Taiwan’s National Science and Technology Council is telling sector regulators to move from principle to practice under the Artificial Intelligence Basic Act, using the Ministry of Digital Affairs’ July risk-classification framework as a shared vocabulary before a statutory two-year review of incompatible rules kicks in. The push matters for banks, hospitals, and manufacturers that already deploy models but still lack clear audit trails for high-impact decisions.
What the clock requires
The Basic Act, in force since January 14, 2026, names NSTC as the central coordinator and orders ministries to restrict or prohibit AI uses that endanger life, property, social order, or national security under existing laws. Article 18 compels agencies to amend regulations within two years when they conflict with the statute’s human-centric principles, creating a de facto deadline for concrete guidance rather than slide-deck commitments.
MODA’s Risk Classification Framework version 1.0, published July 7, groups applications into three tiers and twenty subcategories but does not by itself bind private firms. NSTC officials have described it as the template ministries must adapt when writing binding rules for finance, health, education, and transportation.
September upgrades
MODA’s Administration for Cyber Security issued an advanced-AI security policy on September 4, establishing a task force to track agentic systems that could automate intrusion steps. Separately, MODA released version 2.0 of its AI impact-assessment guidance on September 30, shifting evaluations toward human-rights outcomes rather than checkbox technical reviews.
Industry lawyers said the combined package signals that Taiwan will regulate deployment context, not model weights, mirroring Brussels’ risk-based approach but without EU-style fines embedded in the Basic Act itself. Penalties will ride on sector statutes such as financial consumer protection or medical device rules.
What companies should do now
Compliance officers at Taipei insurers and hospitals told reporters they are inventorying models that touch underwriting and diagnostic support, mapping each to MODA subcategories even before ministries publish final checklists. Cloud vendors operating Taiwan regions are drafting customer responsibility matrices that allocate logging duties, anticipating government procurement clauses that will require explainability for public-sector chatbots.
Startups warned that overlapping consultations could slow clinical or lending pilots if ministries demand duplicate impact assessments. NSTC has promised a single portal for filing evaluations, but the system is not yet mandatory.
International angle
Taiwan’s chip fabs are exempt from most domestic AI rules when exporting equipment, yet their customers face mounting documentation requests from European and U.S. buyers tracing model governance. NSTC’s timeline therefore doubles as an export competitiveness story: local software and hardware bundles that ship with Taiwanese compliance templates may win orders where buyers fear regulatory surprises.
For the island’s AI industry, 2026 is less about debating whether to regulate and more about whether ministries can publish interoperable rules before the Basic Act’s review window exposes gaps that opposition lawmakers can exploit in budget season.