The Committee commends the government for its recent efforts to advance Taiwan’s technology policy agenda. In 2025, the government announced the “Ten Major AI Infrastructure Projects” initiative to strengthen Taiwan’s long‑term competitiveness and technological leadership, introduced the AI Basic Act as the foundation for Taiwan’s responsible AI development, and marked the beginning of a more structured national investment in emerging technologies such as quantum computing. In addition, the Committee underscores that the resilience of Taiwan’s digital foundations is a core national imperative central to security, economic stability, and public trust.

To translate these ambitions into durable outcomes, international collaboration and sustained public–private partnership will be critical enablers. Whether in building resilience‑by‑design digital infrastructure across critical sectors, advancing responsible AI deployment, or preparing for the development of an ecosystem for emerging technologies such as quantum computing, close cooperation with trusted global partners and continuous engagement with industry are essential to accessing expertise, sharing best practices, and scaling innovation. In this context, the Committee emphasizes the adoption of risk‑based regulatory approaches that focus on actual security, privacy, and operational risks rather than rigid or technology‑specific mandates. Such frameworks can better accommodate technological complexity, ensure consistency between policy intent and implementation, and support innovation while strengthening Taiwan’s long‑term resilience and competitiveness.

Suggestion 1: Build a resilience-by-design digital infrastructure across government, financial services, healthcare, and critical infrastructure providers.

To safeguard national security, economic stability, and the continuity of essential public services, the Committee recommends that the Taiwan government adopt a resilience‑by‑design approach, in which continuity, recoverability, and adaptability are embedded as core design principles from the outset, in the modernization of national digital infrastructure, particularly for systems supporting critical functions across government, financial services, and healthcare. As digital technologies now underpin nearly all essential services, from social welfare administration and interbank settlement to healthcare delivery and national security operations, the resilience of underlying IT systems has become integral to public trust and societal stability. Any disruption to these systems, whether caused by cyber incidents, geopolitical shocks, or infrastructure failures, could result in far‑reaching economic, social, and reputational consequences.

While Taiwan has made significant progress in digitalization and IT modernization over the past decade, the increasing complexity and interdependency of digital systems, combined with a rapidly evolving risk environment, demand a fundamental shift in approach. The Committee believes that ensuring continuity under extreme and prolonged disruptions requires moving beyond incremental upgrades toward a resilience‑by‑design architecture. To achieve this outcome at scale, the Committee recommends a coordinated public‑private partnership model, supported by cross‑ministerial collaboration and dedicated budget allocation, to strengthen Taiwan’s national resilience architecture in a systematic and sustainable manner.

1.1   Foster cross‑ministerial resilience‑by‑design beyond data backup. Over the past few years, the Taiwan government has made important progress in establishing data backup mechanisms for systems supporting essential public services. Through targeted policies and investments, backup arrangements for key civilian and critical systems have been largely put in place, strengthening baseline preparedness and data protection.

However, experience has shown that data backup alone does not equal true resilience. In extreme scenarios, such as largescale cyber incidents, prolonged infrastructure disruptions, or geopolitical shocks, national resilience depends on the availability of backed-up data and the ability of core systems to remain operational.

From this perspective, the Committee recommends that the government elevate preparedness efforts beyond data backup and adopt a resilience‑by‑design framework, coordinated at the cross‑ministerial level. Given that critical digital systems span multiple authorities across government administration, financial services, healthcare delivery, and national security, resilience planning must be aligned across ministries to avoid fragmentation and systemic vulnerabilities.

1.2   Advance implementation and operational exercises through public‑private engagement. From the perspectives of government agencies, financial institutions, and healthcare providers, building resilience‑by‑design requires not only policy direction, but also practical implementation readiness. These sectors operate highly complex, mission‑critical systems with limited tolerance for disruption, while facing distinct operational, regulatory, and security requirements. To address these challenges effectively, the Committee recommends that the government initiate structured dialogue with trusted technology partners that have practical experience supporting resilience implementation and largescale continuity planning in other countries.

Such engagement should focus on translating resilience objectives into deployable architectures, operational models, and governance frameworks, rather than remaining at the conceptual or advisory level. International experience demonstrates that resilience cannot be validated solely through design reviews or documentation; it must be tested through implementation, simulation, and regular operational exercises. The Committee therefore encourages the government to work with experienced partners to support sector‑specific planning, technical validation, and the design of realistic stress scenarios tailored to public administration, financial services, and healthcare systems.

To support implementation, the Committee recommends incorporating joint drills, tabletop exercises, and cross‑sector simulations into national resilience planning. These exercises can help identify hidden dependencies, clarify decision‑making authorities, and strengthen coordination across agencies and critical institutions before crises occur, thereby shaping clear operational playbooks and ensuring that required resources are effectively allocated and ready to be mobilized. By embedding implementation and rehearsal into policy execution, Taiwan can move beyond theoretical preparedness and build confidence in the real‑world operability of its national digital resilience architecture.

Suggestion 2: Modernize Taiwan’s privacy framework through risk-based and globally aligned regulations.

The Committee commends the Preparatory Office of the Personal Data Protection Commission (PDPC) for the 2026 draft amendments to the “Regulations Regarding the Security Maintenance and Administration of Personal Information Files in Digital Economy Industries” for implementation of the Personal Data Protection Act (PDPA). However, the current drafts introduce rigid mandates and quantitative thresholds that may hinder innovation and increase compliance costs without proportionally enhancing privacy protection. To align with international standards such as the EU GDPR, we urge revision of the Enforcement Rules along the following lines:

2.1   Clearly define Business Contact Information (BCI) and exclude it from personal data protection. Establish a formal definition for BCI, which is information used solely for professional contact purposes (such as name, title, business address, and email). Consistent with global trends, BCI should be subject to streamlined processing requirements to facilitate efficient commercial operations while maintaining appropriate transparency.

2.2   Adopt a risk-based “harm threshold” for breach notifications. Notification obligations should trigger only when an incident poses a real risk of harm to individuals’ rights and freedoms. Furthermore, the 72-hour reporting window should commence from the moment a breach is reasonably confirmed with sufficient detail to provide meaningful notification, rather than upon initial awareness, to ensure notifications are accurate, complete, and actionable.

2.3   Shift from quantitative to risk-based “high-risk” definitions. Instead of relying solely on quantitative metrics such as “data volume” (for example, 10,000 entries) or “entity size,” the PDPC should define “High-Risk Non-Government Agencies” based on the nature and context of their processing activities, such as processing of sensitive data categories, systematic largescale profiling, or automated decision-making with significant effects on individuals.

2.4   Ensure technology neutrality and outcome-based security measures. Regulations should avoid prescriptive technical requirements, such as specific “password complexity rules” or mandatory “five-year record-retention periods,” which risk becoming obsolete as technology evolves. Instead, regulations should remain technology-neutral and outcome-based, allowing organizations to implement security measures appropriate to the risk, including modern controls such as multi-factor authentication, encryption, and adaptive authentication mechanisms.

2.5   Clarify the controller-processor accountability framework. Clearly distinguish between Data Controllers (entities determining purposes and means of processing) and Data Processors (entities processing on behalf of Controllers). Primary accountability for breach notifications and regulatory compliance should rest with the Controller. Processors should be required to notify the Controller promptly upon becoming aware of a breach and provide necessary assistance to enable the Controller to meet its obligations.

2.6   Establish an adequate transition period. To allow organizations to adjust internal policies, conduct personnel training, update technical systems, and implement necessary organizational changes, we recommend that the government provide a minimum 12-month transition period following the promulgation of new subsidiary regulations.

Suggestion 3: Align public ICT procurement with risk‑ based cybersecurity management.

The Committee welcomes Taiwan’s efforts to strengthen information and communications technology (ICT) security through the 2025 amendment to the Cybersecurity Management Act and the Regulations for the Review of Products Harmful to National Cyber Security issued by the Ministry of Digital Affairs (MODA).

However, broad country-of-origin (COO)-based restrictions continue to be applied by government agencies in public procurements without specified technical standards or rationale.

Moreover, inconsistencies remain between the legal framework established by the Cybersecurity Management Act (CSMA) and the tendering and bidding templates issued by the Public Construction Commission (PCC), which continue to allow explicit exclusions based on country of manufacture. In an era of software‑defined hardware and globally distributed production, manufacturing location alone is increasingly an unreliable factor in assessing cybersecurity risk, as it may not reflect who controls a product’s code, updates, or data flows.

MODA’s regulation deliberately adopts a risk‑based, reviewable approach, recognizing that modern ICT products are developed, assembled, and maintained across multiple jurisdictions. Aligning PCC procurement guidance with this entity‑based framework would reduce uncertainty for procuring agencies, improve consistency across government practice, and better reflect the intent of the CSMA.

3.1 Focus on risk-based regulatory approach. The Committee encourages the Taiwan government, including MODA and PCC, to adopt clearer and more risk‑based cybersecurity standards for ICT products and components, focusing on technical risk profiles rather than applying broad COO-based restrictions.

3.2 Harmonize PCC model contracts with the CSMA framework. This Committee encourages harmonizing PCC’s procurement guidance with MODA’s entity‑based approach (that is, banning Chinese brands, not made-in-China products or components) and remove COO-based procurement biases in model contracts. Rather than allowing blanket exclusion of products made in specific country or region, the PCC model contracts should replace that with language in line with the “Regulations for the Review of Products Harmful to National Cyber Security.”

3.3 Adhere to good regulatory practices (GRP) in the consultation process. We welcome the Taiwan government’s sustained, structured dialogue with industry associations. The Committee recommends fully implementing a 60‑day public consultation period for any important law amendments and regulatory revisions to enable meaningful industry input.

Suggestion 4: Foster Taiwan’s quantum ecosystem through trusted international partnerships and strengthened national preparedness.

Quantum computing is rapidly approaching a critical inflection point: quantum advantage, the moment when quantum systems outperform classical computing on targeted, high value tasks. Recent evidence suggests that quantum advantage could emerge as early as this year. The Committee welcomes the recent launch of Taiwan’s Phase II Five‑Year National Quantum Strategy (2027-2031), which reflects many of the recommendations put forward in AmCham’s 2025 White Paper. The Phase II framework demonstrates the government’s commitment to advancing quantum hardware, integration with high‑performance computing, and national research infrastructure, laying an important foundation for Taiwan’s long‑term quantum competitiveness.

While continued investment in quantum systems remains essential, the Committee recommends that the Taiwan government also put greater effort into accelerating quantum-enabled innovation and promoting research on software algorithms and application-development across priority domains, fostering the quantum ecosystem aligned with Taiwan’s scientific and economic goals. This innovation also needs to be underpinned by a strategic, multi-year transformation toward quantum-safe cryptography and “crypto-agility” to ensure that Taiwan’s digital ecosystem remains resilient against the systemic risks posed by the quantum era.

4.1   Strengthen international collaboration as a core pillar of Taiwan’s Phase II five-year quantum strategy, focusing on deeper engagement on software and applications. As quantum computing moves closer to practical deployment, international experience increasingly demonstrates that the competitiveness of a national quantum program is shaped by the strength of the surrounding ecosystem. Quantum advantage does not emerge from hardware alone; it is realized through the interaction of hardware, software, algorithms, talent, and application‑driven use cases across priority domains.

Quantum networking capabilities are also needed for interconnecting diverse quantum platforms and accelerating the path to practical utility. Countries that are leading in quantum development are therefore putting their focus on ecosystem building, linking research institutions, industry, and users to translate quantum capabilities into real‑world impact.

For Taiwan, this ecosystem‑centric approach is particularly important. While Taiwan’s strengths in hardware, semiconductor, and advanced manufacturing provide a solid foundation, quantum‑enabled innovation ultimately depends on software, algorithms, and domain expertise that determine how quantum systems are used. A robust ecosystem will enable quantum infrastructure to be effectively utilized and translated beyond research environments into practical, real‑world applications.

The Committee therefore recommends that international collaboration be positioned as a core pillar of Taiwan’s Phase II quantum strategy, especially in areas related to software, algorithms, and application development. Quantum ecosystems are inherently global, and meaningful participation in the international quantum community can help Taiwan rapidly develop quantum talent, accelerate scientific discovery, and strengthen its position within the regional quantum landscape. International engagement must prioritize alignment with globally recognized standards and certification regimes to ensure seamless interoperability and strengthen the collective resilience of Taiwan’s digital ecosystem.

4.2   Incentivize international partners that establish and expand quantum ecosystems linked to Taiwan. The Committee also encourages the government to incentivize international partners that establish and expand quantum ecosystems linked to Taiwan. Such programs could support collaborative projects that bring together international partners, domestic industry, and research institutions, helping to accelerate ecosystem formation while enabling talent development through hands-on collaboration and skill transfer.

4.3   Support domestic industry players and emerging startups to develop quantum applications. Alongside these efforts, the Committee recommends that the government establish targeted incentives to encourage domestic industry players and emerging startups to invest in quantum software, algorithms, and application development. While international collaboration is essential to accelerate ecosystem formation, the long‑term sustainability of Taiwan’s quantum ecosystem will depend on the active participation of domestic companies that are willing to build, apply, and scale quantum‑enabled solutions within Taiwan.

4.4   Strengthen Taiwan’s quantum‑safe preparedness through a unified national strategy. As quantum computing continues to advance, one of its long‑term risks lies in the potential to compromise existing encryption standards. Given that quantum security spans technology development, cybersecurity policy, economic resilience, and national defense, the Committee urges the Taiwan government to establish a unified, cross‑agency task force to drive coordinated planning, implementation, and oversight. This task force should bring together relevant authorities responsible for digital affairs, cybersecurity, financial regulation, and national security to ensure shared accountability and coherent policy execution.

The Committee also encourages the government to incorporate quantum‑safe standards as a requirement in the planning and deployment of IT systems supporting critical infrastructure. At the same time, strengthened public‑private collaboration will be essential to align policy objectives with technical implementation and support effective execution of Taiwan’s national quantum‑safe strategy. Implementation of Taiwan’s quantum-safe migration should follow a structured phasing model, beginning with “no-regret” actions such as cryptographic asset discovery, followed by controlled pilot programs and the eventual full-scale migration of the most critical business functions, systems, and information assets.

Quantum-safe governance needs to be anchored at companies’ executive and board levels to establish clear authority, provide funding alignment, and sustained organizational commitment. This migration should not be viewed as a standalone technical upgrade, but rather as a strategic transformation that modernizes legacy security models and enhances overall digital trust.

Suggestion 5: Advance AI policy through continued public-private collaboration.

The Committee thanks MODA and the National Development Council for providing the technology industry with opportunities to contribute to the development of the AI Basic Act and its risk classification framework. Related supporting measures remain under deliberation, including MODA’s risk framework, sector guidelines to be implemented by the respective competent authorities, tools or methods to be adopted for AI risk assessment and evaluation, and revisions to existing AI guidelines governed by respective competent authorities, such as the “Reference Guidelines for the Use of Generative AI by the Executive Yuan and Its Subordinate Agencies (Institutions).” We therefore urge continued public-private collaboration to gather industry input to enable technology providers to share industry insights and international governance developments. Such collaboration would drive innovation, promote responsible AI governance among government agencies, and help Taiwan maintain and enhance its global competitiveness.