Thailand Insurance Cybersecurity Rules: What the 2026 OIC Reforms Mean

Why Thailand Insurance Cybersecurity Rules Are Tightening in 2026

Thailand’s insurance sector has digitised quickly. Policies are sold through apps, claims are processed in the cloud, and customer data flows across multiple vendors. As a result, regulators now treat cyber risk as a core prudential concern rather than a back-office IT matter.

The current standard, the OIC Notification on Criteria for Information Technology Risk Governance and Management B.E. 2563 (2020), has governed insurers since 2021. However, the threat landscape has shifted dramatically since then. Ransomware, supply-chain attacks, and AI-driven fraud have all matured, and the OIC’s proposed amendments aim to align Thailand insurance cybersecurity expectations with current international standards.

What the OIC’s Proposed Amendments Cover

The consultation targets the existing IT risk governance notification for both life and non-life insurers. Importantly, the changes affect not only insurance companies themselves but also the external IT auditors who review them. Three themes stand out.

1. Board-Level Accountability for IT and Cyber Risk

Under the proposal, the board of directors must directly oversee data governance, cybersecurity, and the responsible use of artificial intelligence. Moreover, each board should include at least one director with genuine IT knowledge or experience. Companies must also appoint a designated head of security who is accountable for information security across the organisation.

This shift matters because it removes any ambiguity about who owns cyber risk. Therefore, directors can no longer delegate the issue entirely to a vendor or an internal IT team and assume the obligation is met.

2. Stronger Cybersecurity and Data Security Controls

The draft consolidates the previous chapters on IT project management, IT security, and cybersecurity to reduce duplication. In their place, it introduces a tighter set of mandatory controls, including:

• Multi-factor authentication for all material systems
• Data masking and data leakage prevention measures
• Security hardening and web filtering requirements
• Vulnerability assessment and penetration testing at least once a year
• Dedicated controls for mobile application security and API security
• Safeguards for emerging technologies such as cloud computing and post-quantum cryptography
• Source code review for in-house and outsourced development

In addition, the revised cybersecurity framework follows a familiar lifecycle of identify, protect, detect, respond, and recover. This structure mirrors the internationally recognised NIST Cybersecurity Framework, which gives multinational insurers a useful reference point for aligning their global and Thai compliance programmes.

3. AI Governance and Data Quality

Notably, the OIC extends board oversight to the responsible use of AI. Insurers increasingly use machine learning for underwriting, pricing, and fraud detection, and the regulator wants clear accountability for how these systems handle customer data. Consequently, companies will need documented policies, defined committees, and data quality controls that support both governance and explainability.

Thailand’s regulators are taking a consistent line on emerging technology across sectors. For broader context on how Thai institutions are approaching automated systems, see our analysis of artificial intelligence in Thai courts.

Who Is Affected by the New Thailand Insurance Cybersecurity Framework

The amendments apply broadly across the insurance value chain. Specifically, the directly affected parties include:

• Life insurance companies licensed and operating in Thailand
• Non-life insurance companies, including foreign-owned and branch operations
• External IT auditors engaged to assess insurer compliance
• InsurTech and technology vendors whose platforms support regulated insurers

For foreign investors, the practical message is clear. Cyber and data compliance is now a condition of doing insurance business in Thailand, and weak controls can translate into regulatory exposure, reputational damage, and disrupted operations.

Practical Steps to Prepare for the 2026 Rules

Although the framework is still in consultation, insurers should not wait for final publication in the Royal Gazette to begin. Instead, forward-looking firms can take concrete steps now:

• Review board composition. Confirm that at least one director holds credible IT or cybersecurity experience, and document how the board supervises cyber risk.
• Appoint or confirm a head of security. Define the role, reporting line, and authority clearly.
• Run a controls gap analysis. Benchmark current practice against the draft requirements, especially multi-factor authentication, penetration testing, and data leakage prevention.
• Map your data and AI use. Identify where customer data sits, who can access it, and which automated systems rely on it.
• Tighten vendor contracts. Ensure cloud providers and InsurTech partners can meet the same standards your firm is now expected to uphold.

How These Rules Fit Thailand’s Wider Compliance Landscape

The OIC initiative does not stand alone. Rather, it reflects a broader regulatory push across Thailand to strengthen digital governance, data protection, and platform accountability. Sector regulators are increasingly coordinating on cyber and data standards, which raises the baseline for every regulated business.

Insurers should therefore read these amendments alongside parallel developments, such as Thailand’s tightening rules for digital operators discussed in our guide to the Thailand digital platform competition law. Viewed together, these reforms signal a clear direction of travel toward stricter accountability for any firm that holds significant volumes of customer data.

Official guidance and consultation materials are published by the Office of Insurance Commission, which remains the primary regulator for the sector.

Frequently Asked Questions