A civil society map of AI risks in the Philippines

The Foundation for Media Alternatives (FMA) in the Philippines published an AI risk-mapping report on 30 October, drawing on the discussions of two workshops. Participants came from civil society groups and grassroots organisations working on human rights, labour, gender, media and the environment, along with academics, technologists, journalists and digital rights lawyers. The report sets out the risks of AI in labour, disinformation, privacy, education, the environment and the creative industries, then makes separate recommendations to Congress, executive agencies, platforms and AI developers. It deals with Philippine bills and policies, so readers elsewhere are not directly affected.

The workshops were held on 28 July and 23 September, with the second adding the environment, health and creative sectors that the first had not covered. According to the report's methodology, each group discussed how AI affects its own sector, who benefits and who is harmed, what concrete incidents it had seen, and which existing laws or protections might apply. Risks were plotted on a likelihood-and-severity matrix, with ratings set by each group during the workshops, and the report does not give the number of participants or organisations. The report also states that the risk section reflects only the participants' views, not the position of any organisation or institution, and that the recommendations should not be read as a consensus of every participating organisation.

In the report's account, the most prevalent risks in the Philippines, cutting across sectors, are job displacement and labour intensification, meaning more work done faster without added pay. In business process outsourcing (BPO), the industry that handles outsourced work such as customer service and back-office operations, quality-assurance specialists at one operation lost their jobs to automation, and at another BPO company an estimated 1,500 employees were dismissed (the report gives this as an estimate), reportedly in connection with AI-driven survey/monitoring functions. Content moderators at a major platform worry that their moderation work is being used as machine-learning training data, and that the systems trained on it will eventually replace them.

Also rated high for both likelihood and severity on the matrix are technology-facilitated gender-based violence, AI-generated child sexual abuse material, surveillance of activists, and disinformation, which the report writes is eroding trust in the media and the government. Private appropriation of public data, the environmental impact of data centres, and the opacity and bias of AI training data are placed in the top tier as well.

In the privacy section, participants considered the Data Privacy Act of 2012 to be of limited use in governing AI. The report lists who owns collected data after a company changes hands, and how users can enforce their rights across borders, as questions that remain unresolved.

The report also records protective uses of AI in human rights work, such as translation, help with writing grant applications, and open-source intelligence for documenting violations. The environment group was divided on data centres, with some arguing that the Philippines need not compete with its neighbours on these terms, and others seeing transparent, publicly audited and accountable data centres as an opportunity for industrialisation and higher output.

Many of the recommendations do not have to wait for a new law, since executive agencies, companies and communities can act now under existing mandates such as the Data Privacy Act, the environmental impact assessment system and the Labor Code. The report treats transparency as the precondition for all other accountability, on the reasoning that no one can assess or contest what they cannot see, whether training data, data collection, energy and water use, or AI-assisted decisions. Its recommendations place accountability on upstream model developers, platforms and large deployers, and call for the groups most affected to have a guaranteed place in decisions about AI. For companies and platforms, they include disclosing where AI is used in a product, keeping records of AI-assisted decisions, accepting independent third-party audits, and letting creators opt out of training data and receive compensation.

Perspective

All seven AI bills analysed in the report are House of Representatives bills, referred to a technical working group of the House Committee on Information and Communications Technology and, as of the report's publication, still being consolidated into a substitute bill, the Artificial Intelligence Development and Regulation Act. According to a piece PhilStar ran on 14 July, marked at the foot as a contributed story, the version of the substitute bill at that time would not require most AI systems to register with the government. Registration and safety checks would apply only to high-risk systems that decide on loans, jobs and health, and startups could develop and test new systems in a government-established regulatory sandbox. The same piece quotes the working group's chair as saying the goal is "a law our innovators can build on, our regulators can enforce, and every Filipino can trust".

Comparing the seven bills against nine criteria, the report finds that some are inconsistent about the scope of registration, and that the existing high-risk categories do not yet reflect the harms participants documented. It recommends explicitly listing systems that affect children, neurodivergent people and other vulnerable groups, systems that grade or assess students and workers or reject applications for jobs, loans or services, and AI used in healthcare, including government monitoring and analytics. Accountability would rest with upstream foundation model providers, which would have to create and register a local representative before operating in the country, so that there is a party in the Philippines bearing their legal obligations. Small and medium enterprises would be covered proportionately rather than exempted altogether.

On labour, the report recommends amending labour and social protection rules, and imposing a surcharge on high-compute AI use (identified, for example, through revenue or usage thresholds) to finance a welfare fund for workers outside existing protections. According to the PhilStar piece, the July version of the substitute bill provided that no Filipino may be dismissed by an algorithm alone, and that employers must give 60 days' notice and retraining before any displacement caused by AI.

For the executive branch, the report recommends forming a multi-agency AI task force before a new law is passed, with its path to becoming a permanent body defined from the start. BusinessWorld reported on 29 April that the Department of Economy, Planning, and Development (DEPDev) had unveiled a draft AI governance framework, listing risks that include ethical considerations and cybercrime, cybersecurity and data privacy, labour market disruption, intellectual property and antitrust, and environmental sustainability and resource consumption. According to the report, participants expected the framework to be general and unlikely to address the issues raised in the workshops. In the same BusinessWorld article, the DEPDev secretary said that without good policy and a clear governance framework, "we expose our people to unnecessary risk" (as of 3 November we could not find whether the framework has been finalised).

As of 3 November we found no public response to the report from the Department of Information and Communications Technology (DICT), the National Privacy Commission (NPC) or DEPDev, and we did not separately contact the companies and platforms it mentions. The government considerations above come from the PhilStar contributed piece and the BusinessWorld report, while for the cases and risk ratings in the report, only the report's side is available so far.

The recommendation closest to anonymity and privacy tools is community-owned, locally controlled technology, such as tools that run on local networks or offline and let people share information and report violence without relying on large platforms. Participants named cost, usability and signal as obstacles for such tools, and noted that earlier open-source options have been abandoned. They added that any AI tools built for survivors should guarantee privacy, referral to a human and an emergency pathway.

Participants from the creative sector described several personal guardrails, such as keeping their own writing in a closed project folder and not using general chat tools for work they intend to publish. The report also states that the burden of literacy should not fall on users alone, and that many people feel too disempowered to set limits. Artists who took part said that once a work is in a training pool, it cannot be removed. Our inference is that such practices protect only future work, and do not reach content that has already been scraped.

South Korea's Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, which the Ministry of Science and ICT says took full effect on 22 January 2026, sets out obligations for a defined category of high-impact AI, meaning systems used in listed areas that may significantly affect people's life, physical safety or fundamental rights, whereas the July version of the Philippine substitute bill described above requires registration only for high-risk systems. Businesses providing high-impact AI must put in place risk management, explanation and user protection measures, human oversight and documentation. On disclosure, Article 31(1) in the Korea Legislation Research Institute's English translation of the Act (Act No. 20676) requires operators to tell users in advance that a product or service runs on high-impact or generative AI. The Ministry of Science and ICT announced that fact-finding investigations and penalties under the transparency provision will be deferred for a grace period of at least a year (both checked on 1 November).

Two provisions of Taiwan's AI Basic Act (人工智慧基本法), in force since its promulgation on 14 January 2026, are addressed to government: Article 19 requires the government to carry out risk assessments when it uses AI and to set usage rules or internal control mechanisms, and Article 14 requires the competent authorities, in consultation with the personal data protection authority, to avoid unnecessary collection, processing or use of personal data in AI research and applications. Article 4 lists transparency and explainability among the Act's principles without saying to whom disclosure is owed (Articles 4 and 19 checked on 29 October, Article 14 on 23 October). In Hong Kong, the Digital Policy Office's Artificial Intelligence Adoption Guide for Government Bureaux and Departments (July 2026), written as recommendations without stating binding force, advises that important decisions should never depend exclusively on AI outputs without human review. The guide does not require telling the people affected by a decision that AI was involved (checked on 29 October).

When comparing AI governance across places, questions on rights include which training data and data collection companies must disclose, whether the people affected can contest AI-assisted decisions, and whether oversight bodies have a legal mandate and permanence. On what the policy is meant to achieve, one can also ask whether registering only high-risk systems, as in the July version, can both leave room for startups and be enforced in practice by regulators.