How Risk-Based AI Regulation Is Taking Shape Across Asia

This blog was originally posted on 14th October, 2026. Further regulatory developments may have occurred after publication. To keep up-to-date with the latest compliance news, sign up to our newsletter.

AUTHORED BY NGUYEN NGUYEN, REGULATORY COMPLIANCE SPECIALIST, ADHERENT

---

Key Insights

This article looks at four illustrative jurisdictions in Asia where risk-based AI rules are emerging. AI regulation there is moving along different tracks. All four, however, reflect the broader idea that higher-risk uses should face stronger controls.

Table of Contents

• Introduction
• South Korea: High-Impact AI Under a Binding Framework
• The Philippines: Two Comprehensive Proposals
• Malaysia’s AI Governance Bill
• China: Risk Controls Through Specific Rules
• Implications for Compliance
• Next Steps Across the Region
• Final Thoughts
• Frequently Asked Questions

Introduction

Since the EU passed its AI Act in 2024, risk has become a central way of thinking about AI regulation. The Act uses risk to decide which AI practices are banned and which face heavier requirements, such as uses in recruitment, credit scoring and law enforcement.

Several Asian jurisdictions are now working with the same broad idea, although the details vary considerably. South Korea has already brought a comprehensive AI law into force and applies additional requirements to high-impact AI. The Philippines has two comprehensive AI bills before Congress. Malaysia has consulted on its own risk-based framework. China currently uses a different structure, with separate rules for particular AI technologies and services.

However, “risk-based” does not necessarily mean adopting the EU’s four categories of unacceptable, high, limited and minimal risk. Some frameworks require or propose registration with the regulator before a system in a stricter category goes live, whereas others leave more to the operator’s own risk management.

South Korea: High-Impact AI Under a Binding Framework

South Korea’s Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust took effect on 22 January 2026, together with its Enforcement Decree. The Ministry of Science and ICT describes it as the second AI regime to be enacted anywhere in the world.

High-Impact AI and Transparency Duties

South Korea approaches risk a little differently from the EU, with high-impact AI as its main risk category and no list of banned practices. Its framework applies that concept to systems that can affect areas such as healthcare, recruitment,, credit and public services. Once a system falls within that category, requirements can apply around risk management and human oversight. The Act’s transparency requirements also cover generative AI. MSIT has issued guidance on those duties, including how providers should tell users that they are interacting with AI and how AI-generated content should be identified.

Enforcement and Proposed Changes

The Act is already in force, but MSIT has granted a grace period of at least one year before administrative fines are imposed, and fact-finding investigations will generally be deferred except in highly exceptional cases. The Ministry has also established an AI Basic Act Support Desk for business operators. A recent Bill would extend the high-impact category from hiring into wider personnel management, such as job placement and performance evaluation.

The Philippines: Two Comprehensive Proposals

Four Risk Categories Under HB11137

House Bill No. 11137, the proposed Philippine Artificial Intelligence Regulatory Framework Act, was filed on 7 September 2026. It would divide AI systems into four categories: unacceptable, high, limited and minimal risk.

At the unacceptable end, some AI practices would be prohibited outright, including specified forms of social scoring and some uses of real-time biometric identification. Before deployment, a deployer of a high-risk system would need to register it in a National AI Registry and conduct a documented risk assessment. The Bill also calls for bias testing and human oversight, among other safeguards.

The limited-risk category includes generative AI. This means users would need to be told when they are interacting with AI or seeing content that AI has generated or materially altered. Where feasible, deployers would also need to provide access to human assistance. Minimal-risk systems would not face mandatory registration or pre-deployment review.

Employment and Sector-Specific Provisions

The Bill also deals directly with employment uses of AI. Employers using AI in recruitment, performance evaluation or termination would need to disclose that use, test for bias and provide human review of adverse decisions on request. Other provisions cover sectors such as finance and healthcare.

House Bill No. 11007 (FAIR-AI Act)

A second comprehensive bill, House Bill No. 11007 (the FAIR-AI Act), was filed earlier, on 27 August. It would use three levels of risk and set up a Philippine AI Regulation Council. Among other things, the Council would issue a binding compliance code for companies across the AI supply chain.

Malaysia’s AI Governance Bill

Moving Beyond Voluntary Guidance

Malaysia is moving beyond voluntary AI guidance towards its first horizontal AI law. Until now, it has relied on that guidance alongside sector-specific rules, which the National AI Office (NAIO) has acknowledged could lead to inconsistent standards. The Office, launched under the Ministry of Digital in December 2024, consulted on proposals for an AI Governance Bill from 10 July to 1 August 2026. By September, a draft had been completed and was on its way to Cabinet. It could go before Parliament by early 2027.

What the Proposed Bill Would Cover

The proposed Bill is intended to act as a preventive layer on top of existing laws, which would continue to handle illegal AI-generated content. Its focus would be how developers and deployers manage risk across a system’s lifecycle. Under the proposals, a system developed or deployed to cause harm would be prohibited. One that creates a risk of harm without that intent would be treated as high risk and face requirements such as risk assessment and human oversight. A developer’s or deployer’s share of responsibility would depend on its control over the system. A new central AI authority would work with sectoral regulators and set up incident reporting. When the text is published, it will be interesting to see how much of the consultation makes it into the final Bill.

China: Risk Controls Through Specific Rules

No Single AI Law Yet

China does not currently place all AI systems within a single horizontal risk ladder. Instead, regulators have introduced separate binding rules for recommendation algorithms, deep synthesis, generative AI and other specific services. In May 2026, the State Council’s legislative work plan called for comprehensive AI legislation to be accelerated.

AI Content Labelling Requirements

China’s labelling rules took effect on 1 September 2025. Under the Measures for Labelling AI-Generated Synthetic Content, providers must add a hidden label to the metadata of AI-generated files. That label records details such as the provider’s name and a reference number for the content. Visible labels are required for the types of service China’s earlier deep-synthesis rules treat as likely to confuse or mislead the public, such as chatbots that simulate a person or face-swapping tools. Platforms that share content must check for these labels and add notices where required.

Human-Like Interaction Rules

A further set of rules took effect on 15 July 2026. The Interim Measures for the Administration of Human-Like Interactive Artificial Intelligence Services cover services that simulate a human personality through sustained emotional interaction, such as virtual companions. Providers must tell users that they are interacting with AI and guard against risks such as emotional dependence and harm to minors. Alongside supervision that varies by type and level of service, a security assessment is required at set points, such as at launch or once the service reaches 1 million registered users or 100,000 monthly active users.

Implications for Compliance

Across these frameworks, the controls an AI system faces often depend on how and where it is used, rather than on the model alone. The same language model might only need a disclosure notice as a customer-service chatbot, but if it screens job applicants it could count as high-impact AI in South Korea. Where a company sits in the AI supply chain can also affect its obligations. Malaysia’s proposals give developers and deployers different responsibilities, and a business that adapts or integrates a model could count as both. Under the Philippines’ HB11137, the employer screening those applicants would carry its own duties, including bias testing.

Systems in a stricter category tend to come with record-keeping, from the risk-management records South Korea expects of high-impact AI operators to the pre-deployment assessment and ongoing monitoring the Philippine Bill would require. Those duties keep the paperwork live for as long as the system is in use. Some rules also require a fresh assessment when a system changes. China’s human-like interaction Measures, for example, call for a new security assessment when a provider adds related functions or makes major changes using new technology. In South Korea, a change in the law could also bring a job-placement tool into the high-impact category if the proposed personnel-management amendment passes.

Next Steps Across the Region

For South Korea and China, where binding rules already apply, the focus is now on how those rules will be enforced and extended. In South Korea, attention will turn to the end of the enforcement grace period and to whether the personnel-management proposal moves forward. China continues to develop rules for particular services alongside work on a broader AI law, which remains on the government’s agenda.

In the Philippines and Malaysia, the laws have not yet been passed. Earlier AI bills in the Philippines lapsed when their Congress ended. Progress on HB11007 or HB11137 is the next step to watch in the Philippines. In Malaysia, it is the Bill’s introduction in Parliament. With the Philippines chairing ASEAN this year, the Digital Economy Framework Agreement due in November will also be worth watching for what it says about how the region approaches emerging technologies, including AI.

Final Thoughts

Many companies have planned their AI compliance around the EU AI Act and may be tempted to use the same timetable elsewhere. The EU’s Annex III high-risk obligations have been deferred to December 2027. South Korea’s high-impact requirements, which cover uses such as recruitment and credit, already apply, and fines could follow once MSIT’s grace period of at least one year ends. A company working towards the EU high-risk deadline could therefore face risk-based obligations for comparable uses in South Korea considerably earlier.

In several of the jurisdictions discussed here, duties fall on the company using an AI system as well as the one that built it. Companies in that position may find that a standard software licence says nothing about who runs the tests or keeps the results. Settling that with the vendor before a system goes live is likely to be easier than after a regulator starts asking.

FAQ

• Which of these Asian jurisdictions already have binding AI rules in effect?
  South Korea and China both have binding AI rules currently in force. South Korea’s Framework Act took effect on 22 January 2026. China enforces separate rules for recommendation algorithms, deep synthesis, generative AI, AI content labelling (from 1 September 2025) and human-like interactive AI services (from 15 July 2026).
• How does South Korea’s approach to AI risk differ from the EU AI Act?
  Unlike the EU AI Act, which bans some AI practices outright, South Korea uses “high-impact AI” as its main risk category and has no list of banned practices. South Korea’s framework applies to systems that can affect areas such as healthcare, recruitment, credit and public services, with requirements that can apply around risk management and human oversight.
• What AI risk categories does the Philippines’ House Bill No. 11137 propose?
  HB11137 would divide AI systems into four categories: unacceptable, high, limited and minimal risk. Unacceptable-risk practices, such as specified forms of social scoring, would be prohibited outright. High-risk systems would need to be registered in a National AI Registry before deployment, with a documented risk assessment. Limited-risk systems, including generative AI, would face transparency requirements. Minimal-risk systems would not require mandatory registration or pre-deployment review.
• Could regulations in Asia apply before the EU AI Act’s high-risk obligations?
  Yes. The EU’s Annex III high-risk obligations have been deferred to December 2027, but South Korea’s high-impact AI requirements, which cover uses such as recruitment and credit, already apply, and fines could follow once MSIT’s grace period of at least one year ends. Companies planning compliance solely around the EU timeline could therefore face risk-based obligations for comparable uses in South Korea sooner.
• How does Malaysia’s proposed AI Governance Bill assign responsibility between developers and deployers?
  Under Malaysia’s proposals, a developer’s or deployer’s share of responsibility would depend on its degree of control over the AI system. A business that adapts or integrates a model could count as both a developer and a deployer.

See Adherent in Action

Discover how agentic AI is reshaping product compliance for global enterprises.

BOOK A DEMO