AI & Data Governance
For products where the hard question is not "does it work in the lab" but "can you show it works here, on these patients, and prove you would notice if it stopped".
The problem this solves
AI-enabled health products fail Indonesian scrutiny in predictable places.
- Validation was done on a population that does not resemble Indonesian patients, and no one has said so out loud in the dossier.
- There is a plan for launching the model but no plan for monitoring it — no defined drift signal, no owner, no threshold for pulling it.
- Health data flows are designed technically, then discovered to carry personal-data obligations nobody costed.
What we do
- Validation and monitoring evidenceWorking out what evidence your claim actually requires, where your current validation falls short for an Indonesian population, and how post-deployment monitoring should be defined so that it is answerable rather than aspirational.
- Regulatory sandbox readinessAssessing whether the Ministry of Health's health technology sandbox is a sensible route for your product, which of the three testing schemes fits its maturity, and what participation will actually ask of you. The mechanics are set out in full below.
- Health data protection assessmentMapping your data flows against obligations under Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi — Indonesia's personal data protection law — including where health data crosses borders.
- Governance frameworkDesigning the oversight that sits around the model in operation: who reviews, on what cadence, against which thresholds, and what triggers a stop.
How the Kemenkes health technology sandbox actually works
Almost everything published about this programme is in Indonesian and written for a domestic audience. This is the mechanics, in English, from the Ministry's own materials.
Three testing schemes, chosen by how mature your product is
Entry is not a single queue. Applicants first complete a Tingkat Kesiapterapan Teknologi (TKT) questionnaire — a technology-readiness self-assessment — and the result recommends which of three schemes fits:
- Pengembangan Inovasi — development. For testing a proof of concept and running a pilot, to raise the maturity of the innovation.
- Perluasan Pemanfaatan Inovasi — scaling. For products already ready to deploy, focused on system integration, sustainability and cross-sector collaboration.
- Pembentukan Kebijakan Berbasis Inovasi — policy formation. For innovations that need regulatory or policy support to exist before they can be applied nationally.
That third scheme is the one most foreign teams miss. If your product has no settled regulatory category in Indonesia, the sandbox is not merely a testing ground — it is the route through which the rule itself may get written.
Four stages, and the published 2025-cycle dates
| Stage | What happens | Published dates |
|---|---|---|
| 1 · Registration | Form, supporting documents, and the TKT scheme assessment | 5 Nov 2025 – 13 Mar 2026 |
| 2 · Verification | Documents checked, online interview if needed. Passing earns a registration record and a listing as Inovasi Terverifikasi | 1 – 31 Dec 2025 |
| 3 · Testing & mentoring | Limited-scale testing with the programme team and expert panel | 1 Jan – 30 Jun 2026 |
| 4 · Announcement | Recommended participants receive the ITK registration mark and a public directory listing | 1 Jul – 1 Aug 2026 |
Two things are worth reading carefully here. The registration window runs past the verification window, which indicates verification is handled on a rolling basis rather than as one gate — so submitting late does not mean waiting for a single batch. And the 2025 cycle's announcement stage closed on 1 August 2026; at the time of writing the next intake has not been announced, so anyone planning around this should confirm the current cycle directly with the programme.
What you have to submit
- A company deck covering organisational structure, business growth, business model, products and services, and your health focus area
- A Surat Pernyataan — declaration letter, on the programme's own template
- Tanda Daftar PSE — electronic system provider registration — and a Pakta Integritas or NDA, both listed as optional
The company deck is where most applications are quietly weakened. It is read as evidence of whether the organisation behind the innovation can sustain it, not as a pitch — and a deck written for investors rarely answers that question.
What the outcome is — and what it is not
Participants appear publicly in the programme's Innovation Directory under one of two statuses: Inovasi Terverifikasi after passing verification, and Inovasi Direkomendasikan once recommended. Recommended innovations receive the Tanda Daftar Inovasi Teknologi Kesehatan (ITK), continued mentoring, and priority consideration in Ministry and partner programmes.
What it is not is a market authorisation. A recommendation is a credibility and access signal — valuable with hospital buyers and investors precisely because it is granted by the Ministry — but if your product meets the definition of a medical device it still needs an Izin Edar, which is a separate licence issued as a PB UMKU under Permenkes 11/2025. Treating the ITK mark as approval to sell is a costly misreading, and one we have seen made.
One honest caveat, because it affects how much weight to put on any of this: neither the programme portal nor its official registration guide publishes an implementing regulation number for the sandbox. It operates as a Ministry programme. We state that plainly rather than cite a regulation we cannot verify — and if you have been shown a specific number as its legal basis, it is worth asking where that came from.
Sources: the Ministry of Health sandbox portal at sandbox.kemkes.go.id and its official Panduan Pendaftaran Sandbox Kesehatan 2025, together with the Ministry's published results for the 2024 cycle. Read and verified 16 August 2026. Programme details change between cycles — confirm against the portal before relying on them.
Why this firm
- A physician-led firm, so the clinical claim and the regulatory claim are assessed under one clinical lead
- Our leadership serves as an active External Evaluator of the Kemenkes AI Regulatory Sandbox — the review side of this process, not only the applicant side
- Where a conflict of interest would arise on a specific assessment, we recuse rather than manage it
Building something AI-enabled for Indonesia?
The earlier the evidence question is asked, the cheaper it is to answer. A first call will tell you whether your current validation package is close, or whether it needs work before anything else is worth doing.
Book a consultation