Taiwan: technology regulation at a glance

Framework: Virtual Asset Service Act (passed by Legislative Yuan 30 June 2026, commencement to be set by Executive Yuan) supplementing Money Laundering Control Act (2024 amendment) and existing FSC/Securities and Exchange Act rules for security tokens; overseen by the Financial Supervisory Commission (FSC), with the Central Bank co-approving stablecoin issuers and the Ministry of Finance handling tax

Taiwan is transitioning from a patchwork of AML-registration, sectoral securities-law and tax rules to a dedicated crypto regime. The Legislative Yuan passed the Virtual Asset Service Act on 30 June 2026, giving the FSC sole licensing authority over seven categories of VASP and imposing dual-approval and 100% reserve requirements on stablecoin issuers, but the Act's commencement date is still to be set by the Executive Yuan, and existing platforms have a 12-month application / 21-month full-approval transition window.

Framework: Artificial Intelligence Basic Act (人工智慧基本法), promulgated 14 January 2026; National Science and Technology Council (NSTC) as central competent authority; AI Strategy Special Committee under the Executive Yuan

Taiwan enacted the Artificial Intelligence Basic Act on 23 December 2025 (promulgated and in force 14 January 2026), establishing a 20-clause framework law that sets seven core principles for AI governance, designates the NSTC as the lead authority, and creates a three-tiered national governance structure. The act is deliberately a framework statute: it articulates principles, institutional roles, and high-risk AI obligations, but delegates penalty and enforcement details to implementing regulations and sectoral legislation to be enacted within two years. It complements Taiwan's AI Action Plan 2.0 and the Executive Yuan's 10 AI Infrastructure Initiatives launched in 2025.

Framework: Personal Data Protection Act (PDPA), an omnibus, GDPR-style data protection law applying to both government and non-government agencies across all sectors. Major amendments promulgated 11 November 2025 establish the Personal Data Protection Commission (PDPC) as Taiwan's first dedicated independent supervisory authority; a Preparatory Office (pdpc.gov.tw) currently operates pending the Commission's formal establishment.

Taiwan has had a comprehensive cross-sectoral data protection law since 2010 (the PDPA, building on a 1995 predecessor law), covering collection, processing, use and cross-border transfer of personal data with consent, purpose-limitation, notification, access/correction and deletion rights. Until recently, enforcement was fragmented across sector-specific competent authorities, but 2025 amendments create an independent Personal Data Protection Commission (PDPC) to centralize supervision, responding to the Constitutional Court's 2022 Judgment 111-Hsien-Pan-13, which required an independent oversight body. The amendments were promulgated on 11 November 2025, with the effective date to be set by the Executive Yuan (expected 2026) and a 6-year transition for migrating supervision to the PDPC.

Framework: Act Governing Electronic Payment Institutions (amended effective 1 July 2021); Banking Bureau of the Financial Supervisory Commission (FSC) as regulator

Taiwan operates a well-established two-tier electronic payments licensing regime under the Act Governing Electronic Payment Institutions (EPI Act), comprehensively overhauled in 2021 to unify e-payments and stored-value cards under one law. Specialized Electronic Payment Institutions (EPIs) require FSC approval; as of 2025 there are 29 licensed EPIs (9 specialist non-bank institutions and 20 banks). Smaller operators collecting payments below a TWD 2 billion funds threshold are classified as Third-Party Payment Service Providers and must complete AML and service-capability registration with the Ministry of Digital Affairs under rules in force since November 2024.

Framework: Act for the Recruitment and Employment of Foreign Professionals (外國專業人才延攬及僱用法), amended to add the Digital Nomad Visitor Visa category effective January 2025; further revised version in force January 1, 2026. Administered jointly by the National Development Council (NDC), Ministry of Foreign Affairs / Bureau of Consular Affairs (BOCA), and National Immigration Agency (NIA).

Taiwan launched a dedicated Digital Nomad Visitor Visa in January 2025, codified under the Act for the Recruitment and Employment of Foreign Professionals, permitting remote workers to live and work remotely in Taiwan for up to two years without providing services to local employers. A parallel Employment Gold Card scheme offers a 1-3 year combined work-residence permit for high-skilled/high-income foreign professionals, with a clear pathway to permanent residency (APRC) after three qualifying years.

Framework: Sector-specific laws (Fraud Crime Hazard Prevention Act; NCC oversight) with no comprehensive platform safety statute; draft Digital Intermediary Services Act shelved since 2022

Taiwan has no comprehensive online safety or content-moderation law comparable to the EU Digital Services Act or UK Online Safety Act. A draft Digital Intermediary Services Act (DISA), modeled on the EU DSA, was released by the National Communications Commission (NCC) in June 2022 but suspended after massive public backlash and has not been revived. The government has instead pivoted to sector-specific platform obligations embedded in functional laws, chiefly anti-fraud and advertising-disclosure rules, rather than a single digital safety code.

Framework: Cyber Security Management Act (CSMA), administered by the Administration for Cyber Security (ACS) under the Ministry of Digital Affairs (MODA); National Institute of Cyber Security (NICS) for R&D and technical support

Taiwan has a dedicated comprehensive cybersecurity law, the Cyber Security Management Act, originally enacted in 2018 and in force since January 2019. A significant amendment was passed by the Legislative Yuan on 29 August 2025, promulgated on 24 September 2025, and entered into force on 1 December 2025, expanding scope, strengthening CISO mandates, doubling maximum incident-reporting fines, and barring government use of nationally harmful ICT products. Taiwan also launched Phase VII of its National Cybersecurity Development Program (2025-2028) with NT$8.8 billion in funding.

Framework: Statute for Investment by Foreign Nationals; Company Act (ROC); administered by the Department of Investment Review (DIR), Ministry of Economic Affairs (MOEA)

Taiwan permits foreign nationals to establish companies and hold 100% equity in most sectors, subject to a mandatory Foreign Investment Approval (FIA) from the MOEA's Department of Investment Review before incorporation. A 'Negative List' prohibits or restricts foreign participation in sectors including certain telecoms, broadcasting, agriculture, and legal/accounting services. The end-to-end process, from name reservation through tax registration, typically takes 4-8 weeks and is partially managed through the MOEA's online One-Stop Portal.