ASEAN AI Governance

ASEAN AI governance encompasses the collective policy frameworks, guidelines, and regulatory initiatives developed by the ten member states of the Association of Southeast Asian Nations (ASEAN) — Brunei, Cambodia, Indonesia, Laos, Malaysia, Myanmar, the Philippines, Singapore, Thailand, and Vietnam — to govern the development, deployment, and cross-border use of artificial intelligence. Unlike the European Union's binding AI Act, ASEAN's governance approach has been predominantly voluntary and principle-based, reflecting the bloc's historical preference for non-binding consensus frameworks and the substantial variation in AI readiness and regulatory capacity across member states.

Policy Timeline

ASEAN AI Principles (2019)

ASEAN's first collective AI governance statement was the ASEAN Principles for AI, adopted at the 35th ASEAN Summit in Bangkok in November 2019. The principles established seven high-level norms: transparency, fairness and non-discrimination, security and safety, human-centric values, robustness and reliability, data governance, and accountability. These principles were explicitly aligned with comparable frameworks from the OECD and UNESCO, reflecting ASEAN's objective of interoperability with global governance standards.

ASEAN Guide on AI Governance and Ethics (2023)

The ASEAN Guide on AI Governance and Ethics was developed under the ASEAN Digital Masterplan 2025 and endorsed by ASEAN Digital Ministers in 2023. The guide provides practical, sector-agnostic implementation guidance for organisations deploying AI, covering risk assessment methodologies, internal governance structures, human oversight mechanisms, and transparency obligations. It drew substantially on Singapore's Model AI Governance Framework as a reference, reflecting Singapore's role as the region's de facto governance benchmark-setter.

Expanded Generative AI Edition (January 2025)

In January 2025, ASEAN published an expanded edition of the governance guide specifically addressing the risks and governance requirements of generative AI systems. Nine additional focus areas were added including: content provenance and watermarking standards aligned with C2PA; incident reporting and disclosure procedures for AI failures; protection against adversarial inputs such as prompt injection; requirements for transparency about AI-generated content; and guidance on mitigating hallucination in high-stakes deployment contexts.

ASEAN Responsible AI Roadmap 2025-2030 (March 2025)

At the ASEAN Digital Ministers Meeting in March 2025, member states adopted the ASEAN Responsible AI Roadmap 2025-2030. This five-year coordinated implementation agenda includes mutual recognition of AI audit frameworks across member states, joint capacity-building for national AI regulatory bodies, a cross-border AI incident notification mechanism, and a common taxonomy for AI risk classification. The roadmap explicitly acknowledges that individual member states will implement at different speeds and with varying regulatory approaches, and does not impose binding harmonisation.

ASEAN Digital Economy Framework Agreement

The ASEAN Digital Economy Framework Agreement (DEFA), under negotiation since 2023 and expected for signature by end-2026, represents the most ambitious attempt at binding digital governance in the region. DEFA covers digital commerce, cross-border data flows, cybersecurity baseline standards, and AI governance, creating a legally binding trade agreement framework. AI governance provisions within DEFA are expected to incorporate the ASEAN Guide's principles into a more enforceable instrument, though the precise scope of AI-related obligations remained under negotiation as of mid-2025.

Member State Approaches

ASEAN member states have pursued notably varied national AI governance approaches, reflecting differences in institutional capacity, economic priorities, and democratic governance contexts. Singapore has implemented the most developed voluntary framework through the Infocomm Media Development Authority's (IMDA) Model AI Governance Framework (versions in 2019 and 2020), accompanied by a practical testing toolkit called AI Verify. Singapore has also piloted mandatory requirements for high-risk AI in healthcare and financial services, signalling movement toward selective binding requirements. Malaysia has published the Malaysia AI Governance Framework (MDEC, 2021) and is developing a National AI Regulatory Framework under MITI and the National AI Office. BNM and SC Malaysia have issued sector-specific AI guidance for banking and capital markets respectively. Indonesia enacted Government Regulation No. 71 of 2019 on Electronic Systems and Transactions and published a National AI Strategy 2020-2045, but comprehensive AI-specific legislation remained under development as of 2025. Vietnam has adopted a comparatively mandatory approach for specific AI applications, including requirements for registration of facial recognition systems and labelling obligations for AI-generated content. Thailand published a National AI Ethics Guideline in 2021 and has been developing sector-specific AI regulations through the Electronic Transactions Development Agency (ETDA). Malaysia has been an active and influential participant in ASEAN AI governance processes through MDEC (Malaysia Digital Economy Corporation), the Ministry of Communications and Digital (MCD), and MITI (Ministry of International Trade and Industry). Malaysia hosted the ASEAN AI Summit in 2024 and contributed substantially to the development of both the 2023 ASEAN Guide and the 2025 Generative AI expansion. MDEC published the Malaysia AI Governance Framework in 2021, providing voluntary guidance aligned with the ASEAN Guide's structure and the OECD AI Principles. The framework covers risk management, transparency, accountability, and human oversight obligations for Malaysian organisations deploying AI. Under the MyDigital Blueprint (2021) and the National AI Roadmap, Malaysia has committed to developing a more comprehensive regulatory environment through the National AI Office established under MITI. Bank Negara Malaysia (BNM) has issued AI-specific guidance through its Risk Management in Technology (RMiT) policy and the Exposure Draft on Responsible AI in Financial Services (2024), which addresses algorithmic decision-making, model explainability, and fair treatment obligations for AI applications in banking. The Securities Commission Malaysia (SC) has published guidance on AI use in capital markets, particularly for algorithmic trading and automated advice systems. NACSA (National Cyber Security Agency) addresses AI-related cybersecurity risks through the National Cybersecurity Policy and sector-specific Critical Information Infrastructure (CII) protection standards. The Personal Data Protection Act 2010 (PDPA), currently under amendment, is expected to incorporate AI-specific provisions addressing automated decision-making and profiling — aligning with principles in ASEAN's governance guide and international frameworks such as GDPR. Malaysia's position as ASEAN Chair in 2025 elevated AI governance to a priority agenda item, with Malaysia advocating for practical, interoperable frameworks that support both innovation and responsible deployment across the region.

1. ASEAN. (2023). ASEAN Guide on AI Governance and Ethics. ASEAN Secretariat.
2. ASEAN. (2025). ASEAN Responsible AI Roadmap 2025-2030. ASEAN Digital Ministers Meeting, March 2025.
3. MDEC. (2021). Malaysia Artificial Intelligence Governance Framework. Malaysia Digital Economy Corporation.
4. Trajano, J. C. (2025). Charting ASEAN's Path to AI Governance: Uneven Yet Gaining Ground. The National Bureau of Asian Research, September 2025.