Indonesia’s AI Regulation and the Risk Your Vendor Can't Manage

Preparing for Indonesia's New AI Regulations 

Indonesia is expected to issue two presidential regulations on artificial intelligence this year, a National AI Roadmap and an AI Ethics Regulation that classifies AI systems by risk level. For organizations adopting AI, the message is simple. Responsibility will increasingly fall on those deploying AI, not just those building it. 

The ethics regulation reflects what researchers call human-centered, ethical, and responsible AI: keeping AI under human control, holding it to standards of fairness and transparency, and making someone accountable when it fails. In practice, that accountability often sits with the organization using the system. 

Accountability runs the length of the chain, from the data provider to the organization that deploys and runs the system. 

From Model Safety to System Risk: What Vendor Frameworks Don’t Cover 

A vendor's AI safety framework can provide assurance about the model itself. It does not necessarily address the risks that arise when that model is integrated into business processes. That distinction becomes relevant under a risk-based regulatory approach. 

OpenAI's Frontier Governance Framework is a good example. OpenAI developed it to meet new requirements in California and the European Union, and it explains how the company assesses severe risks before releasing a model. But it only governs OpenAI's models. It says nothing about how those models behave once they are running a credit approval process, a hospital triage system, or part of the power grid. 

A model can appear safe in testing and still create new risks once it is connected to real systems. The judgment that a model is safe enough is also made by the vendor, on its own review of the evidence. That is useful, but for users it remains an assurance rather than an independent guarantee. 

What Experts Estimate About AI Risk 

A recent study from MIT puts numbers on the concern. Surveying 272 experts across 37 countries, it found that eighteen of twenty-four AI risks carried more than a one-in-ten chance of catastrophic harm within five years. These are expert estimates rather than forecasts, but they suggest that many of the people closest to the technology do not consider the risks fully understood or controlled. 

Another finding concerns how risk and responsibility are distributed. Users and the public were judged the most exposed to harm, while primary responsibility for managing it sits with developers and regulators. Deployers, infrastructure providers, and users themselves also carry a meaningful share. 

Three separate sources point to the same sectors. The MIT study, Indonesia's vital-infrastructure framework under Presidential Regulation 82 of 2022, and the government's own AI roadmap all identify finance, healthcare, energy, information and communication technology (ICT), and government services as areas where AI failures could have wider consequences. 

When many critical sectors rely on the same foundation model, that model becomes a single point of dependency for all of them. 

Why AI Governance Can't Stop at Development 

A common argument is that responsibility should sit mainly with developers because regulation often trails technological change. There is some basis for this view. For the most severe risks, action at the developer level may be the most effective safeguard. 

However, many risks emerge only at the point of deployment. 

A credit-scoring model can produce discriminatory outcomes. A fraud filter can drift over time. A diagnostic tool can underperform for certain groups. An employee can paste sensitive records into a public chatbot. These issues emerge from the interaction between models, data, business processes, and users. 

Accountability Already Exists 

The absence of a dedicated AI law does not mean organizations are without obligations. Data-protection requirements, sector regulations, board-level accountability, and, for critical sectors, Presidential Regulation 82 of 2022 already apply. 

The AI Ethics Regulation is expected to classify systems into low-risk, high-risk, and unacceptable-risk categories. High-risk systems are expected to include AI that uses personal data or significantly affects rights, safety, or essential services. Responsibility is expected to extend across the chain from data provider to system operator . 

A bank using AI to assess creditworthiness would likely fall within the high-risk category. The regulation may not introduce penalties of its own, but enforcement can still occur through existing data-protection, financial-sector, and industry-specific rules that already carry sanctions. 

Putting Responsible AI into Action