House Bills 2827 and 3195, both filed under the Twentieth Congress, enumerate five fundamental rights every Filipino should enjoy in relation to AI systems -- the right to know, to remedy, to protection from unsafe systems, to privacy, and to freedom from algorithmic discrimination. These are the right commitments. But the Philippines has a long tradition of well-written laws that go unenforced. An AI Bill of Rights risks becoming the latest entry in that tradition.

AI bills are rich in rights but poor in mechanisms. By design, “bills of rights” and other catalogs of rights found in other jurisdictions tend to be stated as fundamental principles. In many cases, these catalogs of rights are operationalized elsewhere or downstream, such as through court procedure or statute. To be sure, principles without enforcement mechanisms remain aspirational rather than operational. Rights-based approaches are not intended to function as standalone instruments. Canada’s AIDA and the US Blueprint failed to gain traction not because rights are wrong. It is because rights alone would not answer the questions “enforced by whom, how, and against what?” Rights define only what must be protected, and not the manner in which protection is delivered. That is the work of risk-based frameworks and risk-based governance. The Philippines will have rights on paper, but the real question is whether applying any set of “AI rights” can stop AI-powered risks and harms on the ground. The answer may lie in clear and comprehensible obligations that translate AI rights into tangible standards that agencies can meaningfully enforce. This is not to abandon rights-based approaches – it is to complete them. An AI bill of rights is a necessary but not a sufficient condition for effective AI governance.

Two AI bills currently pending in Congress enumerate rights borrowed closely from the US AI Bill of Rights – rights to protection from unsafe systems, freedom from algorithmic discrimination, privacy, the right to know, and the right to remedy. The problem, however, is not how these rights are written. The problem is how to progressively realize AI rights. This typifies a “rights implementation gap”. In the pending bills, there are no corresponding obligations on deployers, no standards for what “unsafe” means in practice, and no complaint pathway to address algorithmic discrimination. The right to know illustrates this most clearly: companies deploying AI in customer service are not required to disclose that an AI is handling the interaction, what it does, or how it reaches its decisions. A right without a corresponding obligation is a declaration, not a guarantee to realize it.

The Bangko Sentral ng Pilipinas (BSP) Complaint Assistant Mechanism (BSP-CAM) case shows how a right can exist in plain sight and remain unenforceable in key aspects. The Consumer Assistance Mechanism (CAM) is a mature, legally grounded complaints system– covering all BSP-supervised financial institutions, with escalation pathways, and adjudication mechanisms under RA 11765 and BSP Circular No. 1048. When a Philippine lending platform that simultaneously develops and deploys its own AI credit scoring system denies credit to a Filipino borrower and its own complaint system fails to be responsive, the borrower can escalate the case to BSP-CAM under the “right to know.” The borrower lodges a complaint with BSP invoking the right to know the reasons for credit denial. But here the right to know may fall short of delivering desirable outcomes. The BSP-CAM was designed for human decisions – unauthorized charges, deceptive practices, and unresolved disputes, but it does not know how to examine the manner in which AI systems reach their decision, nor does it know how to compel the lending platform to disclose the algorithmic decision-making process. Because BSP-CAM will not go outside its comfort zone, the lending platform will not feel obliged to disclose the criteria, the algorithmic process, or even that an AI made a decision that affected the rights and interests of consumers. Here, BSP-CAM’s implementation gap arises. The gap between the right (to know) and the desired outcome becomes evident. BSP-CAM would frame the issue as whether a credit should be issued – not how the decision was made. The institution exists. The right exists. But the institution is unable to bridge both. Perhaps BSP-CAM is aware of the right, but it is not willing and able to apply it to the case before it. Is this a statutory void? Or is it a capacity issue?

The rights-realization gap --the growing distance between rights on paper and their actual fulfillment as conditions change-- is not new. AI has simply reopened it in ways existing mechanisms were never designed to handle.

There is more. Rights-based approaches in the Philippine context seem to be aimed at the wrong phase in the AI development lifecycle. So far, pending legislation seeking to adopt AI bills of rights is targeting system design where the frontier developer is most active, instead of governing the deployment and use phases where the local actor – that’s us – is impacted. The deployment phase is where AI systems reach into the territorial laws and jurisdiction of Philippine courts.

Given judicial hesitation and tenuous long-arm jurisdiction over frontier developers in Silicon Valley or Shenzhen, the better candidate for jurisdictional purposes is the onshore deployer, if not the user. The Philippines should bridge AI rights with enforceable, function-specific obligations that address and manage the closest supply chain actors. AI rights should be feasible to enforce. Specifying which functions to oversee and govern, and locating these functions within the onshore deployer, will transform rights from merely declarative statements to operationalizable controls. enforceable.

One can look closer to home. The Data Privacy Act of 2012 can demonstrate that rights can be successfully operationalized. The law treats data controllers and data processors as key governance actors, and imposes clear obligations on each in relation to “data subjects”. Under the Act, the National Privacy Commission serves as the policy, rule-making, adjudication, and enforcement body for privacy laws. When the NPC issued its advisory on AI systems that process personal data (Advisory No. 2024-04), it provided an agency interpretation and application of general data privacy principles into AI systems, and provided the building blocks for AI governance. A 2012 law is underpinning AI governance today.

The AI advisory is useful but, understandably, too privacy-focused. A BPO using AI-enabled workforce management software is not primarily a privacy issue. However, unlike the NPC, DOLE has no guidelines on algorithmic fairness in workplaces. This is a case where rights-based approaches currently fail: One agency can be in a position to implement a right, while another agency will not give attention to the same right, even if all their stakeholders are similarly impacted. Remedial legislation is rigid and slow to move. Advisories and department orders, on the other hand, are flexible and quick. AI governance needs both the statute, which serves as the stable normative foundation, and subordinate regulation, which comprises the adaptive operational layer. Lawmakers can look to the logic of the DPA for a steady stream of local use cases for AI rights realization in the form of ground-level agency-specific regulation. It is not only faster. It is more contextual.

The right to know and the right against algorithmic discrimination become enforceable when financial institutions have clearly defined obligations toward consumers. Section 8(c) of RA 11765, otherwise known as the Financial Products and Services Consumer Protection Act, obliges financial service providers to be transparent and provide proper disclosure of their products and services. Section 8(d) obliges financial service providers to provide fair and respectful treatment of clients. AI governance and enforcement pathways can be adopted within existing statutory authority. There is no need to await the grandeur of an all-encompassing law. BSP-CAM already has the complaint pathways, mediation, and adjudication infrastructure– these are all existing provisions that give it the AI-specific mandate it needs. The question is whether an agency like the BSP-CAM is able and confident enough to fill the gap. How will a forthcoming “AI Bill of Rights” build confidence among agencies to govern AI under their existing legal mandates?