Beyond the Matrix: AI Governance Gaps in Southeast Asia

Southeast Asia is emerging as a critical node in the global AI development network, hosting a rising number of data centers that are facilitating the training and utilization of AI not just regionally but globally. In 2024 alone, Google committed $1 billion to build a data center in Thailand while Microsoft announced a $2.2 billion investment in Malaysia. Chinese tech giants like Huawei and Alibaba Cloud are matching these investments, positioning themselves as partners for a regional AI ecosystem.

As the United States strives to solidify its lead in the global AI race, Southeast Asia may be a critical front in achieving this goal. Moreover, with millions of people and businesses in the region relying on AI powered platforms, Southeast Asia has the chance to reinvent itself as an AI archipelago. This heightens the urgency for comprehensive AI governance in the region that safeguards digital safety, promotes innovation, and prevents exploitation. 

Current Regional Frameworks

In response to the rise of AI investments in the region, the Association of Southeast Asian Nations (ASEAN) introduced its Guide on AI Governance and Ethics. The guide, published in February 2024 at the 4th ASEAN Digital Ministers’ Meeting, highlights seven principles—transparency, fairness, security, reliability, human-centricity, privacy, and accountability—for the design, development, and deployment of AI systems in Southeast Asia. In January 2025, the guide was expanded to include guidelines and use cases on generative AI. 

However, both iterations of the guide remain non-binding and only highlight best practices and recommendations with no enforcement mechanisms. Adoption remains voluntary and does not supersede any national legislation, in line with ASEAN’s noninterference policy. 

Table: Global Comparison of AI Governance

The European Union has the only other regional AI governance framework with the EU AI Act, which classifies AI systems by risk level and imposes regulations on developers of “high-risk” models. The European Union also bans certain practices, such as social scoring and real time biometric surveillance, and enforces compliance through the EU AI office. In comparison to the ASEAN guide, the European Union prioritizes regulatory enforcement, precautionary measures, and harmonization across the region. 

Current Gaps

Despite growing attention to AI governance, potential gaps may continue to hinder ASEAN’s ability to effectively regulate the technology across the region. First is the lack of binding enforcement. While ASEAN’s existing framework functions as an advisory document to sustain innovation within the sector, it may also limit its deterrence power and undermine the consistency of implementation across the region. 

Additionally, there is a wide disparity in national readiness among member states. Member states span from innovation frontrunners like Singapore, ranked 2nd in the world for Government AI Readiness, to fragile digital environments like Laos and Myanmar, ranked 137th and 143rd, respectively. This may make a uniform regulatory approach impractical, if not impossible. A regional governance framework should account for varying levels of institutional capacity and infrastructure if they are to be effective and inclusive. 

Oversight of critical infrastructure, including data centers, also remains potentially under-addressed. Regulations surrounding data localization, cross-border transfers, and AI chip usage should be integrated into the framework. ASEAN countries are now only just looking into establishing data center frameworks. A patchwork in oversight creates opportunities for regulatory arbitrage that external actors may be able to exploit. 

Lastly, ASEAN remains absent from global governance processes. Unlike the European Union, ASEAN has not meaningfully engaged as a bloc in international bodies such as the Organization for Economic Co-operation and Development Global Partnership on AI or the Global AI Action Summit. This may not only deepen governance disparities among member states but also position ASEAN as a recipient of norms set elsewhere. 

Chart: Government AI Readiness by ASEAN Member State and United States

What Is at Stake?

Fragmented or absent governance in ASEAN may risk creating regulatory blind spots. China has found ways to leverage this regulatory ambiguity to bypass U.S. export restrictions. A June 2025 investigation by the Wall Street Journal revealed that Chinese engineers smuggled hard drives loaded with AI training data into Malaysian data centers. Using U.S. export restricted chips housed in these centers, they were able to train and develop Chinese AI models, effectively circumnavigating U.S. strategic technology trade controls. 

China still lags behind the United States in AI chip performance but is significantly closing the gap regarding algorithm models. The performance gap between the best U.S. and Chinese AI models shrank from 9.3 percent in 2024 to just 1.7 percent in February of this year.

Southeast Asia’s under-regulated infrastructure may be enabling this progress. As a result, Washington is considering tighter export restrictions on AI chips for Malaysia and Thailand, potentially jeopardizing millions of dollars in technology investments and further politicizing regional AI development. The regulatory choices made for AI in Southeast Asia may affect long-term technological development in the region and the balance of technological power.

Hpone Thit Htoo is a research intern with the Southeast Asia Program at the Center for Strategic and International Studies in Washington, D.C.