# Taiwan AI Risk Taxonomy and Assessment Framework: Artificial Intelligence Risk Taxonomy and Assessment Framework (Version 1.0)

Source: https://www.bankingnewsai.com/ai-regulation/documents/taiwan-moda-ai-risk-framework-2026
Last updated: Nov 12, 2026

Taiwan's Ministry of Digital Affairs issued Version 1.0 of the Artificial Intelligence Risk Taxonomy and Assessment Framework on 7 July 2026, effective the same day, under Article 16 of the AI Basic Act. It is addressed to sectoral regulators rather than to firms: each regulator, including the Financial Supervisory Commission for finance, is to inventory the AI use cases in its sector, identify risks against a table of 20 risk subtypes, assess whether a use case is high-risk and choose a response. It is the procedure the FSC is to follow when it sets risk-based AI rules for the financial sector, and the ministry expects the FSC and seven other agencies to complete the process by the end of 2026.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Taiwan (FSC / MODA)](https://www.bankingnewsai.com/ai-regulation/taiwan) |
| Type | Framework |
| Status | In force |
| Published | Jul 7, 2026 |
| Effective | Jul 7, 2026 |
| Applies to | Primarily the competent authorities for each industry in Taiwan, including the Financial Supervisory Commission, each of which 'shall follow the operational workflow prescribed in this Framework' when it sets risk-based management rules under Article 16(2) of the AI Basic Act. Industry and the public are secondary readers. It covers civilian AI uses and excludes military ones |
| Official text | https://law.moda.gov.tw/EngLawContent.aspx?id=104&lan=E |

## Key points

- Workflow (Part 3): 'AI Use Case Inventory → Risk Identification → Risk Assessment → Risk Response', with a checklist for regulators in Appendix 1 and illustrative examples of serious harm in Appendix 2.
- Table 1 lists 20 risk subtypes in three types. Type A, technical design flaws (eight), includes security vulnerabilities and attacks, lack of transparency or explainability, privacy infringement, unfair discrimination or bias, and false or misleading information. Type B, post-deployment operation and human-AI interaction (six), includes overreliance and unsafe use, fraud and misuse of deepfake technology, facilitation of cyberattacks, and unauthorized actions by autonomous AI agents. Type C covers six societal-structural and environmental impacts.
- Inherent-risk assessment (3.3.2): 'The mere possibility of harm suffices, and the actual occurrence of harm is not required', and the mitigating effect of existing laws, administrative measures or technical means is not counted at this stage.
- High-risk test (3.3.3): where a use case may cause serious harm to national security, the fundamental rights of the people, rights to life and safety, property protection, social order or the ecological environment, the regulator 'shall determine that the use case in question constitutes a high-risk AI application' under Article 17(1) of the Act.
- Support measures (3.4.1(a)): regulators also weigh 'the opportunity costs and the risk of weakened service capacity arising from not adopting AI', promote industry standards and self-regulatory codes (ISO 23894 and ISO 42001 may be consulted) and may provide self-assessment checklists; the Framework cites exchange of risk-management experience between the financial and healthcare sectors as cross-industry learning.
- Management measures (3.4.1(b)): requiring explanatory materials and disclosure, including proactive disclosure of content produced with generative AI or deepfakes; where risk reaches a certain degree, advance review such as an impact assessment before a system comes online, risk assessment and audit by an accredited third-party institution, retention of technical documents and recording of incidents; and restriction or prohibition under law where the harms listed in Article 5(1) cannot be effectively managed.
- Consequences of a high-risk finding (3.4.1(b)iv): the regulator shall require clear caution notes or warnings, clarify the attribution of liability and establish relief, compensation or insurance mechanisms, as Articles 5(2) and 17(1) of the Act provide.
- Review: the ministry will periodically review the risk table, and regulators are advised to set up continuous monitoring for use cases whose potential for harm is hard to determine.

## What changed for banks

The Framework is the implementing instrument that Article 16 of the AI Basic Act requires. It gives every sectoral regulator one method and one vocabulary for AI risk, and it makes 'high-risk' a formal determination with statutory consequences. For banks nothing changed on the day of issue: obligations arise only when the Financial Supervisory Commission applies the workflow to financial-sector use cases and sets or amends its own rules.

## Use cases it governs

- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)

## FAQ

### Does Taiwan's AI risk framework apply directly to banks?

No. Its primary subjects are the competent authorities for each industry, which must follow its workflow when they set risk-based management rules under Article 16(2) of the AI Basic Act. Banks are affected when the Financial Supervisory Commission applies it to financial-sector AI use cases.

### What counts as high-risk AI under Taiwan's framework?

A use case whose risk impact may cause serious harm to national security, the fundamental rights of the people, rights to life and safety, property protection, social order or the ecological environment. The assessment looks at inherent risk: the possibility of harm is enough, and existing safeguards are not counted until the response stage.

### When will the FSC apply the framework to financial services?

The Ministry of Digital Affairs' October 2026 report to the Legislative Yuan says it has reached consensus with eight agencies, including the Financial Supervisory Commission, and expects them to complete the framework's process by the end of 2026. The two-year period the AI Basic Act allows for adapting existing laws ends on 13 January 2028.

## Related documents

- [Taiwan FSC Agentic AI Security Consultation](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-agentic-ai-security-2026) — Consultation Document on the Security of Agentic AI in the Financial Industry (金融業運用代理AI安全諮詢文件) (Oct 13, 2026)
- [Taiwan FSC AI Attack Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-attack-recommendations-2026) — Challenges and Strategic Recommendations for the Financial Industry in Responding to AI Attacks (金融業應對AI攻擊的挑戰與策略建議) (Jul 14, 2026)
- [Taiwan AI Basic Act](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-ai-basic-act-2026) — Artificial Intelligence Basic Act (人工智慧基本法) (Jan 14, 2026)
- [Taiwan FSC AI Guidelines](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-guidelines-2024) — Guidelines for Artificial Intelligence (AI) Applications in the Financial Industry (Jun 20, 2024)
- [Taiwan FSC AI Core Principles](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-core-principles-2023) — Core Principles and Policies for Artificial Intelligence (AI) Applications in the Financial Industry (Oct 17, 2023)
- [OCC Bulletin 2026-54](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-54) — Super Intelligence: Supervisory Framework (Nov 4, 2026)
- [HKMA discussion paper on banks' use of Agentic AI](https://www.bankingnewsai.com/ai-regulation/documents/hkma-agentic-ai-discussion-paper-2026) — Discussion Paper on Agentic A.I. Governance in the Banking Sector (Nov 2, 2026)
- [Machado interview with Bloomberg (Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-bloomberg-interview-2026-10) — Interview with Bloomberg — Pedro Machado (Oct 30, 2026)

Last reviewed Nov 12, 2026. Cite the official text (https://law.moda.gov.tw/EngLawContent.aspx?id=104&lan=E) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/taiwan-moda-ai-risk-framework-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (46 authorities, 276 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.