WebX 2026 opened in Tokyo on July 13 with a policy-focused conversation on the CRYL stage featuring Taiwanese lawmaker Ko Ju-Chun and Audrey Tang, Taiwan’s first minister of digital affairs and current ambassador-at-large. Tang joined remotely. The discussion centered on two major legal frameworks Taiwan completed in the first half of 2026: the Virtual Asset Service Provider Act, or VASP law, and the AI Basic Act.
Taiwan’s 2026 legal push took center stage at WebX
Ko, one of the main initiators of Taiwan’s AI Basic Act and an important co-initiator of the VASP law, said Taiwan had allowed people to buy Bitcoin at convenience stores as early as 2016. Even so, the crypto industry remained in a regulatory gray area for nearly a decade. He said the picture only became clear in 2026, after the VASP law passed its third reading on June 13 and the AI Basic Act entered into force on Jan. 14.
Tang used the session to lay out what she sees as the next stage of Taiwan’s digital governance, moving across regulatory philosophy, civic AI, decentralized identity, and the combination of AI agents and blockchain systems.
From ambiguity to defined rules
Tang said the phrase “society has not yet reached a consensus” can appear neutral, but in practice often benefits parties that already have the capacity to act. In her view, delayed regulation allows entrenched interests to keep benefiting. She said the point of Taiwan’s latest institutional shift was to replace interpretive room held by a small number of people with public rules that are transparent, discussable and enforceable.
As discussed on stage, the VASP law creates a registration system for virtual asset businesses and brings in requirements covering customer protection, anti-money laundering and operational management. The AI Basic Act, by contrast, sets out 20 principle-based provisions and explicitly lists seven principles: sustainability, human autonomy, privacy, cybersecurity, transparency, fairness and accountability.
Neither law takes a punishment-first route. Instead, both aim to define boundaries between innovation and rights protection. For Taiwan, that means crypto assets and AI are no longer operating mainly through administrative guidance or case-by-case interpretation. Industry participants, investors and developers now have a clearer policy reference point.
Late-mover advantage and the need to keep regulatory flexibility
Ko also said Taiwan sits at the center of global semiconductor manufacturing, while the start of its AI regulatory work came later than in places such as the European Union.
Tang replied that late movers have one clear advantage: they can study the institutional experience of other jurisdictions and avoid locking fast-changing technologies into rigid categories. She referred to the Greek roots of the word “cybernetics” and said governance is not about pushing for speed at all costs. It is about preserving the ability to change course.
She argued that good AI regulation should not be judged only by whether today’s system categories look complete, because large models have already entered a stage where they can train smaller models. Fixed classifications, she said, can quickly lose accuracy. Her position is that regulation should adjust to risk patterns and leave room for different communities to absorb AI in ways that fit their own needs.
Tang also pointed to Japan’s practice of building different integration models around differences between communities, calling it an important reference for policy design in Asia. Put another way, she said, AI should enter human governance loops, rather than forcing people into AI’s operating logic.
Civic AI, onchain identity and agent authorization
The second half of the conversation shifted to civic AI and blockchain-based identity. Tang introduced the “civic.ai” framework she has been promoting. She said data should not be treated as oil that can be extracted from communities and shipped into massive cloud models. It should be treated as soil that can nourish shared knowledge within a community.
She described that approach with the phrase “Data is soil and never oil,” and said each community can have its own “commi,” combining compact knowledge management with AI so that the system can serve as a bridge across parties and cultures.
As deepfakes and AI agents become more common, Ko raised the question of identity verification. Tang said proof of identity for a human individual can now be handled to a significant degree through local biometric recognition and signature technologies. The next challenge, she said, is proving the authorization of AI agents.
If an AI agent is acting on behalf of a person in a transaction or decision, the system must be able to show that the agent was genuinely authorized by that person, according to Tang. She also disclosed that her own commi, “JTEAMI,” is already operating on Ethereum under ERC-8004 with Agent ID 22714.
She added that if AI agents are to transact on behalf of users, they need to pass tests tied to portability, path inspectability, community deployment governance and fault accountability.
Borrowing from formal verification
Tang said the reliability of AI agents can draw on formal verification methods used for smart contracts. When code becomes too large for any one person to read in full, proof-assistant tools such as Lean and Dafny can help verify invariants and make the behavior rules of AI agents easier to inspect.
Ko closed the session by saying technology policy needs transparency and cross-party cooperation. In his view, Taiwan’s progress from a dedicated crypto law to the AI Basic Act shows that digital governance is becoming an institutional project that crosses both borders and party lines, while also offering Japan and other Asian markets a policy case worth watching.