Andreas Richter (Senior Partner) and Naddawan Oulansakoonchai (Associate)
The rapid integration of artificial intelligence (“AI”) into the modern workplace has fundamentally transformed how businesses operate, from automating routine tasks to generating complex work products. While AI offers significant gains in efficiency and productivity, its adoption also introduces a range of legal risks that employers in Thailand must carefully navigate. Issues relating to data privacy, intellectual property ownership, and potential criminal liability are no longer hypothetical — they are present-day concerns that demand proactive legal strategies. This advisory provides an overview of the key employment-related legal risks arising from AI use in the workplace and outlines practical safeguards that employers should implement to protect their organizations.
1. Key Legal Risks of AI Use in the Workplace
When employees utilize AI tools in the course of their duties, several categories of legal risk may arise. Employers should be aware of the following principal areas of concern:
Data Privacy under the PDPA
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) imposes strict obligations on organizations regarding the collection, use, and disclosure of personal data. When employees input client data, employee records, or other personal information into AI systems — whether cloud-based generative AI platforms or internally deployed tools — there is a material risk that such data may be exposed to unauthorized third parties or used by AI service providers to further train their models. Such unauthorized disclosure or secondary use of personal data may constitute a violation of the PDPA, potentially exposing the employer to regulatory sanctions, civil liability, and reputational harm.
Intellectual Property
The use of AI in the workplace raises significant intellectual property (“IP”) concerns. First, questions arise regarding the ownership of content generated by or with the assistance of AI. Specifically, whether such output qualifies for copyright protection and, if so, who the rightful owner is. Second, there is an inherent risk that AI-generated content may unintentionally reproduce or incorporate elements of third-party copyrighted works, thereby exposing the employer to claims of copyright infringement. These risks are particularly acute where employees rely on AI outputs without conducting adequate review or verification.
Criminal Liability
The misuse of AI tools by employees may also give rise to criminal liability. For example, the use of AI to generate or manipulate information for the purposes of fraud, forgery, or defamation may constitute criminal offenses under the Thai Criminal Code and the Computer Crime Act B.E. 2550 (2007), as amended. Employers should be mindful that, depending on the circumstances, organizational liability may also be attached where adequate preventive measures have not been implemented.
2. Why Every Company Needs an AI Policy
Given the legal risks outlined above, the implementation of a comprehensive AI usage policy is no longer optional but an essential requirement. A well-drafted AI policy serves three critical functions:
Defining Clear Boundaries
An AI policy should clearly specify which AI tools and platforms are approved for use within the organization and which are prohibited. By establishing these boundaries, employers can maintain control over the technology environment and reduce the risk of employees using unapproved or insecure AI applications that may compromise data security or regulatory compliance.
Ensuring Security and Ethical Use
The policy should expressly prohibit the input of confidential, proprietary, or personal data into external AI systems. Additionally, it should require employees to verify and critically review all AI-generated outputs before incorporating them into any work product, client deliverable, or business communication. This safeguard is essential to mitigate the risks of inaccuracy, bias, and unintended IP infringement.
Establishing a Disciplinary Basis
A formally adopted AI policy provides the employer with a clear and enforceable basis for disciplinary action in the event of employee non-compliance. Under Thai labor law, work rules and company policies that have been properly communicated to employees may serve as the foundation for lawful disciplinary measures, including warnings, suspension, or termination of employment in cases of serious violation.
3. AI Clauses in Employment Agreements: Why They Matter
In addition to implementing a standalone AI policy, employers should consider incorporating specific AI-related provisions directly into their employment agreements. There are three compelling reasons for doing so:
Clarity from the Outset
The employment agreement is the primary legally binding document governing the relationship between employer and employee. By including an AI clause at the point of hire, employers ensure that employees are aware of their obligations regarding AI use from the very beginning of the employment relationship. This proactive approach minimizes the potential for disputes and misunderstandings at a later stage.
Assignment of Rights
An AI clause should clearly stipulate that any work product created by the employee through the use of AI tools, utilizing the company’s resources, systems, or proprietary information, shall be the exclusive property of the employer. Without such a provision, the default position under Thai copyright law may leave the employer without full ownership rights over AI-assisted work product, as discussed further in Section 4 below.
Duties and Liability
The employment agreement should address the allocation of liability in circumstances where an employee’s use of AI results in infringement of third-party rights or other harm. Specifically, the clause may provide that the employee shall be required to share liability with, or indemnify, the employer for any damages arising from the employee’s unauthorized, negligent, or improper use of AI tools in the course of employment.
4. Who Owns the Copyright in AI-Generated Work?
The question of copyright ownership in AI-generated work is one of the most complex and evolving issues in this area. Under current Thai law, the analysis depends on the degree of human involvement in the creative process:
AI as the Creator
Under the existing legal framework, AI is not recognized as a legal person and therefore cannot hold or be vested with copyright. Work that is generated entirely and autonomously by AI, without meaningful human creative input, may fall outside the scope of copyright protection altogether.
The Employee as the Creator
Where an employee uses AI merely as a “tool” — for example, by crafting detailed and complex prompts, exercising professional judgment in selecting and curating outputs, and substantially revising or refining the AI-generated content — the resulting work may be considered a product of the employee’s own skill and creative effort. In such cases, copyright may vest in the employee as the author of the work.
The Employer as the Owner
Under Section 9 of the Thai Copyright Act B.E. 2537 (1994), a work created by an employee in the course of employment is owned by the employee, unless otherwise agreed in writing. This default position means that, absent a clear contractual provision to the contrary, the employer may not automatically obtain full ownership rights over AI-assisted work created by its employees — even where such work was produced using the employer’s resources and during working hours.
Key Takeaway
If the employment agreement does not expressly address the ownership of AI-generated or AI-assisted work product, the employer risks losing valuable IP rights. It is therefore essential that employment agreements contain clear and comprehensive provisions assigning all rights in such work to the employer.
5. Our Recommendations
We recommend that employers take the following steps to manage the legal risks associated with AI use in the workplace:
- Implement a Comprehensive AI Usage Policy. Develop and formally adopt a company-wide AI policy that clearly defines approved and prohibited AI tools, sets out rules for data handling, and establishes protocols for the review and verification of AI-generated outputs. A company AI policy that defines clear boundaries, ensures security and ethical use, and establishes a disciplinary basis serves as an essential complementary instrument to the employment agreement, reinforcing the employer’s ownership position and creating a documented framework within which all AI use by employees takes place.
- Include AI-Specific Clauses in Employment Agreements. The employment agreement is the primary legally binding document between employer and employee, and that including an AI clause ensures clear obligations from the very beginning of the employment relationship. Therefore, incorporate provisions addressing AI use, IP ownership, confidentiality obligations, and liability allocation into all new and, where practicable, existing employment agreements. We note that any amendment of an existing employment agreement requires the consent of the employee affected by such amendment.
- Address Intellectual Property Ownership Clearly. Ensure that employment agreements contain express written assignments of all rights, including copyright, in work product created with the assistance of AI tools, to override the default position under Section 9 of the Thai Copyright Act.
- Train Employees on Proper AI Use. Conduct regular training sessions to educate employees on the company’s AI policy, the legal risks associated with AI use, and best practices for using AI tools responsibly and in compliance with applicable laws.
- Review and Update Policies Regularly. As AI technology and the regulatory landscape continue to evolve, employers should periodically review and update their AI policies and contractual provisions to ensure they remain current and effective.
For further information or assistance in developing AI policies, drafting AI-related employment provisions, or addressing any of the legal issues discussed in this advisory, please do not hesitate to contact our Employment and Labor team at Blumenthal Richter Sumet & Schuler. We are committed to helping our clients navigate the evolving intersection of artificial intelligence and employment law with confidence and clarity.
人工智能（AI）在办公场景下的应用： 新兴劳动用工风险与实务防范措施
人工智能（“AI”）正迅速融入现代工作场所，从自动化处理日常任务到生成复杂工作成果，已从根本上改变企业的运营方式。尽管 AI 能显著提升效率和生产力，但同时也带来了多方面的法律风险，在泰国的雇主对此应当谨慎应对。与数据隐私、知识产权归属以及潜在刑事责任相关的问题，早已不再只是理论上的假设，而是在当下切实存在、需要通过前瞻性法律策略加以应对的现实问题。本文旨在概述工作场所使用 AI 所引发的与劳动用工相关的法律风险，并提出雇主应采取的实务防范措施，以保护其利益。
1. 工作场所使用 AI 的主要法律风险
当员工在工作过程中使用 AI 工具时，可能会引发若干类别的法律风险。雇主应重点关注以下几个方面：
（1）《个人数据保护法》（PDPA）项下的数据隐私风险
泰国《个人数据保护法》B.E. 2562（2019）（“PDPA”）对组织在收集、使用和披露个人数据方面设定了严格的法律义务。当员工将客户数据、员工档案或其他个人信息输入 AI 系统时，无论是基于云端的生成式 AI 平台，还是企业内部部署的工具，都存在实质性风险，即相关数据可能暴露给未经授权的第三方，或被 AI 服务提供商用于进一步训练其模型。此类未经授权披露或对个人数据的二次使用，可能构成对 PDPA 的违反，从而使雇主面临监管处罚、民事责任以及商誉损害。
（2）知识产权风险
在工作场所使用 AI 会带来重大的知识产权（“IP”）问题。首先，AI 生成或在 AI 辅助下形成的内容，其权利归属存在疑问：此类成果是否享有著作权保护；若享有，其合法权利人是谁。其次，AI 生成内容存在固有风险，即可能在无意中复制或纳入第三方享有著作权作品的元素，从而使雇主面临著作权侵权主张。若员工在未进行充分审查或核验的情况下直接依赖 AI 输出，上述风险尤为突出。
（3）刑事责任风险
员工不当使用 AI 工具还可能引发刑事责任。例如，利用 AI 生成或篡改信息，以实施欺诈、伪造或诽谤等行为，可能构成泰国《刑法典》及经修订的《计算机犯罪法》B.E. 2550（2007）项下的刑事犯罪。雇主还应注意，在某些情况下，如未建立充分的预防措施，组织本身也可能承担相应的刑事责任。
2. 为什么要制定企业内部的 AI 使用制度
鉴于上述法律风险，制定并实施一套全面的 AI 使用制度，已不再是可有可无的选择，而是企业合规管理中的必要要求。一份完善的 AI 使用制度应当至少具备以下三项关键功能：
（1）明确使用范围
AI 使用制度应明确规定组织内部获准使用的 AI 工具和平台，以及被禁止使用的工具和平台。通过划定这些边界，雇主能够对技术环境保持控制，并降低员工使用未经批准或不安全的 AI 应用程序、进而危及数据安全或监管合规的风险。
（2）确保安全与符合职业道德的使用
该制度应明确禁止将保密信息、专有信息或个人数据输入外部 AI 系统。此外，制度还应要求员工在将任何 AI 生成内容纳入工作成果、客户交付文件或业务沟通之前，必须对其进行核验和审慎审查。此项防范措施对于降低内容的不准确性、偏见以及非故意知识产权侵权的风险至关重要。
（3）建立纪律处分依据
正式采纳的 AI 使用制度，可在员工违反规定时，为雇主采取纪律处分提供清晰且可执行的依据。根据泰国劳动法，已适当传达给员工的工作规则和公司政策，可以作为合法的惩戒措施的基础，包括警告、停职，或在严重违规情况下解除劳动关系。
3. 劳动合同中的 AI 条款的重要性
除制定独立的 AI 使用制度外，雇主还应考虑在劳动合同中直接纳入与 AI 相关的具体条款。这样做主要有以下三个重要原因：
（1）提前明晰义务
劳动合同是规范雇主与员工关系的首要法律约束文件。通过在入职时即纳入 AI 条款，雇主可以确保员工自劳动关系开始之初便清楚知悉其在 AI 使用方面的义务。此种前置性安排有助于最大限度减少后续争议和误解。
（2）权利归属安排
AI 条款应明确约定：员工利用 AI 工具，并使用公司资源、系统或专有信息所创作的任何工作成果，其专属所有权均归雇主所有。若无此类约定，根据泰国著作权法的默认规则，雇主可能无法对 AI 辅助形成的工作成果享有完整所有权，详见下文第 4 节。
（3）职责与责任分配
劳动合同还应处理以下情形下的责任分配：即员工使用 AI 导致侵犯第三方权利或造成其他损害。具体而言，合同条款可约定，如员工在履职过程中未经授权、存在过失或不当使用 AI 工具，由此产生的损害，员工应与雇主承担共同连带责任，或对雇主进行赔偿。
4. AI 生成作品的著作权归谁所有？
AI 生成作品的著作权归属问题，是该领域中最复杂且仍在持续发展的议题之一。根据现行泰国法律，其判断取决于人在创作过程中的参与程度：
（1）AI 作为创作者
根据现行法律框架，AI 并不被承认为法律主体，因此不能持有或被赋予著作权。完全由 AI 自主生成、且没有实质性人类创作投入的作品，可能根本不属于著作权保护范围。
（2）员工作为创作者
如果员工仅将 AI 作为一种“工具”使用——例如，通过设计详细而复杂的提示词，对输出结果进行专业判断、筛选与整理，并对 AI 生成内容作出实质性修改或完善——则最终作品可能被认定为员工自身技能与创造性劳动的成果。在此情况下，著作权可能归属于作为作者的员工。
（3）雇主作为权利人
根据泰国《著作权法》B.E. 2537（1994）第 9 条，员工在受雇过程中创作的作品，原则上归员工所有，除非双方另有书面约定。该默认规则意味着：如果没有明确相反的合同约定，雇主未必能够自动取得其员工创作的 AI 辅助作品的完整所有权，即便该作品系在工作时间内、利用雇主资源完成。
（4）关键提示
如果劳动合同未明确约定 AI 生成或 AI 辅助工作成果的权利归属，雇主就有失去重要知识产权的风险。因此，在劳动合同中纳入清晰且完整的条款，约定将此类作品的全部权利归属于雇主，具有重要意义。
5. 我们的建议
我们建议雇主采取以下措施，以管理工作场所使用 AI 所带来的法律风险：
（1）制定并实施全面的 AI 使用制度
制定并正式采纳适用于全公司的 AI 使用制度，明确界定获准和禁止使用的 AI 工具，规定数据处理规则，并建立 AI 生成内容的审查和核验流程。一项明确边界、保障安全和伦理使用、并构成纪律处分依据的公司 内部AI 使用制度，可作为劳动合同的重要补充工具，强化雇主的权利归属主张，并为员工使用 AI 建立有据可查的制度框架。
（2）在劳动合同中纳入 AI 专门条款
劳动合同是雇主与员工之间最主要的法律约束文件，在其中加入 AI 条款，有助于自劳动关系开始之初即明确员工义务。因此，应在所有新的劳动合同以及在可行情况下的现有劳动合同中，纳入有关 AI 使用、知识产权归属、保密义务和责任分配的条款。需注意的是，对现有劳动合同作出任何修订，均须取得受该等修订影响的员工的同意。
（3）明确知识产权归属安排
确保劳动合同中包含明确的书面权利转让条款，将借助 AI 工具创作的工作成果所涉全部权利（包括著作权）自动转让给雇主，以排除泰国《著作权法》第 9 条项下的默认适用。
（4）对员工进行规范使用 AI 的培训
定期开展培训，使员工了解公司的 AI 政策、使用 AI 所涉及的法律风险，以及在符合法律要求前提下如何在工作实践中负责任且更好地使用 AI 工具。
（5）定期审查并更新政策
随着 AI 技术和监管环境持续发展，雇主应定期审查并更新其 AI 使用制度及相应的劳动合同条款，确保其始终保持最新且切实有效。
如需进一步了解相关信息，或需要协助制定 内部AI 制度、起草与 AI 相关的劳动合同条款，或处理本文所讨论的任何法律问题，欢迎随时联系 Blumenthal Richter Sumet & Schuler 的劳动与雇佣法团队。我们致力于帮助客户以清晰、稳健的方式，应对人工智能与劳动法交叉领域不断演变的各种挑战。
