Special Report On Board Oversight And Liability Trends In The Philippines.
Featured firm: SyCip Salazar Hernandez & Gatmaitan (SyCipLaw).
Interviewees: Ricardo Jesus E. Gutierrez, a Partner of the Firm, in coordination with the Firm’s Corporate Services Department headed by Benedicto P. Panigbatan.
- CL: How is the standard of board oversight evolving in the Philippines, and what should global GCs and boards understand regarding circumstances where an oversight failure leads to personal director liability?
SyCipLaw: Philippine law applies the business judgment rule. Directors need not guarantee outcomes, and Philippine courts generally refrain from taking cognizance of actions questioning decisions made by the board of directors in good faith and within its corporate authority. The threshold for a director’s personal liability is considerably high. Under Section 30 of the Revised Corporation Code, directors are jointly and severally liable for resulting damages if they are proven to have willfully and knowingly assented to patently unlawful acts, acted with gross negligence or bad faith in directing corporate affairs, or acquired an interest that conflicts with their duties.
What appears to be changing is the content and reach of reasonable oversight. Governance rules increasingly expect boards, especially of listed, public, and regulated companies, to oversee enterprise risk rather than being confined to approval of individual transactions. Philippine case law holds that officers acting within their authority and in good faith are not personally liable for simple oversight failures or ordinary negligence. An unsuccessful business decision, or a one-off compliance failure, should not by itself trigger personal liability. The harder cases involve serious or repeated red flags, known unlawful conduct, or a failure to address a material risk so pronounced that the evidence supports gross negligence or bad faith.
For global GCs, the practical point is that Philippine law remains fault based. The board should be able to show a reasonable process: it identifies material risks, obtains the information it needs, challenges management where necessary, and acts on significant issues brought to its attention. Experienced Philippine counsel can calibrate that process to local statutory standards and jurisprudence, so that board practices developed under foreign governance models translate into a similarly defensible model under Philippine law.
- CL: Cyber risk is increasingly a governance issue rather than an IT problem. What key questions should Philippine boards ask management about cybersecurity, incident preparedness, data privacy, and third-party risk, and how do these expectations compare with emerging international standards?
SyCipLaw: Boards should treat cybersecurity as an enterprise risk. At a high level, directors should understand which data and systems are most critical to the business, who is accountable for protecting them, what the company sees as its principal cyber threats, whether security and business-continuity controls are tested regularly, and how quickly the company can detect, contain, and escalate an incident. Philippine data privacy rules already require appropriate organizational, physical, and technical security measures, and qualifying personal data breaches may trigger notification to the National Privacy Commission and affected data subjects within 72 hours from knowledge or reasonable belief that a personal data breach has occurred
Philippine regulation remains fragmented across data privacy, cybercrime, and sector-specific rules, but the governance expectations are converging. Experienced local counsel can help the board map these overlapping requirements to the company’s operations and incident-response playbooks (…)”.
Third-party risk deserves particular attention. The board should understand how the company selects and monitors cloud providers, processors, and other technology vendors; what contractual security and incident-notification obligations apply; and whether subcontracting and access to sensitive information are properly controlled. The same concern extends to third-party AI tools. Companies should, for example, control what confidential or proprietary information employees may upload to such systems.
Philippine regulation remains fragmented across data privacy, cybercrime, and sector-specific rules, but the governance expectations are converging. Experienced local counsel can help the board map these overlapping requirements to the company’s operations and incident-response playbooks, so that regulatory touchpoints, including with the National Privacy Commission and sectoral regulators, are identified and managed consistently.
- CL: As companies deploy generative AI and other AI tools, what does effective board oversight look like? Specifically, where should responsibility sit for AI governance, model risk, data use, bias, IP, and regulatory compliance, and when could inadequate oversight create liability for directors?
SyCipLaw: The board should not be expected to manage individual AI systems. Its role is to set the governance framework, risk appetite, and accountability structure for material AI use. Day-to-day responsibility can sit with a named senior executive or a cross-functional management group, supported by technology, cybersecurity, data privacy, legal, compliance, and the relevant business teams. Higher-risk applications should be escalated to the board or an appropriate board committee.
The framework should cover, among other things, approved AI tools and use cases, data inputs, privacy and cybersecurity, model performance and bias, vendor risk, human review, intellectual property, and regulatory compliance. IP deserves particular attention: Philippine law gives weight to human authorship and inventorship. Businesses using AI should therefore document human contributions, secure appropriate contractual rights, protect confidential datasets and know-how, and decide which assets need copyright, trademark, patent, or contractual protection.
The Philippines has no single, comprehensive AI statute, although several AI governance bills are pending in Congress in 2026. Existing laws on corporate governance, data privacy, intellectual property, consumer protection, and other regulated activities therefore continue to apply. Boards benefit from coordinated legal input when designing their AI governance framework, so that overlapping obligations across these areas, and developments in pending legislation, are tracked and reflected in company policies on a timely basis.
For directors, the liability analysis returns to Section 30 of the Revised Corporation Code. A defective AI system does not, by itself, establish director liability. Exposure becomes more serious where the board knowingly permits unlawful conduct, disregards significant known risks, or exercises oversight in a way that could amount to gross negligence or bad faith. A documented AI governance process therefore matters not only for compliance, but also as evidence of appropriate oversight.
- CL: How should Philippine boards distinguish between voluntary ESG commitments, disclosure obligations, and issues that could engage directors’ fiduciary duties or legal liability?
SyCipLaw: Boards should distinguish three categories. First, companies may adopt voluntary ESG commitments, such as net-zero targets, sustainability policies, or other public goals. These commitments do not carry the force of legislation but, once communicated publicly, these must be properly substantiated. False or misleading environmental claims can expose a company under securities, consumer protection, civil, or other applicable laws. In this connection, it is noteworthy that, in the Philippines, a group of consumers filed a case before the Fair Trade Enforcement Bureau of the Department of Trade and Industry against certain businesses, alleging false or misleading recyclability claims on their plastic packaging.
Second, mandatory disclosure obligations are becoming more specific. Most significantly, Securities and Exchange Commission (“SEC”) Memorandum Circular No. 16, Series of 2025 took effect on January 8, 2026, replacing the SEC’s 2019 sustainability reporting guidelines. The Circular introduces Philippine Financial Reporting Standards on Sustainability Disclosures (PFRS S1 and PFRS S2), based on the International Sustainability Standards Board (ISSB) standards, on a phased basis for covered publicly listed companies and, eventually, large non-listed entities. It also introduces phased external assurance requirements.
Third, ESG becomes a board fiduciary and liability issue when the underlying matter is legally required, financially or operationally material, built into corporate strategy or risk management, or represented to investors and other stakeholders in circumstances where the accuracy of the representation matters. Boards should therefore not treat ESG as a separate category of corporate virtue. It is increasingly becoming part of ordinary legal compliance, risk management, and disclosure oversight. Given the pace at which the SEC’s sustainability disclosure framework is being phased in, boards often find it useful to engage Philippine counsel early to distinguish voluntary commitments from mandatory obligations, and to pressure-test public ESG statements against local disclosure and consumer protection rules.
- CL: When does tax risk become a board-level governance issue? What controls should directors expect to see over tax reporting, aggressive tax positions, transfer pricing, and interactions with tax authorities?
“From a governance perspective, escalation matters even more because tax matters can move beyond corporate monetary exposure and become personal compliance issues for senior officers. “.
SyCipLaw: Tax becomes a board-level issue when the exposure is material, recurring, or systemic; involves an aggressive or uncertain position; may create significant enforcement or reputational consequences; or could expose responsible directors or officers personally.
The board need not administer the company’s tax affairs, but it should put in place a credible tax-control framework. That framework ordinarily includes clear accountability for tax compliance; escalation thresholds for material assessments and uncertain positions; appropriate review of related-party transactions and transfer-pricing documentation; timely reporting of significant audits or disputes; and controls over dealings and settlements with tax authorities.
Escalation matters because tax exposures can quickly move from technical disputes to material financial, operational, and reputational issues if these are not identified and addressed at the right level. Premature collection measures such as distraint or levy, contested assessments, and settlement or compromise decisions can affect the company’s cash flow, financial statements, and relationships with regulators, and can narrow the options available if the matter is raised too late. Clear escalation thresholds allow the board to oversee how significant positions are taken, how disputes with the Bureau of Internal Revenue (“BIR”), the Philippine tax authority, are managed, and how procedural protections are preserved, rather than learning of material exposures only after they have crystallized.
From a governance perspective, escalation matters even more because tax matters can move beyond corporate monetary exposure and become personal compliance issues for senior officers. Where a director or officer has responsibility over, access to, or influence over corporate accounting records and dealings with tax authorities, non-compliance with regulatory processes such as a BIR subpoena can create personal, and potentially criminal, exposure, independent of the company’s own liability. That risk reinforces the need for clear reporting lines, timely escalation of audits, assessments, and enforcement actions to the board or a designated committee, and documented decision-making on how the company responds, so that senior officers are not placed in a position of personal exposure for matters that were not visible to them in time to act. Early involvement of experienced Philippine tax counsel in significant assessments, enforcement actions, and subpoena responses helps preserve procedural protections and keeps interactions with the BIR consistent with the company’s broader governance obligations.
- CL: What does “reasonable” enterprise risk oversight look like for a modern board? How should boards determine which risks require regular attention, what information is required from management, and whether reliance on executives and advisers is sufficient to discharge their duties?
SyCipLaw: Reasonable oversight should be proportionate, risk-based, and demonstrable. A board cannot monitor every operational risk. It should instead identify the risks that could materially affect the company’s business, legal compliance, financial position, reputation, or strategic objectives; set the company’s risk appetite and escalation thresholds; and require regular reporting on those risks.
The SEC’s corporate governance framework reflects this approach. It expects covered boards to oversee a sound enterprise risk management framework and, depending on the company’s size, risk profile, and complexity, contemplates a Board Risk Oversight Committee.
Directors may properly rely on management, specialists, and external advisers, including Philippine legal counsel on questions of local law and regulatory practice. That reliance should not be entirely passive. The board should receive information in a form that allows meaningful judgment, understand the principal assumptions and uncertainties, ask questions when material issues or red flags arise, and follow up on management’s response. The goal is not to eliminate risk, but to show that material risks were identified, understood, and addressed through a rational governance process.
- CL: For multinational groups operating in the Philippines, how should boards navigate the gap between global governance expectations and local legal duties? Could adopting a global risk framework raise expectations for Philippine directors, or could a locally compliant approach fall short of multinational parent standards?
“(…) compliance with foreign rules does not necessarily amount to compliance with the Philippine Data Privacy Act”.
SyCipLaw: A multinational’s global governance framework is useful, but it does not replace Philippine law. Directors of a Philippine company must discharge their duties under Philippine law and should not assume that compliance with the parent’s home-country framework automatically produces local compliance. The point is particularly clear in areas such as data privacy, where compliance with foreign rules does not necessarily amount to compliance with the Philippine Data Privacy Act.
At the same time, a global framework can supply an appropriate minimum standard, particularly where it is more developed than local requirements. Adopting one does not, by itself, change the statutory test for personal liability under Philippine law. In practice, however, the adopted framework may become relevant evidence of the risks the company and its directors understood, and of the governance processes they chose to follow. A significant and unexplained departure from those processes could therefore become relevant in evaluating how the board discharged its duties.
Conversely, meeting only the minimum requirements of Philippine law may fall short of group policies, contractual undertakings, financing requirements, or foreign regulatory standards that apply elsewhere in the group. A better approach would be to map the global framework against Philippine requirements, identify necessary local adaptations, and document any material departures and the reasons for them. That mapping exercise is typically carried out with Philippine counsel working alongside the group’s in-house legal and compliance teams, so that local statutory duties, regulatory expectations, and jurisprudence are properly reflected in the adapted framework.
- CL: Looking ahead three to five years, which emerging area (such as cybersecurity, AI, ESG, tax, sanctions, or supply-chain risk) is most likely to change how director liability is assessed in the Philippines, and what should boards be doing now to demonstrate effective oversight?
SyCipLaw: If one area must be singled out, cybersecurity, increasingly intertwined with AI and data governance, would probably be the strongest candidate. Philippine regulators already impose substantive data-security and incident-reporting obligations, enforcement activity has increased, regulated industries face additional cybersecurity requirements, and new legislation continues to be proposed to address AI-driven attacks and other modern cyber risks.
The underlying statutory test for director liability may not need to change. What we believe would change is what counts as reasonable conduct when concepts such as gross negligence or bad faith are applied to a board that knew its business depended heavily on data, digital infrastructure, and AI.
Boards should therefore build the evidentiary record now. They should assign clear ownership for cyber and AI risk, identify critical systems and data, approve appropriate risk tolerances, require meaningful board reporting, scrutinize material third-party dependencies, maintain and test incident-response and business-continuity plans, and ensure that significant incidents and red flags are escalated and addressed. For AI-enabled assets specifically, companies should also establish controls over approved tools, information uploaded to them, human contribution, ownership, and vendor arrangements. Working with experienced Philippine counsel on policy design, incident playbooks, and regulator engagement helps keep these measures not only operationally sound, but also defensible against the Philippine statutory standards by which board conduct will ultimately be assessed.
NOTE:
The foregoing responses were prepared by Ricardo Jesus E. Gutierrez, a Partner of the Firm, in coordination with the Firm’s Corporate Services Department headed by Benedicto P. Panigbatan.
______________
WRITTEN BY
Ricardo Jesus E. Gutierrez, Ricardo Jesus E. Gutierrez is a partner and a member of the Firm’s Banking, Finance, and Securities, Special Projects, and Intellectual Property departments. He advises multinational and regional clients on structuring foreign investments, establishing a Philippine legal presence, and navigating the full lifecycle of corporate, regulatory, and financial compliance.
Benedicto P. Panigbatan is a Partner, Head of the Firm’s Corporate Services department, and member of the Special Projects and Banking, Finance & Securities groups. His practice areas cover mergers and acquisitions, foreign investments, corporate structuring and reorganization, sale and purchase of non-performing/distressed assets of banks and financial institutions, securities regulation, documentation of loans and security arrangements, taxation (including estate planning, availment of reliefs and exemptions under various tax treaties), joint ventures and financing for real estate projects, mining and construction projects, general corporate services, legal due diligence exercises, and general contract drafting, review and negotiations.
