Picture a claims officer in Makati pasting a customer’s medical file into a free chatbot to draft a rejection letter before lunch. Upstairs, her CEO signs off on a market-entry plan stitched together by the same kind of tool. Nobody has told either of them what is allowed, because in most Philippine companies, nobody has decided.

That, in short, is the paradox laid bare in Gobi Partners’ Solo Horizons: Redefining Scale for the Philippine AI Economy Report 2026, the same study behind the country’s one-founder, many-agents startup thesis. The Philippines leads the ASEAN-6 in knowledge-worker AI adoption. It also runs one of the region’s thinnest governance regimes, both inside companies and in law.

Also Read: The Philippines uses AI as a burnout shield; Singapore uses it for deep work

Enthusiasm is not the problem. The problem is that usage has sprinted ahead of the rules meant to make it safe, and the gap is now wide enough to swallow customer data, source code and, sooner or later, somebody’s legal liability.

Everyone is using AI. Almost nobody wrote the rules

Microsoft and LinkedIn survey data cited in the report puts AI use among Philippine knowledge workers at 86 per cent, against a global average of 75 per cent, from a workforce that already uses AI very differently from Singapore’s. At the top, 80 per cent of chief executives say they are comfortable making major strategic calls on AI-generated insight. The global figure is 64 per cent.

Now look at the other column. The report finds 72 per cent of Philippine enterprises have no formal AI ethics framework or usage policy, and 38 per cent give AI ethics no consideration at all. More than half of leaders (55 per cent) concede they have no documented implementation roadmap.

Employees, predictably, have filled the vacuum themselves. Some 83 per cent of Filipino AI users say they bring consumer tools such as ChatGPT, Claude and Gemini to work, often feeding in customer records, financial projections and source code with no guarantee of where that data ends up.

Banning the tools rarely helps; shadow AI tends to burrow deeper when companies try. The stakes are also higher here than in most markets. The country’s 1.89 million BPO workers handle other people’s data for a living, and the industry is already struggling to reskill them fast enough. One leaked offshore client file, pasted into a personal chatbot account, is the kind of incident that sends contracts elsewhere.

A 2012 privacy law is doing a 2026 job

At the national level, there is no AI statute. Regulators lean on a patchwork of laws written long before large language models existed, according to legal analysis by Gorriceta Africa Cauton & Saavedra in the report.

The Data Privacy Act of 2012 does the heavy lifting. National Privacy Commission rules require registration of systems that run automated profiling, and a 2024 advisory demands transparency and meaningful human intervention in automated decisions. The Cybercrime Prevention Act, the Civil Code, the Consumer Act and the Intellectual Property Code apply only awkwardly. AI has no legal personality, so pinning fault for a model’s error remains unresolved, and the IP code offers no safe harbour for text and data mining, a real headache for startups training on local data.

Also Read: Why Southeast Asian enterprises need AI governance before scaling generative AI

Policy has not been idle so much as scattered. The Department of Trade and Industry’s National AI Strategy Roadmap 2.0, launched in July 2024, sets out four pillars and 30 tasks, yet the AI and Data Ethics Oversight Committee it envisaged has still not been formed. In Congress, 26 separate House bills propose versions of an AI development and regulation act, from a lightweight advisory council to a standalone AI Commission.

Sector regulators have patched the holes on their own. The Bangko Sentral ng Pilipinas has issued voluntary AI risk guidance for financial institutions, and the Commission on Elections has moved to penalise malicious deepfakes during campaigns. Useful, but piecemeal, and part of a regulatory patchwork that founders across the region already know too well.

Singapore tests, Vietnam legislates, Manila deliberates

The neighbours have picked their lanes. Singapore pairs public investment with practical tools such as AI Verify, an open-source framework for testing model transparency and fairness, and the Monetary Authority of Singapore has added safeguards for AI agents in finance. Vietnam went the other way, with a binding, risk-tiered AI law modelled on the EU’s that took effect in March 2026.

Further north, South Korea’s AI Basic Act came into force in January 2026 with mandatory safety audits for high-risk systems, while Japan’s 2025 AI Promotion Act relies on non-binding guidance. AI governance across the region is moving from promises to proof, but there is a cautionary footnote. The report notes that the EU itself has pushed its high-risk obligations back to December 2027. Hard law written too early can age badly.

For the Philippines, the question is less which model to copy than whether to choose one at all. Twenty-six bills is not a debate; it is a backlog.

The fix starts in the office, not in Congress

The report’s prescriptions are sensible, if hardly surprising. Companies should stop pretending bans work and give staff enterprise-grade tools with zero-data-retention terms and clear rules on which data can go where. High-stakes calls in hiring, credit and customer-facing decisions should require a human sign-off.

For founders selling B2B software, there is an opening. Audit logs, bias-testing reports and data-lineage tracking built into the product can turn a buyer’s compliance anxiety into a sales pitch. The country’s fintech players learnt this early; compliance is what let them scale.

Also Read: Without governance, AI agents risk becoming enterprise chaos engines

For lawmakers, the report proposes consolidating the bills under the Department of Information and Communications Technology rather than building a costly new commission, a joint sandbox run by the SEC, BSP, NPC and DICT, and a risk-based law that reserves heavy compliance for genuinely high-risk uses such as biometric surveillance and medical triage.

None of this is radical, and that is the indictment. The Philippines does not lack ideas for governing AI; it lacks the urgency to adopt any of them, while 86 per cent of its knowledge workers get on with using the technology regardless. High trust is an asset. Without guardrails, it is also an exposure waiting for its first headline.

The post The Philippines trusts AI more than anyone in ASEAN. Its rulebook hasn’t caught up appeared first on e27.