Digital health technologies and artificial intelligence are becoming increasingly relevant to healthcare delivery, administration and business operations in Thailand. From telemedicine platforms and connected systems to AI-enabled clinical support and workflow automation, these tools can create significant opportunities — but they also introduce new legal and regulatory questions.
Healthcare organisations considering new technology should assess not only how a solution performs, but also how it fits within existing healthcare, data protection, professional responsibility and commercial frameworks.
1. Regulatory classification and licensing
Not every digital health solution is regulated in the same way. Depending on its intended use and functionality, a platform, software tool or AI-enabled system may fall within healthcare facility requirements, professional practice rules, medical device regulation or other sector-specific requirements.
Organisations should therefore consider regulatory classification early in the procurement or development process, particularly where technology is used to support diagnosis, treatment, monitoring or other patient-facing functions.
Key questions
- Does the technology require registration, licensing or other regulatory approval?
- Could the software or AI functionality be classified as a medical device?
- Are there restrictions on how the technology may be promoted or described?
- Does implementation affect existing healthcare facility or professional licensing arrangements?
2. Professional responsibility and clinical decision-making
AI and digital tools can support healthcare professionals, but responsibility for clinical decisions generally cannot be treated as a purely technical issue. Healthcare providers should clearly define how technology is intended to be used, where human oversight is required and how professional responsibilities are allocated.
This becomes particularly important where an automated system provides recommendations, prioritises cases or supports diagnostic or treatment decisions.
Key questions
- Is the technology advisory, operational or directly involved in clinical decision-making?
- Who remains responsible for reviewing and acting on the system’s output?
- Are workflows designed to ensure appropriate professional oversight?
- Are staff adequately trained on the system’s limitations and intended use?
3. Patient data, PDPA and data governance
Many digital health and AI tools rely on large volumes of health information and other personal data. This makes data governance a central part of legal risk management.
Healthcare organisations should understand what data is collected, where it is stored, who can access it, whether it is transferred outside Thailand and whether it may be reused for analytics, product improvement or AI training.
Key questions
- What categories of personal and health data are processed?
- What is the legal basis for collection, use and disclosure?
- Are third-party technology providers acting as processors, controllers or in another role?
- Are cross-border transfers and data retention appropriately managed?
- Is data used to train or improve AI models, and has this been addressed transparently?
4. Contracts with technology providers
Technology agreements should reflect the operational realities of healthcare. Standard software contracts may not adequately address patient safety, data protection, service continuity, regulatory responsibilities or the consequences of system failure.
Healthcare organisations should ensure that contractual terms appropriately allocate responsibility for security, system performance, data handling, regulatory compliance and liability.
Key questions
- What service levels and uptime commitments apply?
- Who is responsible for cybersecurity incidents or data breaches?
- What rights does the provider have over healthcare data and generated outputs?
- How are errors, system failures and third-party claims addressed?
- Can data be retrieved and transferred if the relationship ends?
5. Transparency, advertising and patient communication
Healthcare businesses should also consider how digital and AI-enabled services are communicated to patients and customers. Claims about accuracy, outcomes, automation or clinical capability should be carefully reviewed and supported.
Where AI or automated systems materially affect a service, organisations should consider whether additional explanations, consent language or patient-facing information may be appropriate.
6. Governance before deployment
A practical digital health governance framework can help organisations evaluate legal, clinical, operational and technology risks before deployment. This is particularly useful where teams across legal, IT, clinical operations, procurement and management are involved in the same project.
Before launch, organisations should consider conducting a structured review covering regulatory classification, data flows, vendor responsibilities, clinical oversight, cybersecurity, patient communication and incident response.
Looking ahead
Digital health and AI are likely to become increasingly integrated into Thailand’s healthcare ecosystem. The key challenge for healthcare businesses will be adopting technology in a way that supports innovation without creating avoidable regulatory, privacy or liability risks.
Early legal review can help organisations identify these issues before they become embedded in operational workflows or commercial arrangements.
This article is intended for general informational purposes only and does not constitute legal advice. Specific legal requirements will depend on the technology, business model and regulatory framework applicable to each organisation.
