The Committee recognizes the government’s foundational role in advancing Taiwan’s leadership within the global technology ecosystem. To fully realize the administration’s focus on national resilience, there is a vital need for a unified digital governance roadmap that transcends fragmented, ministry-specific mandates. Establishing a coherent digital sovereignty framework is essential to facilitating the distributed architectures and global AI capabilities required for systemic operational resilience. Furthermore, formalizing mechanisms to ensure adherence to Intermediary Liability principles will translate abstract guidelines into the enforceable operational standards necessary to catalyze infrastructure investment and provide the legal certainty required for long-term digital growth and stability.

Developing transparent, standardized procedural frameworks for government data requests is critical to providing the principled oversight required for exercises of public authority that implicate constitutional privacy rights. Simultaneously, creating streamlined pathways for regulatory pilot programs will reduce administrative barriers and enable agile testing of frontier technologies to sustain continuous innovation. To maintain Taiwan’s competitive edge, we urge the establishment of cross-ministerial coordination mechanisms led by key authorities including the Ministry of Digital Affairs (MODA), National Communications Commission (NCC), Personal Data Protection Commission (PDPC), and National Development Council (NDC). By accelerating policy development for distributed AI architectures and empowering local enterprises to leverage global innovation, Taiwan can ensure that its regulatory environment remains predictable and robust. Collectively, these institutional reforms will preserve Taiwan’s democratic values while cementing its position as a secure, resilient, and innovation-driven hub.

Suggestion 1: Adopt a governance-based approach to digital sovereignty.

The Committee welcomes the government’s strong commitment to advancing artificial intelligence, digital services, and data-driven innovation across Taiwan’s economy. Distributed digital infrastructure, an interconnected mesh of computing, storage, and network resources deployed across multiple locations, has become central to this transformation. As Taiwan advances its digital sovereignty objectives, ensuring that critical workloads remain secure, resilient, and under appropriate governance is a shared priority. In an environment of rising geopolitical risk, where escalating tensions and the threat of kinetic conflict increasingly make digital infrastructure a direct target, architectures that distribute critical workloads across multiple regions offer greater continuity and resilience than those concentrated in a single location.

Yet in practice, sovereignty requirements have often been interpreted across public sector and regulated industries as necessitating that infrastructure, workloads, and data remain physically within Taiwan’s borders, even where no explicit legal mandate requires it. In some cases, this interpretation has led to distributed digital infrastructure and AI solutions being excluded from higher security tiers in procurement evaluations. Broadening this framework to recognize governance-based approaches — meaning policy, access controls, and oversight ensuring secure, compliant AI use — could unlock access to global knowledge networks, international datasets, and computing resources, while reducing costs and expanding Taiwan’s capacity to participate in the global digital economy.

Internationally, a growing number of governments have acknowledged that digital sovereignty and infrastructure resilience are complementary objectives, best achieved through governance frameworks rather than infrastructure location alone. Emerging policy approaches have sought to define clear national requirements for sensitive data and critical workloads, accept internationally accredited security certifications as credible evidence of compliance, and promote resilient architectures that ensure continuity and availability of critical services.

Recognizing Taiwan’s distinct geopolitical context, the Committee is committed to working with the government on models that maintain national control while enabling access to advanced digital and AI capabilities. Where agencies develop sovereign cloud frameworks independently, as seen with the “sovereign cloud” guidelines announced by the Ministry of Health and Welfare (MOHW) in January 2026, there is a risk of divergent definitions emerging across sectors. The Committee underscores the value of a coordinated whole-of-government approach to ensure consistency and clarity for all stakeholders, and respectfully offers the following recommendations:

1.1   Consider designating MODA as the coordinating agency for digital sovereignty interpretation. In this coordinating role as Taiwan’s central digital governance authority spanning cybersecurity, digital infrastructure, and platform governance, MODA could help align interpretations across ministries and sector regulators, establish common compliance frameworks and technical standards, and support an interministerial review process with a public feedback portal for industry input.

1.2 Adopt a digital-sovereignty-by-design approach. In advancing Taiwan’s digital sovereignty objectives, it is important to recognize that sovereignty is not limited to data location or infrastructure ownership alone. Sovereign-by-design approaches instead define sovereignty through effective control over data and operational decision-making, supported by robust governance and resilient architectures that are designed across on‑premises, public cloud, and hybrid‑cloud environments to ensure continuity, flexibility, and risk diversification. Such an approach allows governments to maintain jurisdictional authority and accountability while responsibly leveraging global innovation across cloud and AI technologies.

1.3 Encourage MODA’s Department of Digital Service to develop referential guidance on governance-based sovereignty. The Committee encourages MODA to consider issuing referential guidelines that help agencies recognize deployment models meeting sovereignty objectives across core domains such as data governance, cybersecurity, regulatory compliance, technological resilience, and digital infrastructure continuity, alongside cross-government education to support consistent interpretation across ministries and sector regulators.

1.4 Apply good regulatory practice (GRP) principles to sovereignty-related guidelines. The Committee encourages relevant regulators to apply GRP principles, including advance notice, public consulta-tion, and transparent feedback consideration, consistent with agreements reached under the U.S.-Taiwan Initiative on 21st-Century Trade.

Taiwan’s ambition to become a trusted center for next-generation AI development demands more than physical infrastructure. It requires access to the full AI technology stack, ranging from secure and scalable compute capacity to advanced models, high-quality data, and specialized services. Clear and predictable regulations that safeguard digital sovereignty while enabling integration with global capabilities are essential. A governance-based approach to digital sovereignty, grounded in operational accountability rather than physical boundaries, provides a more durable foundation for AI-driven growth.

Suggestion 2: Ensure adherence to internationally recognized intermediary liability principles by all government agencies.

The Committee acknowledges the limited but meaningful progress that has occurred in Taiwan’s approach to digital governance. The NCC’s deliberation and development of rule-making guidance that incorporates principles from our previous recommendations is a welcome step. Additionally, the MOHW’s enforcement guidelines on the Tobacco Hazards Prevention Act, while imperfect, demonstrate positive receptiveness to stakeholder concerns regarding platform liability.

However, these incremental improvements remain insufficient to address the fundamental challenge: the absence of a binding, government-wide mechanism ensuring that all agencies adhere to internationally recognized intermediary liability principles.

Our member companies have experienced significant disparities in regulatory awareness and practice across government agencies. While some ministries demonstrate an understanding of balanced digital governance, others continue to pursue approaches that conflict with international best practices and democratic norms. The lack of mandatory compliance mechanisms means that well-intentioned efforts, such as the preliminary discussions around rule-making principles currently underway at the NCC, risk becoming aspirational rather than operational standards.

This inconsistency creates legal uncertainty that discourages platform investment, regulatory fragmentation requiring platforms to navigate contradictory requirements, inadequate stakeholder engagement undermining multi-stakeholder governance, and potential conflicts with international commitments regarding freedom of expression.

The Committee urges the Executive Yuan to establish concrete institutional mechanisms ensuring consistent application of intermediary liability principles.

First, we urge the Executive Yuan to institutionalize a formal cross-ministerial review mechanism for all draft legislation, enforcement rules, and administrative measures affecting online intermediaries. Facilitated by the NCC and MODA, this mechanism should:

a.)    Conduct principle-conformity assessments to ensure alignment with safe harbor standards, including opposition to general monitoring obligations and recognition of service diversity;

b.)    Require transparent regulatory impact analysis addressing proportionality, innovation, cross-border trade, and freedom of expression; and

c.)    Mandate structured stakeholder consultation to reinforce multi-stakeholder governance and regulatory legitimacy.

Second, to translate principle into practice, we recommend that the government develop concrete model laws or template provisions embodying the intermediary liability standards articulated in the NCC’s guidance. This effort should be facilitated and coordinated by the NCC to build upon, and not dilute, the substantial analytical groundwork already completed. By leveraging the NCC’s prior deliberations, Taiwan can efficiently convert high-level guidance into standardized legislative language, including model safe harbor clauses, notice-and-takedown procedures, Good Samaritan protections, and due-process safeguards.

Such model instruments would function as regulatory infrastructure to foster accelerated policy development, enhance predictability for enterprises, and ensure that emerging sectoral regulations remain anchored in coherent digital governance norms.

Taiwan has made measurable progress in articulating the right principles. The next phase should focus on institutionalization and implementation. By coupling centralized oversight with model legislative frameworks, Taiwan can embed consistency into its system, safeguard democratic values, and take a leading position as a trusted and innovation-forward digital economy in the region.

Suggestion 3: Adopt a whole-of-government framework for lawful and accountable government data requests.

The Committee remains concerned that Taiwan has not made substantive progress in addressing structural deficiencies in the government’s approach to requesting user data. Over the past year, administrative agencies have continued to issue broad and inconsistent demands for user information in the context of administrative investigations, often without clear procedural safeguards or harmonized standards.

The PDPC Preparatory Office has indicated that sector-specific laws prevail and that individual agencies retain autonomy in exercising their statutory powers. While we acknowledge the complexities of inter-agency governance, this position inadequately reflects the PDPC’s mandate as an independent supervisory authority responsible for safeguarding personal data and privacy rights.

Government requests for user data are exercises of state authority that directly involve the constitutional right to privacy and informational self-determination. As such, they warrant principled oversight and consistent implementation across sectors. International practice has shown that independent data protection authorities can align enforcement standards across government departments. Japan’s Personal Information Protection Commission, for example, works with sector regulators to align guidance and enforcement practices across industries and the public sector.

The Committee recommends the following:

3.1   Establish a cross-agency data request governance framework. The PDPC should lead the articulation of overarching principles governing all government requests for personal data, regardless of sector. These principles should reflect internationally recognized standards, necessity, proportionality, legality, transparency, accountability, and effective redress, consistent with international standard such as the OECD’s “Declaration on Government Access to Personal Data Held by Private Sector Entities.” Sectoral authorities may retain enforcement authority, but their practices should align with unified privacy guardrails applicable across government.

3.2   Introduce robust procedural safeguards and due-process mechanisms. Requests for user data, particularly content data and sensitive personal information, should be subject to clearly defined legal thresholds, including judicial authorization where appropriate. Service providers must have the ability to review and challenge overly broad or unlawful demands. Importantly, where notification would not undermine legitimate investigative purposes, data subjects should be informed by the requesting government agency. As the data request constitutes an act of state power, the responsibility for transparency and accountability to the affected individual should rest with the state. Data subjects should also have meaningful avenues to seek review or redress.

3.3 Eliminate mandatory retention of data when only for administrative convenience. Mandated retention of user data solely to facilitate potential future administrative access creates systemic cybersecurity and privacy risks. Data minimization should be the default principle. Any retention obligations must be narrowly tailored, demonstrably necessary, and subject to periodic review.

3.4   Institutionalize transparency and accountability mechanisms. Taiwan should establish a centralized reporting mechanism to document and categorize government data requests. Aggregated transparency reporting, covering the volume, legal basis, and outcomes of such requests, would strengthen public trust and align Taiwan with leading digital democracies.

3.5   Enhance technical and legal capacity across agencies. The PDPC should coordinate capacity-building initiatives to ensure that agencies understand the technical constraints, potential cross-border legal conflicts, and compliance risks faced by multinational providers.

A predictable, rights-respecting framework will reinforce Taiwan’s democratic governance, reduce regulatory fragmentation, and strengthen its competitiveness as a trusted digital economy.

Suggestion 4: Support streamlined and effective pilot-program deployment.

When an established business operating in Taiwan seeks to initiate a self-funded pilot program requiring temporary regulatory flexibility, engagement with the relevant government agency is a necessary first step. But the typical response is that no existing legal basis permits the proposed activity, or political appointees may cite political sensitivities or the absence of social consensus as grounds for deferral. The ultimate outcome is inability to proceed without explicit legislative approval.

From an industry perspective, the absence in Taiwan of an institutionalized mechanism for innovators to test and gather real-life data on the implementation of new technologies and models in a temporarily regulation-exempt environment makes the risk of “being the first” unacceptably high. When that cost is prohibitive, it is not only private sector resources and innovation capacity that are impacted. The technologies themselves, including those with potentially significant public benefit, will migrate to more receptive markets. The inability of companies and the government to engage in a good-faith mutually beneficial process for introducing promising technology is puts Taiwan, which should be known for its technology leadership, in an unfavorable light.

Taiwan’s highly cautious approach to public administration, reinforced by vibrant media scrutiny of government conduct and policies, creates a regulatory environment that is too rigid and costly for deployment of quick-launching pilot programs, stifling momentum in the digital economy and technology sectors. An institutionalized, clearly structured pilot pathway would enable the private sector, overcoming those obstacles to progress, to propose and execute pilot programs in partnership with government agencies, and without having to internalize the costs of political and administrative hurdles inherent to Taiwan.

The NDC is already the designated convener of inter-agency discussions (according to the Executive Yuan’s Circular No. 1072000064 of January 16, 2018), involving platform businesses and their associated service providers and users. To help fast-track digital transformation and AI-readiness to meet today’s societal needs, the content of this circular requires updating to reflect today’s innovation cycle involving platforms and non-platform businesses. The Committee urges the NDC to institute revisions in line with the following principles:

• Move beyond the current legal and policy coordination and actively facilitate pilot-program deployment, thereby helping to fast-track digital transformation and AI-readiness.
• Support technology pilot programs as a default position in the absence of material and imminent institutional blockers, such as human-rights violations or cybersecurity and national security threats.
• Set a maximum three-month review period for interagency deliberations convened by the NDC, with a further three-month implementation window from approval to launch.
• Require post-review documentation of failed applications, using the findings to identify problem areas in need of attention.