Key Takeaways
- Act this quarter: the Cabinet approved cyber-security guidelines and tasked the national cyber-security agency to press both government and private organisations to adopt multi-factor authentication, after a credential leak exposing about 221.9 million records tied to Thai (.th) domains. This drives an expectation, not a fine; read item 1 for how far it actually reaches.
- Track over years: the Cabinet approved a self-assessment of Thai law against OECD standards and tasked agencies to use it when amending 26 laws that do not yet align, among them the Foreign Business Act and the Trade Competition Act B.E. 2560 (2017). None of this changes the law today; it is a reform roadmap toward a target OECD membership year of 2571 (2028).
- Operative now: the Cabinet approved cancelling the Mae Moh replacement units 8 to 9 power project (600 MW, 47,470 million baht) after the tender drew no bidders, leaving a supply gap in the far-Northern grid that the state will manage by running older units longer.
- Unsigned draft: the Cabinet approved in principle a finance-ministry memorandum of understanding with Luxembourg on financial technology, digital assets, and financial-hub development, and authorised the Finance Minister to sign. It is not yet signed.
- Frameworks, not market access: the Cabinet approved strategic-partnership documents with Australia (a 2026 to 2029 Joint Plan of Action) and New Zealand (a Joint Declaration) for signing on the Prime Minister's official visits, including a visit to New Zealand on 20 to 21 August B.E. 2569 (2026).
What is decided, and what is only a direction
- Operative now as a Cabinet decision: the cancellation of the Mae Moh units 8 to 9 project resolution.
- Approved as a resolution that drives adoption through the regulator, not a penalty regulation: the multi-factor authentication measure (item 1).
- Approved as guidance and a tasking to ministries, not law: the OECD law-reform roadmap (item 2). The 26 statutes are flagged for future amendment; none is amended yet.
- Approved in principle, not yet signed: the Thailand-Luxembourg finance memorandum.
- Approved for signature as cooperation frameworks, not binding market-access law: the Australia and New Zealand partnership documents.
1. Multi-factor authentication is now the control the state is pressing on private companies. Treat it as a baseline.
If your business holds customer or employee data in Thailand, this is the decision to action. The Cabinet approved guidelines proposed by the National Cyber Security Committee and tasked the National Cyber Security Agency, invoking Section 22(5) of the Cybersecurity Act B.E. 2562 (2019), to have government agencies and private organisations act on the Committee's resolution by adopting multi-factor authentication, for example through the national Digital Identity credential (ThaID) or another secure method. The measure responds to a specific incident: the national computer-emergency team reported that a threat group had published stolen login credentials in volumes exceeding 16,520 files, and that checks of Thai (.th) domains surfaced about 221.9 million exposed records spanning government bodies, companies, educational institutions, and others.
Read the status carefully, because it is easy to overstate. Section 22(5) is a coordination-and-support power, so this resolution drives adoption and sets a clear government expectation; it is not, on the face of the summary, a gazetted regulation carrying its own penalties, and a private company is compelled in the strict legal sense only if it is designated as Critical Information Infrastructure under the Act or once subordinate legislation is issued. Even so, multi-factor authentication is now the baseline the state is actively promoting, and we recommend adopting it as a matter of prudence. The Personal Data Protection Act B.E. 2562 (2019) separately requires data controllers to keep appropriate security measures, and multi-factor authentication is strong evidence of them, which is why its absence is harder to defend after a breach.
2. Thailand's move toward the OECD puts the Foreign Business Act and competition law on a multi-year reform path.
If you are a foreign investor or in-house counsel, this sets the direction of Thai regulation for years, though it changes nothing today. The Cabinet approved a summary self-assessment prepared by the Office of the Council of State for Thailand's Initial Memorandum, the document that measures Thai law against OECD standards, which the Prime Minister signed and submitted to the OECD on 8 December B.E. 2568 (2025). The Cabinet tasked the responsible agencies to use its findings when they amend their laws and subordinate regulations. The self-assessment identified 26 Thai instruments that do not yet align with OECD standards.
The flagged areas preview where obligations are likely to tighten. They include economy, competition, and foreign investment (four instruments, with examples pointing at the Trade Competition Act B.E. 2560 (2017) and the Foreign Business Act, the principle that state and private competitors should be treated alike, and a dedicated screening mechanism for investment touching national security); anti-corruption and tax (four instruments, with examples including clearer criminal liability for companies, an offence of bribing foreign officials, and treating serious tax crimes as money-laundering predicate offences); environment and pollution control (seven); chemicals and biotechnology (six); agriculture and food (two); and statistics and equality (three, including gender-equality duties reaching the private sector). The stated aim is to move Thailand toward its target OECD membership year of 2571 (2028).
None of this is law. It is a Cabinet-approved roadmap that sends drafting work to ministries such as Commerce and the environmental, industry, and anti-corruption bodies. Its value now is as an unusually specific early signal of where foreign-ownership, competition, ESG, and compliance rules are heading, well before any bill is published. No action is required yet beyond preparation.
3. A cancelled 47,470 million baht power project leaves a 600 MW gap in the far-Northern grid.
If your operations or investments depend on reliable power in the North, or if you are siting a power-hungry facility such as a data centre or a factory, note this supply decision. The Cabinet approved the Ministry of Energy's request to cancel the Cabinet resolution of 24 May B.E. 2565 (2022) for the Mae Moh replacement units 8 to 9 project of the state generator (the Electricity Generating Authority of Thailand), a 600 MW project with transmission worth 47,470 million baht in total. The tender drew no bidders, so the plant could not be built in time to supply power commercially within 2569 (2026).
The cancellation removes 600 MW from the system and puts pressure on the far-Northern grid serving Chiang Mai, Phayao, and Chiang Rai, where existing Mae Moh units are already due to retire. To hold stability, the National Energy Policy Council had endorsed, on 21 August B.E. 2568 (2025), a plan to keep two existing units running alongside a newer Mae Moh unit and to defer their retirement from 31 December B.E. 2568 (2025) to 31 December B.E. 2574 (2031). For the market, the signal is near-term reliance on ageing capacity in the North and a probable future tender to replace the lost plant.
4. Thailand and Luxembourg move toward cooperation on fintech, digital assets, and financial-hub development.
For banks, asset managers, and digital-asset businesses, the Cabinet approved in principle a memorandum of understanding between the Ministry of Finance and its Luxembourg counterpart and authorised the Finance Minister, or a delegate, to sign it on a date the two sides agree. The memorandum grew out of an April B.E. 2568 (2025) meeting on the margins of the World Bank and International Monetary Fund annual meetings and covers cooperation on financial technology, digital assets, financial services and banking, and each country's ambition to develop as a regional or global financial hub.
The status is early and the instrument is soft. A memorandum of understanding of this kind is a cooperation framework whose non-binding character depends on its terms; it is not a treaty and not a change to Thai financial-services or digital-asset licensing. As at 12 August B.E. 2569 (2026) it is approved in principle but not yet signed. Its value is as a signal that Thailand intends to deepen cross-border links in fund structuring and digital-asset expertise with a leading European fund domicile.
5. Strategic-partnership frameworks with Australia and New Zealand point to closer trade and supply-chain ties.
For exporters, importers, and investors with Australasian links, the Cabinet approved a Joint Plan of Action to implement the Thailand-Australia Strategic Partnership for 2026 to 2029 and authorised the Foreign Minister to sign it, alongside two joint statements to mark the Prime Minister's official visit to Australia. It also approved a Joint Declaration on a Thailand-New Zealand Strategic Partnership for signing during the Prime Minister's visit to New Zealand on 20 to 21 August B.E. 2569 (2026), building on a Thailand-New Zealand joint action plan for 2026 to 2030 approved on 25 November B.E. 2568 (2025).
Both frameworks are broad, covering trade and economy, supply-chain connectivity, agriculture, renewable energy, science and digital innovation, and people-to-people links. They are cooperation instruments, not binding market-access commitments, so they change no tariff or trade rule by themselves. For business, they best read as a statement of official priority sectors and a foundation for specific initiatives later.
Also worth noting
Two further Cabinet items are worth a place on the watch list. The Cabinet approved in principle a draft Ministerial Regulation under the Revenue Code granting tax relief connected to the ASEAN Centre for Active Ageing and Innovation in Thailand, addressing the corporate-tax status of the intergovernmental centre, personal income tax for its personnel, and import and value-added tax on its equipment; it is a narrow, entity-specific measure now heading to the Council of State. Among senior appointments, the Cabinet extended the term of the Secretary-General of the Board of Investment, which matters to business only as continuity for investors dealing with the BOI.
Where we can help
Our Corporate and Commercial team advises foreign investors and in-house counsel on the Foreign Business Act, competition law, and the corporate and compliance reforms the OECD roadmap foreshadows, and on the financial-services and digital-asset questions the Thailand-Luxembourg framework raises. Our Intellectual Property and Tax teams advise on data, cyber-security, and the tax and anti-corruption elements of the reform programme. Our Litigation and Dispute Resolution team acts on energy, infrastructure, and procurement matters, including the fallout from cancelled projects. Our Immigration team supports cross-border workforce planning as trade ties with Australia and New Zealand deepen. To arrange a 30-minute strategy call, contact [email protected].
Disclaimer: This publication is intended for general informational purposes only and does not constitute legal advice. The information contained herein should not be relied upon as a substitute for specific legal counsel. For advice tailored to your circumstances, please contact Dej-Udom & Associates directly.