Taiwan

This 20-article framework act sets the government's guiding principles for AI development and application (Article 4: sustainable development and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability), designates the National Science and Technology Council as the central AI competent authority with local governments at the municipal or county level (Article 2), and directs the Ministry of Digital Affairs to build a risk taxonomy and assessment framework that sector regulators use to write risk-based management regulations (Article 16).

For high-risk AI application, Article 17 directs the government to clarify liability attribution and establish relief, compensation, or insurance mechanisms, rather than creating those mechanisms itself. Article 5 provides that an AI product or system identified as a high-risk application by a central competent authority for the relevant industry, in consultation with the Ministry of Digital Affairs, shall come with advisory notices or warnings.

Article 18 gives the government two years from this Act's effective date to bring existing law into conformity with it or enact rules it requires, so a crawler or training-data, agent-transaction, or automated-decision duty for a specific AI activity, and any disclosure or labeling duty beyond the Article 5 warning, is not yet a duty this Act itself imposes. The Act provides that it takes effect from the date of its promulgation. It was promulgated on 14 January 2026.

Under Article 13 of the Central Regulation Standard Act, a law that takes effect from its promulgation takes effect from the third day counting from the day of promulgation.

The PDPA requires government and non-government agencies alike to collect and process personal data only for a specific purpose and on one of the bases the Act states (Articles 15, 16, 19, 20), notify the data subject when personal data held has been stolen, altered, damaged, lost, or leaked and, in specified circumstances, report the incident to the competent authority (Article 12), and implement security and maintenance measures to prevent theft, alteration, damage, loss, or leakage of personal data files (Article 20-1).

Since an amendment effective October 17, 2025, the Act's competent authority is the Personal Data Protection Commission, an independent agency, which supervises government agencies through periodic and ad hoc audits (Articles 21-1 through 21-5) and may inspect a non-government agency it deems likely to violate the Act (Article 22).

A non-government agency is civilly liable for injury caused by an unlawful collection, processing, or use of personal data (Article 29), with a statutory minimum of NT$500 per data subject per incident where actual damages cannot be readily shown, and 20 or more affected data subjects may delegate a lawsuit to an incorporated foundation or charity (Article 34).

Chapter 36 criminalizes gaining access to another's computer or related equipment by entering another's password, cracking its protective measures, or exploiting a system loophole without cause (Article 358); obtaining, deleting, or altering another's computer data without cause and causing injury (Article 359); interfering with another's computer or related equipment through a computer program or other electromagnetic method without cause and causing injury (Article 360); and making a program specifically to commit one of those offenses (Article 362).

Offending against a public office's computer increases the punishment by up to one half (Article 361), and prosecution of the Article 358 through 360 offenses proceeds only upon the victim's complaint (Article 363).

Article 358 reaches access only by entering another person's password, cracking the protective measures for using the computer, or exploiting a loophole of the computer system, but Articles 359 and 360 contain no password, protective-measure, or loophole element and turn instead on acting without reason and causing injury to the public or another.

No commencement clause for the act of 25 June 2003 that added the chapter has been located, and no day on which the chapter came into force has been located.

Article 65 makes fair use of a work a general defense to infringement of economic rights, judged on all the circumstances and in particular the purpose and character of the exploitation (including whether commercial or nonprofit educational), the nature of the work, the proportion exploited relative to the whole, and the exploitation's effect on the work's current and potential market value.

The Act sets no dedicated text-and-data-mining exception or machine-readable opt-out mechanism separate from this general standard, so a bulk-collection or model-training use of copyrighted text is tested by the same case-by-case Article 65 balancing as any other use.

Unauthorized reproduction infringing another's economic rights is punishable under Article 91 by up to three years imprisonment and/or a fine up to NT$750,000, rising to imprisonment of six months to five years and a fine of NT$200,000 to NT$2,000,000 where the reproduction is made with intent to sell or rent; Article 91 states that personal reference use or fair use of a work does not constitute infringement.

The Act provides that it takes effect from the date of its promulgation, apart from the exceptions it lists. The last revision of the whole Act was promulgated on 21 January 1998. Under Article 13 of the Central Regulation Standard Act, a law that takes effect from its promulgation takes effect from the third day counting from the day of promulgation.

Article 25 is a residual general clause: beyond the Fair Trade Act's other named prohibitions, no enterprise may engage in deceptive conduct, or conduct that is obviously unfair and capable of affecting trading order. The Fair Trade Commission, the Act's named competent authority, may order an enterprise violating Article 25 to cease, rectify, or take corrective action, and may separately impose an administrative penalty of NT$50,000 to NT$25,000,000 (Article 42).

The Act provides that it takes effect from the date of its promulgation, except Articles 10 and 11, which take effect thirty days after promulgation. The full revision was promulgated on 4 February 2015. Under Article 13 of the Central Regulation Standard Act, a law that takes effect from its promulgation takes effect from the third day counting from the day of promulgation.

Article 24 of the Financial Supervisory Commission's internal-control regulation for financial holding companies and the banking business requires each to 'establish a dedicated information security unit subordinate to the general manager, which shall not concurrently handle information technology operations or other operations that present a conflict of interest with its duties,' headed by 'a person ranked vice general manager or above, or a person with equivalent responsibilities' serving as Chief Information Security Officer.

That officer 'shall report the overall implementation of information security from the preceding year to the board of directors each year'. Article 25 requires the dedicated unit to take charge of 'the planning, management, and execution of the information security system to manage information security risks' and to build 'mechanisms related to cyber security protection, assessment and response to cyber security intelligence, and reporting of and response to cyber security incidents.'

Chapter III of the Cyber Security Management Act binds a 'Specific Non-Government Agency,' defined to mean 'a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization, or institution under control of the government' (Art. 3(6)).

A critical infrastructure provider's own class is defined by reference to 'physical or virtual assets, systems, or networks, the functions of which, once they cease to operate or their performance is reduced, may have a significant impact on national security, social and public interests, people's lives, or economic activities' (Art. 3(7)), a class the Executive Yuan periodically designates.

A critical infrastructure provider 'shall comply with the requirements of their assigned cyber security responsibility levels, appoint dedicated cyber security personnel, and ... formulate, revise, and implement cyber security maintenance plans' (Art. 20, Paragraph 2). Every other specific non-government agency carries the identical duty under Article 21, Paragraph 1.

Every specific non-government agency must also 'appoint a Chief Information Security Officer ... responsible for promoting and overseeing the specific non-government agency's cyber security-related affairs' (Art. 23). A failure to formulate, implement or report on the maintenance plan draws, under Article 30, 'a fine of not less than NT$100,000 and not more than NT$5,000,000 ... for each violation.'

Article 15 of the Telecommunications Management Act requires that 'Telecommunications enterprises who have established a PSTN using telecommunications resources or other telecommunications enterprises announced by the competent authority shall draw up an info-communications security maintenance plan and implement it accordingly'.

Separately, Article 42 lets the competent authority 'designate the PSTN, in whole or in part, as the critical telecommunications infrastructure,' whose establisher 'shall ... draw up a critical telecommunications infrastructure protection plan' subject to the competent authority's evaluation. Failing the general maintenance-plan duty draws a fine under Article 79 for 'Violating Paragraph 1 of Article 15, where no info-communications security management plan has been drawn up or implemented,'.

Failing the critical-infrastructure protection-plan duty draws a separate, higher fine under Article 76 for a party who 'fails to submit critical telecommunications infrastructure protection plan to the competent authority for approval within the prescribed deadline or fails to implement the approved plan.'

The Regulations are prescribed under Article 24(4) of the Cyber Security Management Act, among other provisions of that Act. Article 24(4) of the Act leaves the necessary items of the reporting and response mechanism, the reporting content and the submission of reports to rules the competent authority prescribes. Article 11(1) of the Regulations requires a specific non-government agency to report a cyber security incident within one hour after becoming aware of it.

Article 13(1) of the Regulations requires a specific non-government agency to complete damage-control or recovery operations within 72 hours of becoming aware of a level 1 or level 2 incident and within 36 hours of becoming aware of a major incident. Article 13(2) of the Regulations requires the agency to submit an investigation, handling and corrective action report within one month after those operations.

The Act defines a specific non-government agency as a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization or institution under control of the government. Article 29 of the Act punishes a specific non-government agency that fails to report an incident under Article 24(2) with a fine of NT$300,000 to NT$10,000,000. The full-text amendment of 5 January 2026 took effect on the date of its issuance.

Article 24 requires every specific non-government agency to 'establish notification and response mechanisms for cyber security incidents,' and, 'When specific non-government agencies become aware of a cyber security incident, they shall notify the central competent authority in charge of the relevant sector of the incident'.

Failing that notification duty draws, under Article 29, 'a fine of not less than NT$300,000 and not more than NT$10,000,000,' escalating for continued non-correction past the ordered deadline.

Article 11(1) of the Act requires a telecommunications enterprise that cannot provide services because of a disaster, a penalty imposed by the competent authority or other major incidents to announce the suspension immediately and to report it to the competent authority by the method the authority prescribes. Article 79 of the Act fines a telecommunications enterprise NT$100,000 to NT$1,000,000 for the violations it lists, with a deadline to correct.

Article 79, item 7, covers a violation of Article 11(1) where no immediate announcement has been made or the notified matters are not true at all. The Act's provisions other than Article 52(3) to (7), Article 54, Article 61, Article 22(3), Article 58(1), Article 60 and the parts of Article 89 about Articles 52 and 54 took effect on 1 July 2020.

The communications and broadcasting competent authority must entrust private organizations with establishing content-protection agencies for children's and juveniles' internet use, and an internet platform provider, defined broadly as any provider of internet platform services including storage space, websites, or web-linking services, must establish self-regulatory norms and adopt clear, feasible protection measures against content harmful to a child's or juvenile's physical and mental health (Article 46).

Where the competent authority for the relevant business notifies a platform provider that its content is harmful or that its protection measures are inadequate, the provider must restrict a child's or juvenile's access or browsing, or remove the content beforehand; a provider that fails to do so is fined NT$60,000 to NT$300,000 and ordered to improve within a set period (Article 94).

Article 46-1 separately prohibits anyone from disseminating or transmitting content harmful to a child's or juvenile's physical and mental health on the internet without taking clear, feasible protection measures or cooperating with a platform's protection mechanisms, in a way that makes the content accessible to a child or juvenile. "Children and juveniles" means persons under eighteen (Article 2).

The Act does not itself prescribe a specific age-verification method, leaving the content-classification system, filtering software, and self-regulatory norms to be developed under the competent authority's protection mechanisms. The sections this entry groups came into force on different days.

Article 9, paragraph 1, subparagraph 4 excludes from copyright protection "oral and literary works for news reports that are intended strictly to communicate facts," so a bare factual news report carries no copyright to begin with. Where a report contains a protected expression, Article 49 lets a person reporting a current event by broadcasting, photography, film, newspaper, or internet exploit, within the scope necessary to the report, whatever work is seen or heard in the course of that event.

Article 61 separately lets a newspaper, magazine, or internet transmission republish, publicly broadcast, or publicly transmit commentary on a current political, economic, or social event that has already appeared in a newspaper, magazine, or on the internet, unless the original publisher has indicated that republishing is not authorized.

Neither provision creates a payment obligation or a registration or designation scheme; each is a copyright exception that either removes the underlying content from protection or permits its republication subject to an opt-out. The Act provides that it takes effect from the date of its promulgation, apart from the exceptions it lists. The last revision of the whole Act was promulgated on 21 January 1998.

Under Article 13 of the Central Regulation Standard Act, a law that takes effect from its promulgation takes effect from the third day counting from the day of promulgation.