UU AI Jangan Sampai Menjadi Aturan yang Sudah Tua Saat Baru Berlaku

Bayangin Indonesia mulai menyusun UU AI hari ini.

Draft satu tahun.

Pembahasan dua tahun.

Harmonisasi.

Disahkan.

Ketika berlaku, model yang menjadi contoh awal sudah tidak dipakai.

Agent sudah lebih autonomous.

Interface berubah.

Architecture baru.

Ini risiko nyata.

Legislative process memang lambat.

Dan seharusnya tidak secepat software release.

Undang-undang butuh deliberation.

Masalahnya bukan hukum lambat.

Masalahnya kalau hukum ditulis terlalu dekat dengan teknologi hari ini.

Maka ketika selesai, outdated.

Indonesia sudah sadar tension ini.

Pada 2026, pemerintah menekankan regulasi AI harus adaptif dan tidak reaksioner.

RPerpres AI juga diposisikan sebagai test case sebelum UU AI.

Itu approach yang cukup sehat.

Belajar dulu.

Jangan buru-buru membekukan detail.

Atur prinsip yang tahan lama

Apa yang relatif stabil?

Hak manusia.

Accountability.

Safety.

Fairness.

Transparency.

Data protection.

Right to challenge.

Ini bisa menjadi core law.

Teknologi berubah.

Prinsip tetap.

UU sebaiknya bicara: sistem high-impact harus dikelola risikonya.

Bukan: model dengan parameter lebih dari X wajib Y.

Parameter count bisa irrelevant besok.

Principle-based but enforceable.

Jangan terlalu vague.

“AI harus bertanggung jawab” tidak cukup.

Need duty.

Risk assessment.

Human oversight.

Incident.

Audit.

Framework stable.

Detail flexible.

Pisahkan UU dan technical standard

Ini architecture penting.

UU: hak, kewajiban, regulator, liability.

Peraturan turunan: kategori, procedure.

Technical standard: benchmark, metric, test.

Semakin teknis, semakin mudah update.

Kalau benchmark masuk UU, impossible.

Kalau semua detail di guidance nonbinding, weak.

Layering.

Indonesia already uses layered regulation in many sectors.

AI should too.

Use delegated authority carefully.

Regulator needs mandate to update list.

For example: high-risk use case annex updated annually.

But guard against arbitrary.

Public consultation.

Criteria.

Judicial review.

Flexibility with accountability.

Build mandatory review cycle

UU AI bisa punya review clause.

Every two or three years.

Government reports to DPR.

What changed?

Incident.

Compliance cost.

New technology.

Then amendment if needed.

Not wait crisis.

Review doesn’t mean law automatically expires.

It means institutional learning.

Sunset clause for technical experiment

Some provisions can expire unless renewed.

Pilot restriction.

Emergency rule.

Sandbox.

This avoids temporary panic rule becoming permanent.

Not all rights need sunset.

Core principle stable.

Technical intervention can.

Use regulatory sandbox

Before writing permanent rule for new use case, test.

Company deploy limited.

Regulator observe.

Users protected.

Data collected.

Then rule.

OECD has documented AI regulatory sandboxes as tools for authorities and firms to test innovation under controlled conditions.

Indonesia already knows sandbox in fintech.

AI can use.

Especially new agentic systems.

Don’t legislate from demo.

Regulate from evidence.

Create AI incident database

Law stays fresh if regulator sees real harm.

Incident reporting.

Near miss.

Pattern.

If new risk rises, guidance update.

Without data, law reacts to viral case.

This produces overreaction.

Institutional memory keeps law grounded.

Indonesia should start before UU.

RPerpres phase can build.

Update definitions carefully

AI definition is tricky.

Too broad: calculator included.

Too narrow: new architecture escapes.

Use international baseline.

Machine-based system.

Inference.

Outputs like predictions, content, recommendations, decisions.

Varying autonomy.

But avoid tying to one algorithm.

Definition should survive.

OECD updated AI definition internationally.

EU aligned.

Indonesia can align enough for interoperability.

But local legal language matters.

Model versus system

UU should distinguish.

Foundation model.

AI system.

AI agent.

Deployer.

Provider.

Not every obligation same.

If law only talks model, application risk missed.

If only application, systemic provider risk missed.

Layer responsibilities.

This survives model evolution.

Capability-based trigger

Some regulation should activate when capability crosses threshold.

Not model brand.

Example: can autonomously execute financial transaction.

Can generate realistic synthetic media at scale.

Can interact with critical infrastructure.

Capability.

Then control.

This works even new model.

Permission matters.

Agent era needs action governance.

Material change principle

System approval cannot be forever.

If material change: reassess.

What is material?

Autonomy increase.

New tool.

Sensitive data.

New use.

Model capability jump.

Technical guidance can define.

This keeps regulation alive without re-legislating every update.

Monitoring after deployment

Traditional certification: pass once.

AI: drift.

Need post-market monitoring.

Error.

Incident.

Complaint.

Bias.

Security.

Vendor update.

High-risk systems regularly evaluated.

NIST AI RMF explicitly recommends testing before deployment and regularly during operation.

Lifecycle regulation.

Not static license.

Machine-readable regulation

Future-looking idea.

Technical obligation should be published structured.

API.

Version.

Change log.

Companies can automate compliance.

If high-risk list updates, system alerts.

This makes law more responsive.

Government itself should modernize regulatory delivery.

Not only PDF.

PDF remains legal record.

But structured data helps implementation.

Version control

Every guidance needs version.

Effective date.

Transition.

Change summary.

Developers are used to release notes.

Regulator should learn.

If guidance silently updated, uncertainty.

Transparent change management.

Business needs predictability.

Adaptiveness cannot become randomness.

This balance critical.

Stable principles.

Predictable update process.

Technical agility.

Don’t chase every hype

Regulator also needs restraint.

New model release doesn’t mean new law.

Wait.

Is there new harm?

Existing framework insufficient?

If current rules already cover fraud, no AI fraud law needed.

Avoid legislative inflation.

Sometimes old law works.

UU ITE already has Agen Elektronik concept.

UU PDP automated decision rights.

Consumer law.

Copyright.

AI law should fill gaps.

Not duplicate.

Regulatory mapping before drafting.

Include technology experts in legislature

DPR needs support.

Not every legislator should code.

But committee needs technical advisor.

Explain model architecture.

Agent.

Security.

Benchmark.

Otherwise lobbying dominates.

Vendor gives one story.

Civil society another.

Independent expert helps.

Public hearing should include engineer and affected user.

Socio-technical.

Build regulator talent

Adaptive law useless if regulator can’t understand update.

Hire technical staff.

Train.

Partnership university.

Lab.

Testing.

Regulator must be able to ask hard question.

Not only read compliance.

Capacity is law’s runtime.

Without capacity, adaptive clause decorative.

Protect startups from moving target

Frequent updates can burden business.

Need transition period.

SME guidance.

Safe harbor.

If company followed current standard in good faith, don’t punish retroactively for future rule.

Legal certainty.

Innovation needs.

High-risk company still must act quickly when serious risk discovered.

Balance.

International interoperability

Indonesia cannot regulate in isolation.

Global model provider.

Cross-border data.

ASEAN.

EU.

US.

Align terms where possible.

This reduces compliance cost.

But don’t outsource values.

Local protection.

Children.

Bahasa.

Public service.

Use international standard as base.

Add local layer.

Measure law effectiveness

What does success look like?

Not number of documents.

Not number of fines.

Metrics:

incident severity down.

Complaint resolution.

High-risk inventory coverage.

Audit quality.

Innovation.

SME compliance cost.

Public trust.

Regulator response time.

If law not improving outcome, update.

Regulation itself needs evaluation.

Meta-governance.

Be willing to delete rule

Government loves adding.

Rarely removing.

Adaptive law requires deletion.

If obligation no longer useful, remove.

If technology obsolete, retire.

If cost > benefit, change.

Regulatory humility.

No one knows 2030 AI exactly.

Law should admit uncertainty.

Create process to learn.

Don’t pretend prediction.

UU AI Jangan Sampai Menjadi Aturan yang Sudah Tua Saat Baru Berlaku.

Cara menghindarinya bukan membuat DPR bergerak secepat startup.

Itu impossible dan probably undesirable.

Caranya membuat architecture hukum yang berbeda.

Core principles stable.

Technical standards flexible.

Review mandatory.

Testing continuous.

Incident feeds learning.

Material changes trigger reassessment.

Regulator has technical capacity.

Indonesia punya kesempatan sekarang.

Perpres AI sebagai test case bisa menjadi ruang belajar.

Kalau fase ini dipakai serius, UU nanti tidak perlu dibangun dari teori.

Ia dibangun dari evidence penggunaan AI di Indonesia.

Itu jauh lebih valuable.

Ada satu mekanisme lagi yang worth dipertimbangkan: regulatory trigger berbasis incident dan capability. Artinya regulator tidak harus menunggu jadwal review dua tahunan jika muncul risiko material baru. Mereka bisa mengeluarkan guidance sementara atau memulai review khusus dengan dasar yang sudah ditentukan di UU.

Tapi emergency power harus dibatasi.

Ada alasan tertulis.

Ada masa berlaku.

Ada public review.

Kalau tidak, adaptiveness berubah menjadi ketidakpastian hukum.

UU juga sebaiknya mewajibkan pemerintah mempublikasikan implementation report. Bukan hanya berapa perusahaan terdaftar, tetapi temuan nyata: kategori high-risk yang paling banyak, incident, biaya compliance, bottleneck auditor, dan perubahan teknologi.

Data ini membuat DPR bisa mengevaluasi apakah norma masih relevan.

Untuk teknologi yang berubah cepat, legislative oversight harus lebih aktif daripada sekadar menunggu gugatan atau scandal.

Kita juga perlu mekanisme harmonisasi dengan aturan sektoral. Kalau OJK memperbarui ketentuan AI finance, jangan sampai bertentangan dengan guideline umum Komdigi. Central coordination harus punya cara menyelesaikan conflict.

Dan jangan lupa archive. Ketika standard berubah, versi lama tetap harus tersedia karena keputusan masa lalu dinilai berdasarkan rule saat itu. Version history menjadi bagian legal certainty.

Future-proof law bukan law yang selalu berubah.

Ia law yang berubah melalui proses yang bisa diprediksi, terdokumentasi, dan diuji.

Satu hal yang sering dilupakan adalah anggaran pembaruan. Setiap kewajiban review, testing, atau standard baru butuh orang dan uang. Kalau UU memerintahkan regulator adaptif tetapi tidak membangun kapasitas dan budget, hasilnya tetap statis.

Maka fiscal planning harus masuk regulatory design.

Siapa membiayai lab?

Siapa melatih auditor?

Siapa menjaga incident database?

Future-proofing bukan hanya redaksi pasal. Ia juga investasi institusi yang membuat pasal bisa terus hidup.

Tanpa kapasitas itu, aturan adaptif hanya akan terlihat modern di atas kertas tetapi lambat ketika dipakai menghadapi teknologi nyata.

Karena hukum yang hidup selalu membutuhkan institusi yang ikut belajar.

Karena undang-undang yang future-proof bukan undang-undang yang berhasil menebak teknologi masa depan.

Undang-undang future-proof adalah undang-undang yang tahu cara berubah ketika tebakan kita salah.