Taiwan

This 20-article framework act sets the government's guiding principles for AI development and application (Article 4: sustainable development and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability), designates the National Science and Technology Council as the central AI competent authority with local governments at the municipal or county level (Article 2), and directs the Ministry of Digital Affairs to build a risk taxonomy and assessment framework that sector regulators use to write risk-based management regulations (Article 16).

For high-risk AI application, Article 17 directs the government to clarify liability attribution and establish relief, compensation, or insurance mechanisms, rather than creating those mechanisms itself.

Article 18 gives the government two years from this Act's effective date to bring existing law into conformity with it or enact rules it requires, so a disclosure, crawler or training-data, agent-transaction, or automated-decision duty for a specific AI activity is not yet a duty this Act itself imposes.

The PDPA requires government and non-government agencies alike to collect and process personal data only for a specific purpose and on one of the bases the Act states (Articles 15, 16, 19, 20), notify the data subject when personal data held has been stolen, altered, damaged, lost, or leaked and, in specified circumstances, report the incident to the competent authority (Article 12), and implement security and maintenance measures to prevent theft, alteration, damage, loss, or leakage of personal data files (Article 20-1).

Since an amendment effective October 17, 2025, the Act's competent authority is the Personal Data Protection Commission, an independent agency, which supervises government agencies through periodic and ad hoc audits (Articles 21-1 through 21-5) and may inspect a non-government agency it deems likely to violate the Act (Article 22).

A non-government agency is civilly liable for injury caused by an unlawful collection, processing, or use of personal data (Article 29), with a statutory minimum of NT$500 per data subject per incident where actual damages cannot be readily shown, and 20 or more affected data subjects may delegate a lawsuit to an incorporated foundation or charity (Article 34).

Chapter 36 criminalizes gaining access to another's computer or related equipment by entering another's password, cracking its protective measures, or exploiting a system loophole without cause (Article 358); obtaining, deleting, or altering another's computer data without cause and causing injury (Article 359); interfering with another's computer or related equipment through a computer program or other electromagnetic method without cause and causing injury (Article 360); and making a program specifically to commit one of those offenses (Article 362).

Offending against a public office's computer increases the punishment by up to one half (Article 361), and prosecution of the Article 358 through 360 offenses proceeds only upon the victim's complaint (Article 363). Accessing a page that requires defeating no password, protective measure, or system loophole is not within the text of any offense in this chapter.

Article 65 makes fair use of a work a general defense to infringement of economic rights, judged on all the circumstances and in particular the purpose and character of the exploitation (including whether commercial or nonprofit educational), the nature of the work, the proportion exploited relative to the whole, and the exploitation's effect on the work's current and potential market value.

The Act sets no dedicated text-and-data-mining exception or machine-readable opt-out mechanism separate from this general standard, so a bulk-collection or model-training use of copyrighted text is tested by the same case-by-case Article 65 balancing as any other use.

Unauthorized reproduction infringing another's economic rights is punishable under Article 91 by up to three years imprisonment and/or a fine up to NT$750,000, rising to imprisonment of six months to five years and a fine of NT$200,000 to NT$2,000,000 where the reproduction is made with intent to sell or rent; Article 91 states that personal reference use or fair use of a work does not constitute infringement.

Article 25 is a residual general clause: beyond the Fair Trade Act's other named prohibitions, no enterprise may engage in deceptive conduct, or conduct that is obviously unfair and capable of affecting trading order. The Fair Trade Commission, the Act's named competent authority, may order an enterprise violating Article 25 to cease, rectify, or take corrective action, and may separately impose an administrative penalty of NT$50,000 to NT$25,000,000 (Article 42).

Taiwan has not enacted a dedicated hot-news or database-misappropriation statute; a claim that a competitor's systematic reuse of another's factual reporting or compiled data is unfair has to be brought, if at all, under this general clause rather than under a named misappropriation tort.

Article 24 of the Financial Supervisory Commission's internal-control regulation for financial holding companies and the banking business requires each to 'establish a dedicated information security unit subordinate to the general manager, which shall not concurrently handle information technology operations or other operations that present a conflict of interest with its duties,' headed by 'a person ranked vice general manager or above, or a person with equivalent responsibilities' serving as Chief Information Security Officer.

That officer 'shall report the overall implementation of information security from the preceding year to the board of directors each year'. Article 25 requires the dedicated unit to take charge of 'the planning, management, and execution of the information security system to manage information security risks' and to build 'mechanisms related to cyber security protection, assessment and response to cyber security intelligence, and reporting of and response to cyber security incidents.'

Chapter III of the Cyber Security Management Act binds a 'Specific Non-Government Agency,' defined to mean 'a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization, or institution under control of the government' (Art. 3(6)).

A critical infrastructure provider's own class is defined by reference to 'physical or virtual assets, systems, or networks, the functions of which, once they cease to operate or their performance is reduced, may have a significant impact on national security, social and public interests, people's lives, or economic activities' (Art. 3(7)), a class the Executive Yuan periodically designates.

A critical infrastructure provider 'shall comply with the requirements of their assigned cyber security responsibility levels, appoint dedicated cyber security personnel, and ... formulate, revise, and implement cyber security maintenance plans' (Art. 20, Paragraph 2). Every other specific non-government agency carries the identical duty under Article 21, Paragraph 1.

Every specific non-government agency must also 'appoint a Chief Information Security Officer ... responsible for promoting and overseeing the specific non-government agency's cyber security-related affairs' (Art. 23). A failure to formulate, implement or report on the maintenance plan draws, under Article 30, 'a fine of not less than NT$100,000 and not more than NT$5,000,000 ... for each violation.'

Article 15 of the Telecommunications Management Act requires that 'Telecommunications enterprises who have established a PSTN using telecommunications resources or other telecommunications enterprises announced by the competent authority shall draw up an info-communications security maintenance plan and implement it accordingly'.

Separately, Article 42 lets the competent authority 'designate the PSTN, in whole or in part, as the critical telecommunications infrastructure,' whose establisher 'shall ... draw up a critical telecommunications infrastructure protection plan' subject to the competent authority's evaluation. Failing the general maintenance-plan duty draws a fine under Article 79 for 'Violating Paragraph 1 of Article 15, where no info-communications security management plan has been drawn up or implemented,'.

Failing the critical-infrastructure protection-plan duty draws a separate, higher fine under Article 76 for a party who 'fails to submit critical telecommunications infrastructure protection plan to the competent authority for approval within the prescribed deadline or fails to implement the approved plan.'

Article 24 requires every specific non-government agency to 'establish notification and response mechanisms for cyber security incidents,' and, 'When specific non-government agencies become aware of a cyber security incident, they shall notify the central competent authority in charge of the relevant sector of the incident'.

Failing that notification duty draws, under Article 29, 'a fine of not less than NT$300,000 and not more than NT$10,000,000,' escalating for continued non-correction past the ordered deadline.

The communications and broadcasting competent authority must entrust private organizations with establishing content-protection agencies for children's and juveniles' internet use, and an internet platform provider, defined broadly as any provider of internet platform services including storage space, websites, or web-linking services, must establish self-regulatory norms and adopt clear, feasible protection measures against content harmful to a child's or juvenile's physical and mental health (Article 46).

Where the competent authority for the relevant business notifies a platform provider that its content is harmful or that its protection measures are inadequate, the provider must restrict a child's or juvenile's access or browsing, or remove the content beforehand; a provider that fails to do so is fined NT$60,000 to NT$300,000 and ordered to improve within a set period (Article 94).

Article 46-1 separately prohibits anyone from disseminating or transmitting content harmful to a child's or juvenile's physical and mental health on the internet without taking clear, feasible protection measures or cooperating with a platform's protection mechanisms, in a way that makes the content accessible to a child or juvenile. "Children and juveniles" means persons under eighteen (Article 2).

The Act does not itself prescribe a specific age-verification method, leaving the content-classification system, filtering software, and self-regulatory norms to be developed under the competent authority's protection mechanisms.

Article 3, paragraph 1, subparagraph 4 excludes from copyright protection "oral and literary works for news reports that are intended strictly to communicate facts," so a bare factual news report carries no copyright to begin with. Where a report contains a protected expression, Article 49 lets a person reporting a current event by broadcasting, photography, film, newspaper, or internet exploit, within the scope necessary to the report, whatever work is seen or heard in the course of that event.

Article 61 separately lets a newspaper, magazine, or internet transmission republish, publicly broadcast, or publicly transmit commentary on a current political, economic, or social event that has already appeared in a newspaper, magazine, or on the internet, unless the original publisher has indicated that republishing is not authorized.

Neither provision creates a payment obligation or a registration or designation scheme; each is a copyright exception that either removes the underlying content from protection or permits its republication subject to an opt-out.