: consider the NPC for misuse of personal data; seek police/NBI assistance where threats, fraud or another crime may be involved.
4. Protect yourself: alert affected contacts if impersonation is occurring; seek urgent help if there is immediate danger. For suspected child sexual-abuse material, record the location and report it without downloading or forwarding it.

Legal routes: RA 10175, Section 4 and RA 11313, Section 12. The NPC notice explains removal demands and privacy complaints; removal or prosecution is not automatic.

We are evaluating an AI vendor

Before signing, check what the AI vendor may do with your data and output, what it promises if something goes wrong, and how you can leave. Use this practical procurement checklist; individual clauses depend on the service and risk.

• Purpose and roles: permitted tasks, data categories and controller/processor responsibilities.
• Model training: whether prompts, files and outputs can be reused; any opt-out and its limits.
• Retention and location: storage periods, backups, subprocessors and overseas transfers.
• Security and incidents: access controls, audit evidence, notification commitments and investigation support.
• Copyright: input licences, output-use terms and infringement exclusions.
• Reliability and oversight: testing, human approval, logs and handling of model changes.
• Liability and exit: indemnities, caps, dispute terms, export, deletion and termination costs.

Legal basis: DPA Sections 20–21; Civil Code Articles 1159 and 1306; IP Code Section 177. Contract terms do not displace statutory duties.

We need an AI governance starting point

Start with a documented inventory, named owners, clear data rules and human oversight. The following is a practical implementation sequence, not a separate government certification.

1. List uses: record tools, users, tasks, data and affected decisions, including AI inside existing software.
2. Assign accountability: name a business owner and involve privacy, security, HR and legal staff as needed.
3. Assess risk: map applicable laws, perform the relevant privacy assessment and review vendor terms.
4. Set operating rules: approved uses, prohibited inputs, review thresholds and escalation contacts.
5. Test and monitor: check accuracy and bias, train users, keep decision records and provide a route to challenge consequential outputs.

Source: NPC Advisory No. 2024-04, Section 2(B)–(D).