The Philippines has no AI law yet. That does not mean nothing applies to you — the Data Privacy Act, the National Privacy Commission's AI guidelines, and the Tax Code already do. Here is where the rules actually stand, and how QueryKing is built to sit inside them.
Written for finance leads and boards asking one question: if the BIR questions a filing an AI touched, what can you show?
Most AI governance material is written for companies running hundreds of models. If you are a Philippine business putting invoices through an automated system, the picture is far simpler than the noise suggests — and the binding parts have nothing to do with an AI act.
Several bills are live, including a proposed Artificial Intelligence Development and Regulation Act. Earlier filings proposed an AI Development Authority and a Philippine Council on Artificial Intelligence. The drafts lean toward promoting adoption, with strict rules reserved for high-risk uses.
This is the lane that matters. The Data Privacy Act of 2012 applies to AI systems today — the National Privacy Commission said so explicitly. Waiting for an AI act is not a compliance position.
Relevant to exporters, outsourcing providers and anyone running our Executive AgentOS into an EU-facing business. Obligations arrive in waves, and the 2026 delay was narrower than the headlines suggested.
They will ask a much smaller question, and it will be about one invoice. What changed it. When. On whose authority. On what basis. Governance is not a policy document you write once and file — it is whether you can answer that question a year later, without the person who was there, and without a spreadsheet nobody trusts. Everything below exists to make that answer boring.
Every claim on this page describes how the system is actually built, not a policy we aspire to. The short version: the AI explains and tidies. It never decides whether you are compliant, and it never invents a tax fact.
Structural BIR EIS validation — TIN digit counts, date windows, positive amounts, VAT arithmetic — is plain code with no AI call in it. These are mechanical checks. Routing them through a language model would add cost, latency and the risk of a confident wrong answer, and buys nothing. The same invoice always gets the same verdict.
Writing the plain-English exception report your accountant reads, and normalising formatting — a date written five different ways, "Php" versus "PHP". That is the whole remit. Separators get cleaned up; digits are never invented.
A missing TIN with nothing to infer from, a total that does not reconcile, an invoice backdated beyond the limit — these are never auto-fixed. Neither is a zero-VAT sale whose tax treatment is undeclared: zero-rated and exempt sales genuinely owe ₱0, and no model should guess which one you meant. It goes to a person.
No update and no delete ever runs against the log. It is deliberately not tied to the invoice record, so it survives even if the invoice is deleted. Every automatic correction lands in it as a visible change, attributed and timestamped — not a silent edit.
The BIR EIS acknowledges asynchronously. If an acknowledgment does not arrive, QueryKing escalates instead of resending. A duplicate filing with the BIR is a mess you never want to clean up — that is a decision worth a person's five minutes.
Each taxpayer transmits under their own key. Keys are held encrypted, with the unlock key kept outside the database entirely, so possession of the database is not possession of the keys. Key material never leaves the server.
One export produces the whole picture: every invoice, every transmission attempt, every exception with how it was resolved, the full audit log, and a manifest stating what is inside and over what window. Built to be handed to an examiner, not decoded by an engineer.
Tax Code §235, as amended by the EOPT Act, sets a five-year floor. QueryKing keeps records for ten — because §222 lets the BIR assess within ten years on a false or fraudulent return, or a failure to file. That is precisely the moment you need the record to still exist.
Executive AgentOS answers the governance question by removing it. It runs on your AI subscription and your drive — we never host, hold, or resell your data. Every note is a plain file you can open without us. Confidential exclusions are set on day one, so some things never enter the system at all. The safest data-processing arrangement is the one where nobody else is processing your data.
Bring your auditor's checklist, your data protection officer, or your most sceptical board member. We will walk the audit trail live — not a slide about it.
Email us directly: queryking@proton.me
Reviewed August 2026. This page is general information about the regulatory landscape, not legal or tax advice, and it is a snapshot — pending bills move and effective dates shift. Confirm anything you intend to rely on with your own counsel or tax adviser, and check the current text of any instrument cited here before acting on it.