Foreign artificial intelligence (AI) companies are increasingly entering the Indonesian market by providing AI-powered platforms, software, and digital services directly to users in Indonesia. Unlike traditional businesses, AI service providers can operate their services remotely and serve users in Indonesia without establishing a physical office or incorporating a company in Indonesia.
This raises an important regulatory question: Can a foreign AI company offer its services in Indonesia without establishing a local entity?
Under Indonesia’s current regulatory framework, there is no general provision expressly prohibiting foreign AI companies from providing AI services to users in Indonesia on a cross-border basis. However, where an AI service falls within the scope of an Electronic System Operator (Penyelenggara Sistem Elektronik or “PSE”), the foreign provider may be subject to electronic system registration, data protection, information security, and other regulatory obligations in Indonesia.
In addition, depending on the nature of its business activities, the company may also need to consider Indonesia’s risk-based business licensing regime.
Accordingly, while a cross-border operating model without an Indonesian subsidiary may be possible in certain circumstances, the absence of a local entity does not necessarily mean that a foreign AI provider falls outside the scope of Indonesian regulations.
AI as an “Electronic Agent”
One of the key legal concepts relevant to AI services in Indonesia is the concept of an electronic agent (agen elektronik).
Law No. 11 of 2008 on Electronic Information and Transactions, as amended by Law No. 1 of 2024 (“ITE Law”), recognizes an electronic agent as an electronic system device designed to automatically perform certain actions on specific electronic information and operated by a person.
AI systems that automatically process information, generate outputs, provide recommendations, or perform certain actions through an electronic system may fall within this concept of an electronic agent, depending on the characteristics and functions of the relevant system.
This classification is important because Indonesia’s electronic transaction regulations recognize legal consequences arising from transactions conducted through electronic agents.
Under this legal framework, responsibility for the operation and consequences of an electronic agent is generally placed on the party operating or providing the relevant electronic system and is not automatically shifted to the end user. This becomes particularly relevant where an AI system generates an output or performs an action that results in legal or economic consequences.
Accordingly, a foreign company providing an AI platform to users in Indonesia cannot necessarily treat the AI system merely as a technological product without any regulatory responsibility attached to it. Depending on the nature of its services, the provider may be regarded as operating an electronic system and, in certain circumstances, an electronic agent under Indonesian law.
PSE Registration: A Key Obligation for Foreign AI Providers
Another important regulatory consideration is Indonesia’s PSE regime.
Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (“GR 71/2019”) establishes the regulatory framework for electronic system operators, including registration requirements for private-sector PSEs.
The PSE regime does not apply exclusively to Indonesian companies. Foreign electronic system providers may also fall within its scope where their electronic systems are used in Indonesia or provide services to users in Indonesia.
Accordingly, a foreign AI provider cannot automatically assume that the location of its servers, headquarters, or development team outside Indonesia is sufficient to avoid Indonesian PSE obligations.
Where an AI service falls within the scope of a private-sector PSE, the provider may be required to register its electronic system with the relevant authority before making the system available for use in Indonesia.
The registration process generally requires information concerning:
- the general description and functions of the electronic system;
- the electronic system’s business processes;
- infrastructure and hosting arrangements;
- implementation of personal data protection; and
- information security arrangements or relevant commitments.
For foreign AI providers, these requirements raise a practical compliance question: who is legally responsible for the electronic system in Indonesia?
Although a foreign company may operate its technology from outside Indonesia, regulatory compliance and enforcement require the regulator to be able to identify the party responsible for the system and its operations.
This is one of the reasons why local presence, a properly structured representative arrangement, or another legally recognized mechanism for assuming regulatory responsibility may become important in practice.
Does an AI Company Need an Indonesian Entity?
The answer depends on how the foreign company conducts its business activities in Indonesia.
Indonesia’s regulatory framework does not simply provide that every foreign AI company must establish an Indonesian subsidiary before offering services to users in Indonesia.
Accordingly, a cross-border model may be possible in certain circumstances.
However, the analysis may be different where the foreign company actively conducts regulated business activities in Indonesia or operates an electronic system that falls within the PSE regime.
This distinction is important.
A foreign company may technically provide software or digital services from overseas. However, where the service is actively offered to Indonesian users, processes Indonesian users’ data, operates an electronic system accessible in Indonesia, and falls within Indonesia’s PSE framework, the company may be subject to Indonesian regulatory obligations regardless of where its servers or headquarters are located.
Therefore, the question should not simply be:
“Does the AI company have an Indonesian subsidiary?”
The more relevant questions are:
What service is being provided? Who are the users? How is the system operated? What data is being processed? And does the activity fall within Indonesia’s PSE and business licensing regimes?
AI Ethics and Regulatory Expectations
Indonesia has also begun developing a broader regulatory framework concerning the responsible use of AI.
Minister of Communication and Informatics Circular Letter No. 9 of 2023 on AI Ethics sets out ethical principles applicable to AI stakeholders, including businesses conducting AI-based programming activities under KBLI 62015 and PSEs.
The circular letter emphasizes principles including:
- transparency;
- accountability;
- personal data protection;
- security;
- reliability;
- fairness; and
- risk mitigation.
Although the circular letter does not have the same binding force as legislation or government regulations, it provides an indication of the regulator’s expectations regarding responsible AI governance.
For foreign AI companies operating in Indonesia, regulatory compliance should therefore not be assessed solely by reference to whether the company has obtained a particular license.
AI governance, data protection, information security, transparency, and accountability may also become relevant when the company’s system is used by Indonesian users.
Sector-Specific Regulations May Apply
The regulatory analysis becomes more complex when AI is deployed in a regulated sector.
For example, AI technologies used in the financial services sector may be subject to additional requirements imposed by the Financial Services Authority (Otoritas Jasa Keuangan or “OJK”).
Financial institutions are subject to requirements concerning information technology governance, risk management, and other regulatory matters. Where an Indonesian financial institution uses an AI solution supplied by a foreign technology company, the relationship may therefore require clear contractual arrangements concerning data, security, system reliability, risk allocation, and regulatory compliance.
Similar considerations may arise in other regulated sectors, depending on the intended use of the AI technology.
Therefore, foreign AI companies should not assume that compliance with the general PSE framework alone is sufficient. The sector in which an AI system is deployed may trigger additional regulatory requirements.
What Happens If the AI Company Operates Without a Local Entity?
From a normative perspective, Indonesian law does not establish a general prohibition against foreign AI companies providing services to users in Indonesia without establishing an Indonesian legal entity, particularly where the services are provided on a cross-border basis.
However, this does not mean that the company can operate outside Indonesian regulatory jurisdiction.
Where an AI service qualifies as an electronic system operated for users in Indonesia, the provider may be required to comply with the PSE framework, including registration and other related compliance obligations.
At the same time, where the company conducts business activities in Indonesia that fall within the scope of Indonesia’s business licensing regime, it must also assess whether a local business presence is required.
This creates a practical distinction between legal possibility and regulatory operability.
A foreign AI company may technically be able to make its platform accessible to Indonesian users from overseas. However, operating the platform on a sustained commercial basis while complying with Indonesian PSE, data protection, business licensing, and sector-specific requirements may require a more structured legal presence.
The Importance of a Clear Local Compliance Structure
For foreign AI companies entering Indonesia, establishing a local entity is therefore not the only legal issue that needs to be considered.
The more fundamental question is whether the company has established a structure through which its Indonesia-facing activities can be properly regulated and its legal responsibilities clearly allocated.
Depending on the business model, this may involve:
- establishing an Indonesian subsidiary;
- establishing an appropriate representative or other legally recognized presence;
- registering as a PSE where required;
- obtaining the relevant business licenses;
- implementing personal data protection and information security measures;
- establishing contractual arrangements with Indonesian customers and business partners; and
- implementing appropriate AI governance and risk management procedures.
The appropriate structure will depend on the nature of the AI service, the target users, the location and processing of data, the commercial model, and the sector in which the technology is deployed.
Key Considerations for Foreign AI Companies
Before launching an AI platform or service in Indonesia, foreign providers should consider at least the following:
1. Determine the nature of the AI service.
The company should identify whether its technology merely provides software functionality or operates an electronic system that performs automated functions for users.
2. Assess PSE obligations.
The company should determine whether its platform qualifies as a private-sector PSE and whether PSE registration is required.
3. Assess business licensing requirements.
Where the company conducts AI-based programming or other business activities in Indonesia, the applicable KBLI classification and risk-based licensing requirements should be reviewed.
4. Review data protection obligations.
AI systems frequently process substantial amounts of data. The company should therefore assess its obligations under Indonesia’s personal data protection framework.
5. Consider local presence.
Where Indonesian regulatory obligations require a clearly identifiable responsible party, the company should assess whether an Indonesian entity, representative, or other legally recognized structure is appropriate.
6. Identify sector-specific requirements.
AI deployed in financial services, healthcare, telecommunications, or other regulated sectors may be subject to additional regulatory requirements.
7. Establish contractual and liability arrangements.
Contracts with Indonesian customers and business partners should clearly allocate responsibilities concerning AI outputs, data processing, security, intellectual property, and regulatory compliance.
How TAMA Global Mobility Can Assist
TAMA Global Mobility assists foreign technology companies and multinational groups in assessing and structuring their operations in Indonesia, including:
- PSE Regulatory Assessment, assessing whether an AI platform or electronic system falls within Indonesia’s PSE registration regime;
- Business Licensing Assessment, identifying the relevant KBLI classification and risk-based licensing requirements;
- Local Presence Structuring, advising on appropriate Indonesian corporate or representative structures for foreign technology businesses;
- Immigration & Employment Advisory, advising on immigration and employment arrangements for foreign personnel involved in Indonesian operations;
- Data & Regulatory Compliance, coordinating PSE, personal data protection, information security, and related compliance requirements; and
- Market Entry Advisory, assisting foreign AI and technology companies in structuring their Indonesian market entry from a corporate, licensing, immigration, and regulatory perspective.
TAMA Global Mobility provides structured advisory support to foreign companies navigating Indonesia’s immigration, global mobility, corporate licensing, and regulatory environment.
Disclaimer: Here
– – – ||| – – –
TAMA Global Mobility
WhatsApp: +62 821-1015-402
Email: info@tamaglobalmobility.com
For additional insights on Indonesian immigration compliance and global mobility matters, explore our related publications:
Centralization of Mining Area Planning for Investigation and Research Assignments in Indonesia
Transfer of ITAS Sponsorship Between Companies Within the Same Business Group in Indonesia
Can Foreign Companies Participate in Government Procurement in Indonesia?
Foreign Founder as a Director of a PT PMA: RPTKA and Work Stay Permit Requirements
Can a Foreign Company Operate in Indonesia Without Establishing a PT PMA?
Entering the Indonesian Market: PT PMA, Representative Office or Permanent Establishment?
