AI Regulation: Who Should Bear the Risk Management Burden, Model Developers or Businesses?
California’s SB 53 took effect on 1 January 2026.
Reading the statute reveals a very high threshold. A frontier model must be trained using more than 1026 computational operations, counting both integer and floating-point operations, rather than FLOPs alone.
The annual revenue threshold of more than US$500 million identifies a large frontier developer. It counts the combined gross revenues of the developer and its affiliates in the preceding calendar year. Some obligations under the law therefore extend beyond developers that meet this revenue threshold.
Large frontier developers must publish and comply with a framework for managing catastrophic risks. Critical safety incident reporting applies to frontier developers more generally. They must report to the state’s Office of Emergency Services within 15 days of discovering an incident. Where there is an imminent risk of death or serious physical injury, they must report within 24 hours to an authority with appropriate jurisdiction, as required by law.
A large frontier developer that fails to comply with the relevant provisions may face a civil penalty of up to US$1 million per violation. Only the state Attorney General may bring the civil action to recover that penalty.
That sounds severe, but these thresholds target a specialised group of frontier model developers. They do not encompass ordinary businesses that simply purchase an AI system for use.
A business does not become a frontier developer, with the corresponding developer obligations under SB 53, merely by using someone else’s AI. Its obligations under other applicable laws must still be considered.
A central idea of this law is to address catastrophic risks arising at the model level by regulating developers upstream.
Now let us turn to Thailand’s draft approach.
The draft principles opened for consultation by ETDA take an approach based on risk. Uses that fall within the relevant scope may carry obligations to assess risks, monitor impacts and implement measures to reduce risks. Their precise scope will depend on the version of the draft and the rules that follow.
However, ETDA’s July 2026 presentation describes duties of care for developers, providers, deployers and users, according to their respective roles. It also discusses enforcement concerning cross-border services. We therefore cannot conclude that the Thai draft regulates only downstream users or that foreign providers will have no obligations.
For public agencies, provisions concerning ethical impact assessments and registration of AI use must be checked against the relevant draft and rules before being described as legal obligations. The existence of assessment guidance or tools does not mean that every requirement is already legally binding.
Take a Thai hospital that buys AI to assist with interpreting medical images. If that use falls within the scope of a future law, the hospital may need to assess risks in the clinical setting, monitor results and arrange appropriate human oversight.
These burdens can arise even though the hospital did not build the model. But comparing just two laws cannot establish that its legal duties exceed those of the American company that built it. All laws applicable to each party must be considered.
I understand the reasoning. Even when Thai businesses do not build the model, they choose whom to use AI on, which decisions it should support and how closely people should review its outputs. Some risks arise from downstream use as well.
Still, the costs of assessment and monitoring will fall on Thai businesses using AI. If users bear responsibilities beyond what they can control, while model developers are not required to provide information or help manage model-level risks, the burden may be uneven.
Another law California enacted in the same year was AB 316. It prevents a defendant that developed, modified or used AI from asserting that the AI autonomously caused the harm.
Other arguments remain available, including those concerning causation, foreseeability and the comparative fault of others. The law therefore does not automatically make everyone who uses AI liable whenever harm occurs.
In Thailand, saying that the system made its own decision does not, by itself, resolve the question of liability. The applicable legal rules still require consideration of matters such as intentional or negligent conduct, damage and the causal connection between the conduct and the damage.
Those who choose to use a tool should manage the parts of its use they can control. The liability of developers, providers and users must nevertheless be assessed against the facts and the duties of each party.
I would like to hear your views. How much responsibility should Thai businesses bear for assessing the risks of AI they did not build? And how should the law require foreign providers selling into Thailand to share the burden associated with their models?
I will continue following the draft’s progress and share updates as it develops.
Sarun Amatyakul
Note This article discusses draft principles and information on the development of Thailand’s AI legislation published by ETDA. The draft is not legislation currently in force. Its obligations and scope may change before enactment.