EveryAILaw.comDoes Artificial Intelligence Basic Act require Risk Assessment?
Taiwan • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 6 specific requirements for Risk Assessment across 1 provision:
- Risk taxonomy — The Ministry of Digital Affairs must promote an AI risk taxonomy and assessment framework interoperable with international standards, and assist sectoral authorities in establishing risk-based management regulations (Article 16(1))
- Sectoral rulemaking — Sectoral competent authorities must establish risk-based management regulations following that taxonomy and assist their industries in formulating guidelines and codes of conduct (Article 16(2))
- High-risk liability — For high-risk AI applications, the government must clarify liability attribution and conditions and establish relief, compensation, or insurance mechanisms; this does not reach pre-application R&D unless tested in a real-world environment or used to provide products or services (Article 17)
- Conforming legal review — Within two years of the effective date, the government must complete the enactment, amendment, or repeal of non-conforming laws, regulations, and administrative measures (Article 18)
- Government use assessment — When using AI to perform duties or provide services, the government must conduct risk assessments, plan response measures, and establish usage guidelines or internal control mechanisms (Article 19)
- Data protection by design — Sectoral authorities, consulting the personal data protection authority, must avoid unnecessary collection, processing, or use of personal data in AI R&D and application and promote data protection by design and by default (Article 14)
Government AI Governance Framework #
A framework act, not a compliance statute. Every operative article directs the state: fund AI development (Arts. 9-10), open government data (Art. 13), protect labour rights (Art. 15), clarify high-risk liability and establish relief or insurance mechanisms (Art. 17), and review all conflicting law within two years (Art. 18). Private-sector obligations arrive later and indirectly, through whatever sectoral regulators issue under Article 16(2) — which is what makes the two-year Article 18 deadline of 2028-01-14 the date to watch. **Open scope question:** on a strict reading of exclusion principle E4 (wrong audience), this Act may belong in `data/exclusions.md` rather than as a tracked instrument, since it creates no private-sector duty. It is retained for now because it is the enabling frame for every future Taiwanese AI rule; revisit when the first Article 16(2) sectoral regulations appear.
Requirements
| Requirement | Details |
|---|---|
| Risk taxonomy | The Ministry of Digital Affairs must promote an AI risk taxonomy and assessment framework interoperable with international standards, and assist sectoral authorities in establishing risk-based management regulations (Article 16(1)) |
| Sectoral rulemaking | Sectoral competent authorities must establish risk-based management regulations following that taxonomy and assist their industries in formulating guidelines and codes of conduct (Article 16(2)) |
| High-risk liability | For high-risk AI applications, the government must clarify liability attribution and conditions and establish relief, compensation, or insurance mechanisms; this does not reach pre-application R&D unless tested in a real-world environment or used to provide products or services (Article 17) |
| Conforming legal review | Within two years of the effective date, the government must complete the enactment, amendment, or repeal of non-conforming laws, regulations, and administrative measures (Article 18) |
| Government use assessment | When using AI to perform duties or provide services, the government must conduct risk assessments, plan response measures, and establish usage guidelines or internal control mechanisms (Article 19) |
| Data protection by design | Sectoral authorities, consulting the personal data protection authority, must avoid unnecessary collection, processing, or use of personal data in AI R&D and application and promote data protection by design and by default (Article 14) |
Penalties
| Violation | Fine |
|---|---|
| None | The Act contains no penalty provision. It directs government action and carries no sanction against private parties |