The AI Roadmap and AI Ethics Perpres are not yet signed. Five risk-based AI governance steps that executives and operations leads can take now.
Tim MarkasDevTechnology Partner, Jakarta
As of early September 2026, two draft Presidential Regulations (Perpres) on AI, a national AI Roadmap and AI Ethics, have been described by the Ministry of Communication and Digital Affairs (Komdigi) as final but not yet signed by the President. For executives and operations leads, the natural reaction is to wait: "let's see the rules first."
We think waiting is not the safe option. The direction of the rules is readable enough, and your staff are quite likely using AI today. This article summarises what the government has said, what is still unknown, and five steps you can take without waiting for anyone's signature.
From the Komdigi statements we read (sources at the end):
What we do not know, and will not guess: the final wording, how risk levels will be defined, whether there will be sanctions, and any compliance deadlines. So the guidance below is governance practice that makes sense whatever the final text says. It is not legal interpretation. For legal certainty, consult your legal counsel once the official regulation is published.
In a statement quoted by Bisnis.com on 16 July 2026, the Deputy Minister of Communication and Digital Affairs said Indonesia's AI challenge is no longer access but depth of use. He also said nearly half of the workforce already uses AI every week.
If that is anywhere near true in your organisation, some work is already being done with AI help, possibly with no internal rules: which documents may be uploaded, who checks the output, and who is accountable when it is wrong. The biggest risk is usually not the model. It is the data that leaves the building and the decisions taken without human review.
Ask each unit which AI tools they use, for what work, and with what data. Start from curiosity, not from penalties. A simple list is enough. It is not unusual to find usage leadership did not know about.
Use the same logic as the government's direction: the greater the impact on people, the tighter the controls. An example internal framework (ours, not an official government classification):
| Level | Examples | Minimum controls |
|---|---|---|
| Low | Summarising meeting notes, drafting letters | No personal data; the user reads the output |
| Medium | Classifying service tickets, summarising contracts | Limited data; outputs sampled regularly; logs kept |
| High | Triaging patients, assessing creditworthiness, deciding who receives a service | Final decision by a person; traceable reasoning; sign-off by leadership |
Write one page: which data must never go into an external AI tool (patient, customer or staff data, for example) and which tools are approved. Komdigi itself reminds users not to enter personal data into general AI assistants. Komdigi officials have also stressed the ability to control data and decide how AI is used, so where your data is stored and processed belongs on your list of questions.
Every medium- and high-risk use needs one named owner. Define where a person must check the output: before a decision goes to a citizen, patient, customer or partner. AI that speeds up a staff member's work is different from AI that decides on its own.
AI pilots often fail not because of the model but because nobody defined "success". Write the criteria up front: acceptable error rate, time saved, and what happens when the output is wrong. Once live, the system needs monitoring, because output quality can drift when data or processes change. This is why we separate Deliver and Operate into two phases with written responsibilities.
If you have no inventory, do not know which use case to tackle first, or are looking at an AI proposal whose price feels like a guess, start with Diagnose: paid discovery with a written output. For AI, a good Diagnose produces a usage inventory, a risk grouping, one or two proposed first use cases with acceptance criteria, and an estimate of running costs after go-live. The reasoning is the same as in when to run paid discovery. If implementation is warranted, we deliver it in milestones through AI implementation.
The status of the AI Perpres may still change, but an inventory of AI use, a risk grouping and data rules do not have to wait. If you would like a measured place to start, tell us about your organisation through the contact page: we begin with a short first conversation, then a paid Diagnose if the scope makes sense. The personal-data side of AI, including DPIA for high-risk processing, is covered in the PP 33/2026 countdown.
All references above were read directly from the following pages (accessed 30 September 2026). The signing status of the Perpres may change after that date. The sources are in Indonesian; the English wording is our own translation.
Trellix Wise for Private Cloud GA 15 Oct 2026: AI for the SOC inside your boundary. Survey of 600 CISOs: 95% saw an AI-linked insider incident, average cost USD 2.4M. Five steps for business.
FIDO's Passkey Index 2026: passkey sign-ins succeed more often, are faster, and cut phishing and SMS OTP costs. But while passwords remain a fallback, the gap stays open. Six steps for businesses.
