<![CDATA[The rapid development of artificial intelligence (AI) technology has transformed various sectors of life, yet it has also given rise to new threats in the form of AI-based cybercrime that are complex and difficult to detect. This phenomenon is characterized by the emergence of cases such as deepfakes for identity fraud, personalized phishing, and autonomous cyberattacks that exploit machine learning algorithms. Indonesia, as a state based on law, faces serious challenges in combating these crimes due to normative gaps in existing legislation. Law Number 11 of 2008 concerning Electronic Information and Transactions (ITE Law) and its amendments, as well as Law Number 27 of 2022 concerning Personal Data Protection (PDP Law), have not specifically regulated criminal acts that utilize artificial intelligence. This article examines the regulation of AI-based cybercrime in Indonesian positive law and formulates an ideal criminal law policy model through a normative approach with analysis of legislation, concepts, and cases. The research finds that criminal policy reformulation is needed at three stages: legislative policy with the formulation of new offenses that accommodate AI characteristics, applicative policy with strengthening the technical capacity of law enforcement officials, and executive policy with a punishment system oriented toward prevention. The criminal law approach needs to align with the utilitarian theory of punishment and adopt principles from international regulations such as the EU AI Act, while still adapting to the national legal context and Pancasila values.]]>
