What are the BOT AI Risk Management Guidelines?
The Bank of Thailand (BOT) issued Policy Guideline No. BOT.3.5994/2568 on Risk Management for the Use of Artificial Intelligence Systems. The Guidelines help financial institutions use AI responsibly by establishing clear governance, oversight, and risk management practices. It covers two main areas:
- AI Governance: defining the roles and responsibilities of boards and senior management.
- AI Development and Security Controls: managing risks throughout the AI lifecycle, including data, models, monitoring, and security.
The BOT AI Risk Management Guidelines help financial institutions:
- Apply risk management based on the level of AI risk and business impact.
- Use AI in line with the FEAT principles of Fairness, Ethics, Accountability, and Transparency.
- Work alongside existing BOT requirements for IT risk, cybersecurity, data governance, and consumer protection.
The BOT guidelines state that financial institutions should:
- Remain accountable for the use of AI systems and their outcomes.
- Apply the FEAT principles when developing and using AI.
- Manage risks throughout the entire AI lifecycle.
- Protect customers through transparent and fair AI practices.
COMPLIANCE BRIEF
Complying with the Bank of Thailand (BOT) AI Risk Management Guidelines in Thailand
Learn how Thales solutions can help financial institutions in Thailand strengthen controls around sensitive data, AI models, APIs, applications, and AI-driven systems.
How Thales Helps with BOT AI Risk Management Guidelines Compliance?
Thales helps financial institutions in Thailand align with the Data Risks, Model Development and Cybersecurity Controls of the AI Development and Security Controls in the Guidelines.
Bank of Thailand (BOT) Compliance Solutions
Application Security
Protect applications and APIs at scale in the cloud, on-premises, or in a hybrid model. Our market leading product suite includes Web Application Firewall (WAF), protection against Distributed Denial of Service (DDoS) and malicious BOT attacks and security for APIs.
Data Security
Discover and classify sensitive data across hybrid IT and automatically protect it anywhere, whether at rest, in motion, or in use, using encryption tokenization and key management. Thales solutions also identify, evaluate, and prioritize potential risks for accurate risk assessment as well as identify anomalous behavior, and monitor activity to verify compliance, allowing organizations to prioritize where to spend their efforts.
Identity & Access Management
Provide seamless, secure and trusted access to applications and digital services for customers, employees and partners. Our solutions limit the access of internal and external users based on their roles and context with granular access policies and Multi-Factor Authentication that help ensure that the right user is granted access to the right resource at the right time.
Address the BOT AI Risk Management Guidelines - AI Development and Security Controls
How Thales helps:
- Integrate generative machine learning into its discovery engine to understand semantic context.
- Automatically crawl, identify, and catalog data pools across hybrid clouds and on-premises environments before feeding bulk data into an LLM or credit-scoring model. This enables data compliance teams to audit the integrity and diversity of training sets before model ingestion.
How Thales helps:
- Provide Static and Dynamic Data Masking along with Vaultless Tokenization. When sensitive data (such as customer PII or account numbers) is passed to an AI model or commercial chatbot, dynamic masking replaces the sensitive data with tokens or masked hashes in real time.
- Transparently intercept RESTful API calls destined for third-party AI models (e.g., OpenAI or external LLMs) and sanitize the input by stripping or encrypting sensitive values before the text crosses the corporate data boundary.
How Thales helps:
- Provide FIPS 140-2 Level 3 cryptographic security to anchor the cryptographic keys used to sign and lock AI model binaries, as the root of trust for any AI model relies on the integrity of its code and execution parameters.
- Ensure that once an AI model is verified and deployed, its mathematical weights cannot be subtly altered or tampered with by an insider or malicious actor.
How Thales helps:
- Address runtime security for agentic AI and LLMs, the AI Security Fabric serves as a specialized proxy layer between users, enterprise RAG applications, and foundation models.
- Audit the interaction flow and help compliance teams trace exactly how inputs correlate to outputs.
- Provide detailed, auditable file and database access logs that record exactly who, what process, and when an AI engine accesses proprietary corporate knowledge bases. This generates the absolute paper trail required by BOT auditors to evaluate algorithmic transparency and data lineage.
How Thales helps:
- Detect and block malicious prompts in real-time, and prevent leakage of sensitive information from responses.
- Detect anomalies associated with Adversarial Attacks (manipulated structural payloads) and strip away malicious inputs before they can trigger logic flaws in the neural network.
- Inspect API traffic entering AI orchestration layers.
- Isolate legitimate traffic from malicious automated actors and mitigate high-frequency bot injection vectors.
Solutions:
Application Security
How Thales helps:
- Build baseline profiles of normal user and machine behavioral patterns. By mapping behavioral anomalies against the OWASP Top 10 for LLM Applications and MITRE ATLAS parameters, the platform flags indicators of compromise – as automated Model Inversion attempts – before systemic extraction occurs.
Related resources
Other key data protection and security regulations
PCI HSM
MANDATE | ACTIVE NOW
The PCI HSM specification defines a set of logical and physical security compliance standards for HSMs specifically for the payments industry. PCI HSM Compliance certification depends on meeting those standards.
DORA
REGULATION | ACTIVE NOW
DORA aims to strengthen the IT security of financial entities to make sure the financial sector in Europe is resilient in the face of the growing volume and severity of cyber-attacks.
Data Breach Notification Laws
REGULATION | ACTIVE NOW
Data breach notification requirements following loss of personal information have been enacted by nations around the globe. They vary by jurisdiction but almost universally include a “safe harbor” clause.
GLBA
REGULATION | ACTIVE NOW
The Gramm-Leach-Bliley Act (GLBA)--also known as the Financial Services Modernization Act of 1999--requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data.