1. Introduction

Autonomous Behavioral Regulation Systems (ABRS) are technology-based systems designed to monitor, evaluate, influence, modify, or regulate human behaviour without requiring continuous human intervention.

These systems use artificial intelligence (AI), machine learning, behavioural analytics, biometric monitoring, automated decision-making, and predictive algorithms to regulate individual or collective conduct.

Examples include:

AI-powered workplace systems that monitor employee productivity and automatically issue warnings.

Automated educational platforms that regulate student behaviour and impose restrictions.

Smart surveillance systems that identify allegedly inappropriate behaviour in public places.

Automated financial platforms that restrict transactions based on behavioural risk scores.

AI-based healthcare systems that monitor patient compliance and modify treatment recommendations.

Digital platforms that automatically suspend users for allegedly violating behavioural standards.

In Thailand, these systems raise important civil-law questions concerning personal rights, privacy, negligence, contractual responsibility, consumer protection, discrimination, compensation, and the liability of technology providers.

Central legal issue: When an autonomous system independently evaluates and regulates human behaviour, who bears civil liability if its decision causes financial loss, reputational damage, discrimination, emotional injury, or interference with personal rights?

Thailand does not have a separate comprehensive civil-liability statute specifically governing autonomous behavioural regulation systems. Their legal consequences must therefore be examined through existing legislation and established civil-law principles.

2. Legal Framework Governing Autonomous Behavioural Regulation in Thailand

A. Thai Civil and Commercial Code (CCC)

The Thai Civil and Commercial Code provides the principal framework for determining civil responsibility.

Section 420 – General tort liability

Section 420 establishes liability where a person, wilfully or negligently, unlawfully injures another person's life, body, health, liberty, property, or rights.

This provision is particularly important where an autonomous system:

Incorrectly classifies an individual as dangerous.

Automatically restricts someone's access to services.

Produces discriminatory behavioural assessments.

Causes psychological or reputational injury.

Improperly interferes with personal rights.

The injured person may seek compensation if the necessary elements of unlawful conduct, fault, injury, and causation are established.

Section 421 – Exercise of rights contrary to their purpose

The exercise of a right that is intended solely to cause injury to another person may constitute unlawful conduct.

This principle may become relevant where an organisation deliberately configures an automated behavioural system to harass, intimidate, or unfairly disadvantage particular individuals.

Section 422 – Presumption of fault in certain circumstances

Where damage results from an infringement of a legal provision intended to protect others, the statutory presumption concerning fault may become relevant, subject to the provision's requirements.

Sections 438 and 446 – Compensation

Section 438 concerns the court's assessment of damages, while Section 446 addresses compensation for non-pecuniary injury in specified circumstances.

These provisions may support compensation claims involving physical injury, impairment of liberty, health-related harm, or other legally recognised personal injury.

B. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA) is central to behavioural regulation technologies.

Such systems frequently process:

Personal identifiers.

Facial images and biometric information.

Location information.

Employment performance records.

Financial behaviour.

Health information.

Online activity and behavioural profiles.

Important provisions include:

Section 77 is particularly significant because it establishes civil liability for damage arising from non-compliance with the PDPA, subject to its statutory conditions and defences.

Consequently, a company deploying autonomous behavioural systems may face liability when unlawful collection, profiling, disclosure, or processing of personal information causes damage.

C. Consumer Protection Act B.E. 2522 (1979)

The Consumer Protection Act may apply where behavioural regulation technology is supplied as a commercial product or service.

Potential issues include:

Misleading claims concerning AI accuracy.

Concealment of automated restrictions.

Unfair contractual conditions.

Misrepresentation of behavioural scoring.

Failure to disclose important limitations.

D. Product Liability Act B.E. 2551 (2008)

The Liability for Damages Arising from Unsafe Products Act may become relevant where an unsafe product incorporating autonomous behavioural technology causes damage.

Questions may arise concerning defective sensors, unsafe embedded software, inadequate warnings, and dangerous system design.

Its application depends on the statutory definition of product, defect, damage, and responsible business operator. Not every standalone software service will automatically qualify.

E. Computer Crime Act B.E. 2550 (2007)

The Computer Crime Act may become relevant where behavioural regulation systems involve unlawful access, alteration, interference, or misuse of computer data and systems.

It should not, however, be treated as a general civil-liability statute for every incorrect automated decision.

3. Civil Liability of Different Participants

Autonomous behavioural regulation usually involves several participants. Thai law does not automatically transfer responsibility to the AI system itself.

A. Liability of system developers

Developers may face liability under Section 420 when negligent development or testing causes legally recognised damage.

Examples include:

Designing an algorithm that systematically misclassifies individuals.

Failing to test behavioural prediction systems.

Creating software that automatically imposes disproportionate restrictions.

Failing to correct known defects.

Ignoring foreseeable risks associated with biometric monitoring.

A developer's liability will depend on its actual role, contractual obligations, knowledge of the risks, and causal contribution to the injury.

B. Liability of organisations deploying autonomous systems

An organisation cannot necessarily avoid responsibility by arguing that the harmful decision was made by an algorithm.

For example, an employer deploying an automated employee-monitoring platform may be liable where negligent supervision or unlawful system deployment causes damage.

Relevant legal considerations include:

Whether the monitoring was lawful.

Whether employees were adequately informed.

Whether the organisation had a legitimate purpose.

Whether the collected information was necessary.

Whether the resulting disciplinary action violated contractual or statutory rights.

C. Liability for autonomous decision-making

A particularly difficult question arises when the system acts without direct human intervention.

For instance, an automated platform might independently classify an individual as a high-risk person and restrict access to essential services.

The court would need to examine:

Who selected the system?

Who controlled its operational parameters?

Who supplied the training data?

Who had authority to override its decisions?

Whether the outcome was foreseeable.

Whether reasonable safeguards were implemented.

The absence of direct human intervention does not automatically eliminate the possibility of liability.

4. Important Thai Case Laws

Important legal qualification: Thailand has not yet developed a substantial body of reported Supreme Court decisions specifically concerning AI-driven autonomous behavioural regulation. The following six-plus decisions are established judicial authorities relevant by analogy. They should not be misrepresented as cases directly deciding AI liability.

Case 1. Supreme Court Decision No. 4893/2558 (2015) – Right to Privacy and Unlawful Publication

Legal principle: Violation of personal privacy may constitute a wrongful act under Section 420 of the Civil and Commercial Code.

The case concerned the publication of intimate images of individuals without their consent.

The Supreme Court recognised that personal privacy constitutes a legally protected right and that unlawful interference with that right may result in civil liability.

Application to autonomous behavioural regulation:

This decision is important where an autonomous system:

Collects private behavioural information without lawful justification.

Publishes sensitive personal information.

Uses facial recognition to identify individuals improperly.

Exposes private behavioural patterns.

Distributes personal profiles without legal authority.

It supports the proposition that technological interference with privacy may create civil liability.

Case 2. Supreme Court Decision No. 15067/2557 (2014) – Medical Negligence and Incorrect Health Information

Legal principle: Incorrect medical reporting that causes additional injury may constitute negligence under Section 420.

The case concerned a hospital and a doctor who incorrectly reported a patient's medical examination results. The error delayed diagnosis of kidney cancer, allowing the disease to progress.

The Court recognised that the defendants could be responsible for the additional harm caused by the incorrect reporting.

Application to autonomous behavioural regulation:

This case provides a useful analogy for AI-powered healthcare and behavioural monitoring systems.

For example:

An AI system incorrectly evaluates a patient's behavioural condition.

A treatment recommendation is generated from inaccurate information.

A patient is denied appropriate medical intervention.

The system's inaccurate assessment causes further injury.

The case demonstrates the importance of accurate information, professional supervision, and causation.

Case 3. Supreme Court Decision No. 6234/2564 (2021) – Unlawful School Expulsion and Joint Tort Liability

Legal principle: School officials may incur joint tort liability where pupils are unlawfully removed from the school register.

The dispute concerned the removal of two pupils from a private school's student register without proper authority.

The decision is relevant to the legal limits of institutional disciplinary powers.

Application to autonomous behavioural regulation:

Consider an educational institution using AI to monitor students.

An automated system might:

Identify a student as a disciplinary risk.

Automatically suspend a student.

Restrict access to educational facilities.

Produce inaccurate behavioural assessments.

Recommend expulsion without proper review.

The decision provides an analogy for examining whether institutional authorities have acted unlawfully when exercising disciplinary powers through automated technology.

Case 4. Supreme Court Decision No. 1808/2561 (2018) – Concealment of Material Information and Consumer Rights

Legal principle: Concealing material information in a commercial transaction may constitute a wrongful act under Section 420.

The dispute concerned a property developer that failed to disclose material information about the expropriation of part of the property sold to consumers.

The Court recognised the legal consequences of concealing important information and causing consumer injury.

Application to autonomous behavioural regulation:

This decision is relevant where technology providers or commercial organisations conceal material facts about behavioural regulation systems.

Examples include:

Concealing automated risk-scoring practices.

Misrepresenting the accuracy of behavioural assessments.

Failing to disclose significant system limitations.

Hiding automated restrictions from consumers.

The decision supports the importance of transparency in commercial relationships.

Case 5. Supreme Court Decision No. 5374/2561 (2018) – Security Infrastructure and Protection of Property Rights

Legal principle: Interference with legally protected property-related interests may constitute a wrongful act under Section 420.

The case concerned interference with a boundary wall forming part of the common facilities of a property development. The wall was associated with access control, security personnel, and CCTV facilities.

The Supreme Court recognised the legal significance of the common security infrastructure and the resulting interference with protected interests.

Application to autonomous behavioural regulation:

The case is relevant to automated security environments involving:

AI surveillance cameras.

Automated access-control systems.

Behaviour-based entry restrictions.

Smart building security.

Automated monitoring of residential communities.

It illustrates the importance of determining who possesses legally protected interests in security infrastructure and who is responsible for unlawful interference.

Case 6. Supreme Court Decision No. 6010/2564 (2021) – Civil Liability and Independent Civil Evidence

Legal principle: Civil liability may be established independently through civil proceedings and evidence, rather than depending entirely on the outcome of criminal proceedings.

The case involved company funds transferred into accounts belonging to several individuals through an employee's misappropriation scheme.

The Court examined the involvement of the recipients and their responsibility for the transferred money.

Application to autonomous behavioural regulation:

This principle may be relevant when a behavioural regulation system causes financial or property damage.

For example:

An automated system wrongly freezes a customer's account.

A behavioural risk assessment triggers financial restrictions.

An automated payment system transfers money improperly.

Several companies participate in the development and operation of the harmful system.

A claimant must establish the relevant civil responsibility through admissible evidence, rather than assuming that a criminal conviction is always necessary.

Case 7. Supreme Court Decision No. 6683/2537 (1994) – Standing to Claim Compensation

Legal principle: A person seeking compensation must establish that they are the person who actually suffered the relevant damage or possesses the necessary legal entitlement to claim it.

The dispute involved a person driving a borrowed vehicle who sought compensation for repair expenses after an accident.

The Court held that the borrower could not claim the owner's repair costs merely because the borrower had been driving the vehicle.

Application to autonomous behavioural regulation:

This decision is relevant to identifying proper claimants where automated systems cause damage.

For example:

An employee suffers reputational damage from an automated assessment.

A company suffers financial loss because its business account is restricted.

A family member seeks compensation for another person's injury.

A customer claims compensation for damage actually suffered by another account holder.

The claimant must demonstrate the appropriate legal interest and standing.

Case references and principles are drawn from Thai Supreme Court decision summaries and legal research materials. The application to autonomous systems is analytical, not a holding of those courts on AI technology.

Additional relevant judicial decisions

The following decisions can further strengthen comparative analysis of liability and procedural responsibility.

These are supplementary authorities, not direct precedents on behavioural AI. The decisions and their general tort-law context can be found in the Thai Supreme Court decision database.

Thai CCC+1

5. Employer Liability for Autonomous Behavioural Regulation

One important application of autonomous behavioural regulation is the workplace.

Thai employers increasingly have access to digital systems that monitor employee productivity, attendance, movements, performance, and workplace conduct.

Potential disputes include:

A. Automated employee dismissal

If an automated system incorrectly identifies an employee as violating workplace rules and the employer dismisses that employee, legal questions may arise under:

The Civil and Commercial Code.

The Labour Protection Act B.E. 2541 (1998).

The Labour Relations Act B.E. 2518 (1975).

The Personal Data Protection Act.

B. Automated productivity monitoring

Continuous monitoring may create privacy and personal-data protection issues, especially where unnecessary or excessive personal information is collected.

C. Algorithmic discrimination

If a behavioural scoring system disadvantages employees based on inaccurate or unlawfully processed information, the employer may face civil and employment-related claims.

D. Unreasonable disciplinary decisions

An employer should not assume that an automated assessment automatically establishes employee misconduct. The accuracy of the information and the legality of the disciplinary decision remain important.

6. Liability Under Section 437: Dangerous Property

Section 437 of the Civil and Commercial Code deserves particular attention.

It establishes special liability concerning damage caused by certain dangerous things or animals, subject to its statutory conditions and defences.

In autonomous technology disputes, a question may arise as to whether the relevant equipment qualifies as a dangerous thing and whether the person possessing or controlling it falls within the provision.

Examples include:

Autonomous security robots.

AI-controlled industrial machinery.

Smart access-control equipment.

Automated surveillance devices.

Autonomous vehicles.

However, it would be incorrect to assume that every AI algorithm or software application automatically constitutes a dangerous thing under Section 437.

The court must examine the nature of the equipment, its operation, the statutory requirements, and the causal relationship between the thing and the damage.

7. Contractual Liability for Autonomous Behavioural Systems

Autonomous behavioural regulation is also governed by contractual principles.

Commercial agreements may exist between:

Software developers and business operators.

Employers and technology providers.

Schools and automated monitoring suppliers.

Banks and behavioural analytics providers.

Consumers and digital platforms.

Under the Civil and Commercial Code, contractual responsibility may arise where a party fails to perform its agreed obligations.

Relevant provisions include:

Section 213 – Enforcement of obligations.

Section 215 – Compensation for non-performance.

Section 222 – Scope of recoverable damages.

Section 383 – Judicial reduction of an excessive penalty in appropriate circumstances.

For example, if a technology provider guarantees that its behavioural monitoring platform will comply with agreed technical standards but supplies a defective system, the customer may have a contractual claim.

A contractual disclaimer stating that all AI decisions are automatically final does not necessarily eliminate statutory obligations or liability for unlawful conduct.

8. Personal Data and Automated Behavioural Profiling

The PDPA is particularly important because autonomous behavioural regulation systems frequently depend on collecting and analysing personal information.

A. Behavioural profiling

A behavioural profile may include:

Purchasing patterns.

Online activity.

Location history.

Workplace conduct.

Facial recognition records.

Health-related behavioural information.

The organisation must identify an appropriate lawful basis for processing and comply with applicable transparency, necessity, security, and retention requirements.

B. Automated decision-making

Thailand's PDPA does not establish a comprehensive, general-purpose right to human review of every automated decision comparable to the express safeguards found in some other jurisdictions.

Nevertheless, automated decision-making must comply with the PDPA's existing requirements.

The organisation should maintain procedures for:

Explaining relevant data-processing purposes.

Correcting inaccurate personal information.

Protecting sensitive personal data.

Restricting unauthorised disclosure.

Responding to data-subject requests.

Investigating harmful automated decisions.

C. Civil remedies

Under Sections 77 and 78 of the PDPA:

A data controller or processor may be liable for damage caused by non-compliance.

Intentional or negligent conduct is not always necessary to establish liability under Section 77.

Statutory exceptions apply.

Courts may award punitive damages of up to twice the actual damages under Section 78.

The statutory limitation periods must be observed.

Thailand Law Library+1

9. Evidence and Burden of Proof

Autonomous behavioural regulation disputes create difficult evidentiary questions because the internal decision-making process may be inaccessible to the injured individual.

Important evidence includes:

Under ordinary civil procedural principles, the claimant generally must establish the facts supporting the claim.

However, specific statutory provisions, including PDPA liability rules, may affect the allocation of legal responsibility.

A particularly important issue is the preservation of automated decision logs. If an organisation cannot explain the system's operation, establishing causation may become more difficult for both parties.

10. Major Legal Challenges in Thailand

A. Absence of specific AI civil-liability legislation

Thailand's existing civil laws were not originally designed for fully autonomous behavioural decision-making.

Section 420 therefore remains an important general mechanism.

B. Difficulty identifying the responsible party

A harmful decision may result from interactions between a developer, data controller, software provider, and deploying organisation.

Determining each party's contribution is essential.

C. Algorithmic opacity

Individuals may not know why an automated system has classified them as dangerous, unreliable, or unsuitable.

D. Discrimination and unequal treatment

Behavioural prediction systems may reproduce inaccurate assumptions or discriminatory patterns contained in their data.

E. Lack of direct judicial precedents

There is an important distinction between established Thai tort-law decisions and actual AI litigation.

As reported in 2026 legal research, Thailand has not developed a substantial body of publicly available higher-court decisions concerning AI liability or AI-specific personal-data disputes. Most PDPA enforcement matters have been addressed through administrative processes.

Chambers+2

11. Proposed Legal Reforms

Thailand could strengthen its legal framework through the following reforms.

1. Mandatory human oversight

High-impact behavioural decisions should have meaningful human review, particularly where they affect employment, education, financial access, or essential services.

2. Algorithmic transparency

Organisations should disclose when significant decisions are made using automated behavioural assessments.

3. Risk-based classification

AI behavioural systems should be classified according to the potential harm they can cause.

4. Mandatory independent audits

High-risk systems should undergo periodic testing for accuracy, discrimination, cybersecurity, and reliability.

5. Clear allocation of liability

Legislation should clarify the respective responsibilities of developers, manufacturers, data controllers, processors, and deploying organisations.

6. Accessible compensation mechanisms

Individuals affected by harmful automated decisions should have practical access to complaints procedures and civil remedies.

7. Protection against automated discrimination

Specific safeguards should address unjustified behavioural classifications and discriminatory restrictions.

12. Illustrative Hypothetical Case

Consider a Thai company that introduces an AI-based employee behavioural regulation platform.

The platform continuously analyses employee movements, productivity, facial expressions, attendance, and communication patterns.

One employee is incorrectly classified as a serious disciplinary risk. The platform automatically recommends dismissal, and the employer terminates the employee's employment without independently examining the information.

The employee subsequently discovers that the classification resulted from inaccurate data.

Potential legal claims include:

The employee may seek appropriate compensation for proven losses.

The employer cannot necessarily avoid responsibility by claiming that the AI platform independently generated the recommendation.

However, liability of the software developer would require a separate examination of its contractual obligations, negligence, statutory responsibilities, and contribution to the damage.

13. Conclusion

Civil Law and Autonomous Behavioral Regulation Systems in Thailand represents an emerging area of legal responsibility involving the intersection of traditional tort law, contractual obligations, personal-data protection, employment law, and consumer protection.

The most important existing legal foundation is Section 420 of the Thai Civil and Commercial Code, supplemented by Sections 421, 437, 438, and the Personal Data Protection Act B.E. 2562 (2019).

The seven principal Supreme Court decisions discussed above establish useful principles concerning privacy, negligence, institutional responsibility, consumer rights, property interests, independent civil evidence, and standing.

Nevertheless, none should be described as directly deciding the civil liability of an autonomous behavioural regulation algorithm.

Overall legal position

Thailand's existing civil-law framework provides several routes for addressing injuries caused by autonomous behavioural regulation systems. Its principal challenge is adapting established liability principles to situations where decisions are generated by complex technological systems rather than conventional human decision-makers.

Research note: This is an academic legal explanation, not a substitute for advice on a specific Thai dispute. No external links have been included, as requested.