By James Yang , Executive Assistant to the CEO, Profet AI
For the past few years, one of the most common questions businesses have asked about AI is: “What can AI do?”
As AI evolves from an assistive tool into an AI Agent, however, the questions businesses need to ask are becoming much broader:
What can AI see? What can it access? Whose authority can it act under? And if something goes wrong, can the organization detect it, contain it, and determine who is accountable?
This is why Taiwan’s evolving AI, cybersecurity, and data protection landscape deserves renewed attention in 2026.
In 2025, Taiwan amended the Cyber Security Management Act, which took effect on December 1, 2025. The Personal Data Protection Act was also amended in November 2025. In addition, the Artificial Intelligence Basic Act was passed by the Legislative Yuan on December 23, 2025, and promulgated on January 14, 2026.
These three laws address different areas. The Cyber Security Management Act focuses on information and communication systems and cybersecurity. The Personal Data Protection Act governs the collection, processing, use, and protection of personal data. The Artificial Intelligence Basic Act establishes fundamental principles for AI development and governance in Taiwan.
For enterprises, the key question is not simply “What new regulations have been introduced?”
It is also about understanding the broader governance direction that these regulations are collectively shaping.
As AI becomes embedded in core business processes, cybersecurity, data protection, and AI governance will increasingly converge within the same AI use cases.
From Personal Data and Cybersecurity to AI: Three Layers of Governance
To understand this regulatory shift, it is important to distinguish the roles of the three laws.
The Cyber Security Management Act primarily addresses how information and information and communication systems should be protected. Under the Act, cyber security involves preventing unauthorized access to, use of, control over, disclosure of, damage to, alteration of, or destruction of information and information and communication systems, while maintaining their confidentiality, integrity, and availability.
Its direct scope focuses on government agencies and specific non-government agencies, rather than applying uniformly to every private enterprise.
The Personal Data Protection Act addresses a different layer of risk.
When organizations collect, process, or use personal data, they need an appropriate legal basis and must adopt appropriate security and maintenance measures to protect individuals from improper harm.
The November 2025 amendment further strengthened the institutional framework for personal data protection, including supervisory and inspection mechanisms and the management of personal data security. However, as of the time of writing, the enforcement date of this amendment remains to be determined by the Executive Yuan.
The Artificial Intelligence Basic Act takes the discussion one step further by establishing fundamental principles for AI development and application in Taiwan.
Article 4 sets out seven principles for government promotion of AI:
- Sustainable Development and Well-being
- Human Autonomy
- Privacy Protection and Data Governance
- Cyber Security and Safety
- Transparency and Explainability
- Fairness and Non-discrimination
- Accountability
Taken together, these three laws reveal a clear governance structure:
The Cyber Security Management Act addresses cybersecurity management for entities within its scope. The Personal Data Protection Act governs the collection, processing, use, and protection of personal data. The Artificial Intelligence Basic Act establishes fundamental principles for AI development and application, as well as the direction of future risk governance.
These three layers closely correspond to the challenges enterprises increasingly face as they move from traditional IT environments toward AI Agents.
The Cyber Security Management Act: From IT Protection to Continuous Governance
Taiwan’s 2025 amendment to the Cyber Security Management Act further institutionalized cybersecurity requirements for entities within its scope through mechanisms including responsibility classification, cybersecurity maintenance plans, incident notification and response, audits, and outsourcing management.
In other words, organizations need to answer more than just:
“Do we have a firewall?”
They also need to ask whether they have a cybersecurity governance process that can operate continuously.
This becomes particularly important when a cybersecurity incident occurs. Relevant requirements emphasize incident notification, response, root-cause analysis, and subsequent improvement. Cybersecurity is therefore increasingly becoming part of enterprise operations and risk management—not simply a technical issue.
The arrival of AI Agents makes this challenge even more complex.
Consider a Prompt Injection attack that manipulates an Agent’s decision-making and causes it to deviate from its intended task.
The enterprise then needs to answer questions such as:
- Why did the Agent have this permission?
- Who authorized it?
- What data did it actually access?
- Were its actions fully logged?
- Can the organization immediately restrict or stop it?
These questions are closely related to traditional cybersecurity governance.
The difference is that the enterprise now has another type of actor in its digital environment: an AI Agent capable of acting on behalf of people and systems.
As Enterprises Rely More on Third Parties, Cybersecurity Responsibility Extends Across the Supply Chain
As discussed in our previous article, supply chain security is another area that deserves renewed attention.
For entities covered by the Cyber Security Management Act, requirements related to outsourcing information and communication system construction, maintenance, and information and communication services include selecting appropriate contractors, requiring effective cybersecurity management mechanisms, and defining rights, obligations, and liability for breaches in written contracts.
This reflects a practical reality: an organization’s digital boundary no longer ends at its own data center or internal network.
Today, enterprises may simultaneously rely on cloud services, SaaS platforms, system integrators, third-party APIs, and AI model services.
Once AI Agents are introduced, a seemingly simple application may connect to enterprise knowledge bases, CRM systems, ERP platforms, APIs, and other tools—creating a new form of digital supply chain.
Organizations therefore need to look beyond a simple question such as:
“Does the vendor have a cybersecurity certification?”
They also need to ask:
- What data can third parties access?
- Which tools can an Agent invoke?
- How are API tokens managed?
- How long is data retained?
- How are cybersecurity responsibilities divided when an incident occurs?
The growing focus on SBOM (Software Bill of Materials) can also be understood in this context.
SBOM is an important practical tool for improving transparency and management across the software supply chain. It is therefore more accurate to view SBOM as a tool for implementing and operationalizing governance, rather than describing it as a requirement that the Cyber Security Management Act explicitly imposes on every enterprise.
For enterprises, the more important direction is clear:
Supply chain security increasingly needs to be visible, controllable, and accountable.
This also means that IT outsourcing and AI service adoption should not be evaluated solely by procurement or IT teams. Cybersecurity, legal, data governance, and operational risk should increasingly be part of the same assessment.
The Personal Data Protection Act: From “Having a Policy” to Actually Managing Data
If the Cyber Security Management Act encourages organizations to reconsider “Is our system secure?”, the Personal Data Protection Act raises another fundamental question:
“Do we actually have the ability to manage the personal data we hold?”
The November 11, 2025 amendment further strengthened the supervisory framework for personal data protection, including inspection and security maintenance mechanisms. The amendment also introduced and revised provisions concerning the supervision and management of personal data protection for non-government agencies. Its effective date, however, remains to be determined by the Executive Yuan.
This is particularly relevant to AI adoption.
In a traditional enterprise environment, a data flow might be relatively straightforward:
Employee → CRM → Customer Data
With AI, the flow may become:
Employee → AI Agent → Enterprise Knowledge Base → CRM API → AI Model → Response
As data moves across more systems, models, and tools, organizations need to ask more than whether a database is encrypted.
They need to understand:
- Which data can enter an AI system?
- Which data should never enter it?
- What can third-party model providers access?
- Can an Agent transfer data to another system?
- Can these activities be traced and audited?
This is why AI Governance cannot be completely separated from Data Governance.
If enterprises want AI to become part of their core operations, data classification, access control, purpose limitation, retention, transmission, and access logging need to be considered from the beginning—not added as a privacy layer after the AI system goes live.
The Artificial Intelligence Basic Act: Establishing a Common Language for AI Governance
Among the three laws, the Artificial Intelligence Basic Act represents one of the most significant developments for Taiwan’s AI ecosystem in 2026.
The Act was passed by the Legislative Yuan on December 23, 2025, and promulgated on January 14, 2026. Its objectives include promoting human-centered AI research and development, fostering AI industry growth, building a secure AI application environment, protecting fundamental rights, and strengthening Taiwan’s international competitiveness.
Its significance lies in establishing a common set of governance principles for AI development and application in Taiwan.
Article 4 identifies seven principles, including human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability.
For example, the principle of Human Autonomy emphasizes human oversight.
Privacy Protection and Data Governance highlights data minimization and the prevention of data leakage.
Cyber Security and Safety calls for cybersecurity safeguards to ensure the robustness and security of AI systems.
And Accountability emphasizes corresponding internal governance and external social responsibility.
The direction is becoming even more concrete.
On July 7, 2026, Taiwan’s Ministry of Digital Affairs established the AI Risk Taxonomy and Assessment Framework, effective immediately. The framework is intended to support government agencies and sectoral authorities in identifying, assessing, and responding to AI risks, as well as developing risk-based management requirements.
For enterprises, this signals an important transition:
AI governance is gradually moving from shared principles toward more concrete, risk-based management approaches tailored to specific applications and industries.
This direction is especially important as more enterprises adopt AI Agents.
The greater the degree of autonomy an AI system has, the more mature the organization’s governance capabilities need to become.
When AI Agents Enter the Enterprise, Three Laws Converge in One Use Case
Consider a company deploying a customer service Agent.
The Agent can access customer information in a CRM system, search the enterprise knowledge base, check order status, and even execute certain service processes through APIs.
From a product perspective, this is an AI application designed to improve customer service efficiency.
From a governance perspective, however, it involves three different layers of risk.
First, if the enterprise falls within the scope of the Cyber Security Management Act, issues such as accounts, permissions, system access, monitoring, incident response, and outsourcing may fall within applicable cybersecurity management requirements.
Second, the Personal Data Protection Act raises questions about whether customer information in the CRM can be processed in this way, whether the data is appropriately protected, and whether it is transferred to other services.
Third, the Artificial Intelligence Basic Act provides a broader governance direction, including data governance, cybersecurity measures, human oversight, and accountability.
From an enterprise governance perspective, these three laws can therefore be understood as three interconnected layers:
System Security Data Governance AI Governance
As AI Agents enter core business processes, mature organizations should consider these risks when designing the AI architecture itself—not after the system has already been deployed.
Eight Questions Enterprises Can Use for Self-Assessment
Faced with rapidly evolving regulations and AI technologies, enterprises do not necessarily need to build a highly complex governance framework from day one.
A more practical approach is to begin with eight fundamental questions:
1. Which requirements apply to us?
Which are legal obligations, and which are regulatory guidance, industry standards, or internal governance requirements?
2. What are our critical assets?
Which data and systems are the organization’s most important assets to protect?
3. Who can access them?
Beyond employee accounts, which AI Agents can access these assets?
4. What can each Agent do?
What data can each Agent read, modify, or act upon?
5. Where does the data go?
What data can the organization’s LLMs, cloud services, SaaS platforms, and APIs access or process?
6. Can we see what the Agent is doing?
Can the organization trace which data an Agent accessed, which tools it invoked, and which actions it performed?
7. Can we stop it in time?
When an Agent behaves unexpectedly, can the organization immediately restrict or revoke its permissions?
8. Does management have visibility into the risk?
Are AI risks incorporated into enterprise governance, or do they remain technical documentation owned solely by the IT team?
Ultimately, these eight questions are asking whether an organization can truly:
See it. Control it. Trace it.
If the answer is no, successfully deploying AI does not necessarily mean the organization is ready for AI to scale into its core operations.
From Compliance to Business Strategy: Building Trusted AI Capabilities
The value of regulation is not simply to help organizations avoid penalties.
More importantly, regulation encourages organizations to reconsider operational risks that may previously have been overlooked.
As enterprises increasingly depend on cloud services, APIs, AI models, and Agents, the relationships among data, systems, vendors, and people are becoming more complex.
This is particularly relevant to manufacturing.
AI Agents may eventually become part of processes across the manufacturing environment, where they interact with engineering data, equipment information, operational systems, and frontline know-how.
Once AI moves beyond providing recommendations toward executing tasks, enterprises need to address data governance, permissions, workflows, cybersecurity, and human oversight as part of the same operational architecture.
AI Governance should therefore become part of enterprise operational capability from the moment the AI architecture is designed.
Organizations need mechanisms covering the full lifecycle—from AI development and permission configuration to data access, tool usage, execution monitoring, incident response, and lifecycle management.
From “Should We Adopt AI?” to “Can We Operate AI with Trust?”
In 2026, the questions enterprises ask about AI are changing.
Yesterday, the question was:
“Can AI improve our efficiency?”
Today, it is increasingly becoming:
“Can AI safely enter our core operations?”
From the cybersecurity governance and outsourcing requirements under the Cyber Security Management Act, to data protection and security requirements under the Personal Data Protection Act, and the principles of human autonomy, data governance, cybersecurity, transparency, and accountability established by the Artificial Intelligence Basic Act, Taiwan’s enterprises are facing more than a series of individual regulatory updates.
A broader AI Governance environment is taking shape—one where cybersecurity, data protection, and AI governance increasingly intersect.
For enterprises, the real question may not be whether to add another compliance checklist.
It is whether they can build an operating model in which AI can be trusted, monitored, controlled, and held accountable.
As AI evolves from a tool into an actor within enterprise workflows, organizations need more than increasingly capable models.
They need more mature governance capabilities.
Compliance is not the destination of AI adoption. It is the starting point for building trusted AI operations.
