If AI Rules Must Wait, Southeast Asia Should Set the Terms

On 27 February 2026, two days before Vietnam’s Artificial Intelligence (AI) law took effect, the Computer and Communications Industry Association asked Hanoi for an 18-month moratorium. The association, whose members include Amazon, Apple and Google, said companies needed more time for compliance. The law commenced on 1 March. Systems already in use have 12 months to comply, or 18 in healthcare, education and finance. What matters during the extra time is who has checked the system and what they can show for it.

Laws of this kind were pioneered by the EU and have now been adopted by Vietnam. They sort AI systems by the harm they can do and attach stricter requirements to the riskier ones: documentation, testing, monitoring and human oversight. These requirements aim to reduce the risk of AI making bad decisions about people.

Existing consumer and data protection laws may not adequately cover these risks. Assessing them requires evidence from two parties: the supplier which builds and sells the system, and  the institutions that use it (banks, hospitals and government ministries). The supplier should hand over its test results and known limitations. Institutions should run their own checks to see how the systems perform for their customers, in their languages and on their data. Such tests only show what was examined; they do not, by themselves, prove that a system is safe. Governments may grant more time. But the institutions using these systems should still be required to obtain testing documentation from suppliers, and take responsibility when a system changes or fails. These conditions can be set now, whether a country is phasing in a broader AI law (as in Vietnam and the EU) or is still in the process of drafting them (as in Malaysia and Indonesia).

There is a case for deferring deadlines for such laws. Brussels has done so because the technical standards for showing compliance are not ready. But such deferral postpones only AI-specific obligations. Banks and hospitals remain bound by the laws that already govern them, from consumer protection and personal data to their own licensing. Nothing stops such AI-using institutions from testing their systems. Put simply, such AI-using institutions should not merely rely on the tests made by suppliers; they should test such AI models in their fields of business; they should do so whether or not AI-specific laws have been implemented by the authorities.

Whichever route a country takes, the test is the same: before an AI system decides who gets a loan or who waits for care, someone other than the seller must have checked it, and someone must be answerable when it fails.

Singapore’s supervision of its banks shows how this can be done. The Monetary Authority of Singapore (MAS), which licenses banks, reviewed how selected banks managed AI in 2024 and published a set of good practices for the industry. Although the paper provides guidance rather than binding rules, it tells banks what MAS expects to see when it inspects them.

In practice, a bank that follows the guidance has to know what its AI systems do and test them before and after they go live. Banks should ask suppliers to inform them when the AI models are changed and keep records that MAS can inspect. For a customer, it means a loan decision made with the help of AI has been checked by the bank, and not only by the AI supplier. MAS cannot fine banks for departing from its set of good practices, but it can supervise. As part of licensing and inspection procedures, MAS can assess each bank’s adherence to the published expectations and generate a risk profile. This may subject some to further scrutiny. The key here is local accountability _— that is, a bank in Singapore should test and confirm that a model built in California works as claimed, for the bank’s own local customers. The same principle applies beyond banking _— it can apply to a private hospital, for instance.

For countries introducing AI-specific legislation, Vietnam’s experience is instructive. Its law applies to foreign providers of high-risk systems. They must keep a local contact point in Vietnam and, where a system must be certified before use, have a commercial presence or an authorised representative there. A foreign company that ignores these rules may be hard to reach, but the regulator can contact the bank or hospital in Vietnam that chose to use the model and hold that institution responsible for checking it.

The institution should hold two things. First, the supplier’s own account of what the model is for, where it fails and the tests behind those claims. The EU’s voluntary code for AI providers includes a documentation template that institutions can borrow when asking suppliers, though it covers only general-purpose models, the large models behind chatbots and similar tools. Second, the institution should conduct its own local testing because supplier documentation usually reflects tests conducted in Europe or the US. A model’s performance on English-language data says nothing about how it reads Thai medical notes or Bahasa Indonesia loan files.

The contract between supplier and institution should cover other issues: the need for advance notice of model updates, incident reporting within a specified deadline, cooperation with regulatory inspections and a right to suspend use.  A supplier’s refusal to disclose such information does not necessarily mean that a model is unsafe; but it would limit what the institution can verify. The institution must then test more, narrow its use or decline to rely on the system.

Malaysia’s digital minister told Parliament on 5 October that the country’s AI Governance Bill, which he described as a cross-sector framework complementing existing sectoral laws, will be tabled early next year. Indonesia’s two presidential regulations, on an AI roadmap and AI ethics, were awaiting signature in September. Neither country needs to wait for such laws to materialise before testing occurs. Indonesia’s banking regulator, Otoritas Jasa Keuangan (OJK), issued AI governance guidance in April 2025 covering a system’s whole life. It can stipulate what banks must be able to show while the law is pending: the supplier’s test results, the bank’s own local testing, and contract terms covering updates and failures. Bank Negara Malaysia can ask the same of Malaysian banks.

Vietnam has chosen to legislate, Singapore to supervise, and Malaysia and Indonesia are still deciding. Whichever route a country takes, the test is the same: before an AI system decides who gets a loan or who waits for care, someone other than the seller must have checked it, and someone must be answerable when it fails.

2026/295