ASEAN AI governance, the regional picture in 2026

ASEAN's approach to AI governance reflects the diversity of its ten member states, from Singapore's advanced voluntary frameworks to Vietnam's binding AI statute and emerging regulatory activity in Thailand, Indonesia, and the Philippines. The ASEAN Guide on AI Governance and Ethics (adopted February 2024) provides regional principles, but implementation varies significantly across member states.

ASEAN Guide on AI Governance and Ethics

Adopted by ASEAN Digital Ministers in February 2024, the Guide provides a voluntary, principles-based framework covering: transparency and explainability; fairness and non-discrimination; security and safety; human oversight; accountability and governance; data privacy; inclusivity; and sustainability. The Guide is non-binding but serves as the baseline for member state alignment. It builds on the earlier ASEAN Framework on Digital Data Governance (2018).

Key member state positions

Singapore. The most advanced ASEAN member on AI governance. Model AI Governance Framework (three editions, Traditional AI 2020, Generative AI 2024, Agentic AI 2026). AI Verify testing framework. PDPA with March 2024 AI Advisory Guidelines. MAS (Monetary Authority of Singapore) AI Risk Management Guidelines (November 2025 consultation). Singapore often serves as the reference point for other ASEAN states.

Thailand. The PDPA (effective June 2022) applies to AI processing personal data. The Royal Thai Government issued the National AI Ethics Guideline (2021). Thailand's Digital Economy and Society Ministry has signalled interest in AI-specific regulation but no legislation has been enacted. The PDPA's automated decision-making provisions are less specific than GDPR Article 22.

Indonesia. The Personal Data Protection Law (UU PDP, effective October 2024) applies to AI. The National AI Strategy (Stranas KA, 2020) sets development priorities. Indonesia's Ministry of Communication and Informatics has issued voluntary AI ethics guidelines. The government has signalled that regulation will follow development, not lead it.

Vietnam. Vietnam has moved from development-first policy to binding statute. The Law on Artificial Intelligence (No. 134/2025/QH15) was passed on 10 December 2025 and took effect on 1 March 2026. It classifies AI systems by risk, places the heaviest duties, including conformity assessment and registration, on high-risk systems, and reaches foreign providers as well as domestic ones. Systems already in operation have a transition window, to 1 March 2027 in general and to 1 September 2027 in finance, healthcare and education. The instruments around it have also been replaced: the Law on Personal Data Protection (No. 91/2025/QH15, effective 1 January 2026) superseded Decree 13/2023, and the Law on Cybersecurity (No. 116/2025/QH15, effective 1 July 2026) replaced the 2018 Cybersecurity Law. The National Strategy on AI Research, Development and Application (Decision 127/QD-TTg, approved January 2021 and running to 2030) remains the development-side policy.

Philippines. The Data Privacy Act 2012 and National Privacy Commission apply to AI. The DTI (Department of Trade and Industry) has issued AI ethics guidelines. The DTI's National AI Strategy Roadmap 2.0 (NAISR 2.0), adopted July 3, 2024, supersedes the original 2021 AI roadmap.

Malaysia. Bank Negara Malaysia has folded AI expectations into its Risk Management in Technology (RMiT) policy (enhanced December 2025) following an August 2025 discussion paper on AI in the financial sector. The PDPA 2010 applies to AI. Malaysia's National AI Roadmap (AI-Rmap 2021-2025) is being succeeded by the National AI Action Plan 2026-2030 (AI Nation 2030), which signals further regulatory development.

Cross-border considerations

Companies operating across ASEAN face a patchwork of requirements. Singapore's frameworks are the most detailed but are voluntary. Thailand, Indonesia, and the Philippines have binding data protection laws that apply to AI but with less AI-specific guidance. Cross-border data transfer provisions vary by member state. The ASEAN Guide provides a common vocabulary but not common obligations.

Primary sources: ASEAN Guide on AI Governance and Ethics · PDPC Singapore

Related reading