Taiwan's foundational AI law mapped to cryptographic witness evidence. 7 principles, sector-level risk authority, semiconductor industry context.
Who this is for: AI teams at semiconductor and hardware companies (TSMC, MediaTek, NVIDIA supply chain), compliance officers serving Taiwanese markets, legal counsel advising on Asia-Pacific AI obligations.
In effect since January 14, 2026. The AI Basic Act (20 articles) was passed by the Legislative Yuan on December 23, 2025 and promulgated January 14, 2026. It establishes 7 foundational principles and authorizes sector regulators to build risk-based management rules within 2 years. While the Act does not impose direct private sector obligations yet, it creates the legal foundation for binding sector-specific regulations expected to follow.
Taiwan's AI Basic Act is framework legislation: it sets principles and delegates rule-making authority to sector regulators, rather than imposing detailed obligations directly on private entities. This approach mirrors Japan's innovation-first posture while preserving the legal foundation for more prescriptive sector rules.
For organizations operating in Taiwan, the strategic imperative is readiness. Sector rules will arrive within the 2-year window. Organizations that build witness evidence now will satisfy those requirements without a compliance sprint when they activate.
Taiwan's unique position in global technology supply chains gives its AI governance framework outsized significance. The Act's principles will shape how AI is developed, validated, and deployed across the most critical hardware supply chain on earth.
AI-HW.1 (hardware attestation) and AI-SUPPLY.1 (supply chain integrity) are directly relevant to organizations whose AI systems depend on or produce Taiwan-fabricated components.The intersection of semiconductor supply chains and AI governance is a new compliance frontier. SWT3 Witness Anchors provide a hardware-agnostic, cryptographically verifiable evidence layer that travels with AI deployments regardless of the underlying silicon provider.
| Principle | AI Basic Act Article | SWT3 Evidence |
|---|---|---|
| Sustainable development and well-being | Art. 3(1) | AI-INF.1 inference provenance tracks system utilization and impact over time |
| Human autonomy | Art. 3(2) | AI-AUTO.2 records human oversight boundaries and override decisions |
| Privacy protection and data governance | Art. 3(3) | CJT fields (jurisdiction, legal_basis, purpose_class) on every anchor |
| Cybersecurity and safety | Art. 3(4) | AI-GRD.1 guardrail status, AI-SEC.1 security events |
| Transparency and explainability | Art. 3(5) | AI-TRANS.1 transparency records, AI-EXPL.1 explainability evidence |
| Fairness and non-discrimination | Art. 3(6) | AI-FAIR.1 bias measurement anchors |
| Accountability | Art. 3(7) | Every SWT3 Witness Anchor is independently verifiable at sovereign.tenova.io/verify |
Taiwan context: As sector regulators develop risk-based rules, inference logging will likely become mandatory for high-risk applications. Organizations that begin witnessing now will have evidence chains ready when sector rules activate.
SWT3 witnesses: Every inference produces a Witness Anchor recording model ID, input/output hashes, latency, and endpoint. Creates continuous governance evidence regardless of which sector rules apply.
AI-INF.1 anchors demonstrate compliance readiness. When sector regulators define logging requirements, these records already satisfy the obligation.
Taiwan context: The cybersecurity and safety principle (Art. 3(4)) will drive sector regulators to require evidence that safety controls are active. Financial regulators (FSC) and healthcare regulators are expected to be among the first to define specific guardrail requirements.
SWT3 witnesses: Records guardrail status (active/inactive) and pass/fail per inference. Creates continuous safety evidence.
AI-GRD.1 evidence shows guardrail coverage for every inference. Gaps in coverage are immediately visible in the anchor timeline.
Taiwan context: The transparency and explainability principle (Art. 3(5)) directly maps to disclosure requirements. The Act's emphasis on transparency suggests sector rules will require organizations to document what AI systems do and how decisions are made.
SWT3 witnesses: AI-TRANS.1 records transparency disclosures, model capabilities documented, and user notification status. Creates verifiable evidence that transparency obligations were met.
AI-TRANS.1 anchors prove that transparency measures were active, not just that they were configured. The difference matters to sector regulators.
Taiwan context: The fairness and non-discrimination principle (Art. 3(6)) will drive requirements for bias testing, particularly in financial services and employment AI. Organizations deploying AI in these sectors should begin establishing bias measurement baselines now.
SWT3 witnesses: AI-FAIR.1 records bias measurement results, including the metric used, the population tested, and the outcome. Creates deployer-specific fairness evidence.
AI-FAIR.1 anchors prove bias was measured in the specific deployment context, not just that a model card exists from the model developer.
Taiwan context: The accountability principle (Art. 3(7)) requires organizations to maintain records of AI system configurations. When sector regulators define configuration management requirements, baseline records provide evidence of compliance from day one.
SWT3 witnesses: AI-BASE.1 records model configuration at attestation time. Configuration changes produce new anchors, creating a timeline of configuration drift.
Compare current AI-BASE.1 anchors against approved baselines. Any discrepancy indicates unauthorized changes that may require sector regulator notification.
| Aspect | Taiwan AI Basic Act | South Korea AI Basic Act | Japan AI Promotion Act | EU AI Act |
|---|---|---|---|---|
| Effective date | Jan 14, 2026 | Jan 22, 2026 | May 28, 2025 | Aug 2, 2025 (phased) |
| Approach | Principles + sector delegation | Risk-based + compute threshold | Innovation-first, soft law | Risk-tiered, comprehensive |
| Private sector obligations | Indirect (via sector regs) | Direct (transparency, impact assessment) | None (voluntary) | Extensive (risk-tiered) |
| Penalties | None yet (sector regs pending) | 30M KRW (~$21K) | None (name and shame) | Up to 3% global turnover |
| Extraterritorial | Unclear | Yes | No | Yes |
| Grace period | 2-year review window | 1-year enforcement grace | N/A | Phased by risk tier |
Taiwan and Japan share the lightest current burden for private entities. Both create legal foundations that sector regulators will build on. Organizations operating across Asia-Pacific should treat Taiwan's 2-year review window as a readiness runway, not a compliance holiday.
The following example shows a minimal SWT3 witness configuration for a Taiwan-deployed AI system. CJT fields anchor every inference to Taiwan jurisdiction and the applicable legal basis.
from swt3_ai import AIWitnesswitness = AIWitness(api_key="axm_live_...",agent_id="taiwan-production-agent",# CJT fields -- required for jurisdiction-aware witnessingjurisdiction="TW", # ISO 3166-1 Taiwanlegal_basis="legitimate_interest", # or consent, contractpurpose_class="business_automation")# Every inference is witnessed automaticallyresult = witness.infer(model="gpt-4o",prompt="Summarize the quarterly risk report.",procedure_id="AI-INF.1")# Anchor is created. Verifiable at sovereign.tenova.io/verifyprint(result.anchor) # SWT3-E-VULTR-AI-INF1-PASS-...
See the SDK documentation for TypeScript, Rust, C#, Ruby, and Swift equivalents. The jurisdiction field accepts any ISO 3166-1 alpha-2 code. All CJT fields survive all four clearing levels.
| AI Basic Act Principle | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| Sustainable development and well-being (Art. 3(1)) | Art. 9 risk management system | GOVERN 1.1, MANAGE 2.2 | Clause 6.1 (risk and opportunity) |
| Human autonomy (Art. 3(2)) | Art. 14 human oversight | GOVERN 6.1, MANAGE 4.1 | Clause 8.4 (human oversight) |
| Privacy and data governance (Art. 3(3)) | Art. 10 data governance | MAP 5.1, MANAGE 1.3 | Clause 8.3 (data management) |
| Cybersecurity and safety (Art. 3(4)) | Art. 15 accuracy, robustness, cybersecurity | MANAGE 2.4, MANAGE 3.1 | Clause 9.1 (monitoring) |
| Transparency and explainability (Art. 3(5)) | Art. 13 transparency, Art. 50 disclosure | GOVERN 5.2, MAP 1.6 | Clause 7.5 (documented information) |
| Fairness and non-discrimination (Art. 3(6)) | Art. 10(2)(f) bias testing | MAP 5.2, MEASURE 2.5 | Clause 6.1.2 (impact assessment) |
| Accountability (Art. 3(7)) | Art. 16-24 provider/deployer obligations | GOVERN 1.2, GOVERN 6.2 | Clause 5.3 (roles and responsibilities) |
Common examiner questions and the SWT3 evidence that answers them.
| Examiner Question | SWT3 Evidence | Procedure |
|---|---|---|
| How do you demonstrate accountability for AI decisions? | Every inference produces a tamper-evident Witness Anchor verifiable at the public verify endpoint | AI-INF.1 |
| What evidence shows safety controls were active? | AI-GRD.1 anchors record guardrail status per inference, including pass/fail and the guardrail version | AI-GRD.1 |
| How is bias measurement documented for each deployment? | AI-FAIR.1 anchors record the metric, test population, threshold, and result at the deployer level | AI-FAIR.1 |
| Can you demonstrate transparency disclosures were made? | AI-TRANS.1 anchors record disclosure events with timestamps and user notification status | AI-TRANS.1 |
| What shows the system configuration has not drifted? | AI-BASE.1 anchors record approved configuration. New anchors are minted on change, creating a drift timeline | AI-BASE.1 |
| How is jurisdiction tracked for data governance? | CJT fields (jurisdiction=TW, legal_basis, purpose_class) are embedded in every anchor and survive all clearing levels | All procedures |