Who Can Actually Stop the Machine? The Institutional Test for AI Governance in Southeast Asia

INTRODUCTION

An AI system has passed its technical tests. It prices loans, or screens welfare applicants, or triages patients, and the organisation deploying it has good reasons for urgency: a competitor is ahead, a minister has announced a launch date, a budget cycle is closing. Somewhere in the organisation, or in a regulator’s office, sits a person whose job is to assess whether the system should go live.

Suppose that person concludes it should not. The grounds for that need not be exotic: errors that fall unevenly across the people the system sorts, performance that has drifted from the data it was validated on, refusals that cannot be explained to the person refused, a model that can be manipulated by someone who understands it, or stakes high enough that a mistake costs someone a benefit, a diagnosis, or a livelihood.

What happens next is the real measure of AI governance, and it is what Southeast Asia’s multiplying instruments leave unresolved. The region now has an ethics guide, a standalone national statute, a draft bill, a pending presidential regulation, and a sophisticated family of voluntary frameworks. Each answers the question “What should responsible AI look like?” Far fewer answer the query “Who decides, against whose objection, and with what consequence?”

This article argues that the second question is the one that matters, and that asking it produces a less tidy picture of the region than the usual inventory suggests. The distinction is between governance presence, meaning principles, committees, inventories, and approval processes; and governance effectiveness, meaning arrangements with enough institutional authority to change a consequential decision when compliance has become expensive. Presence is now abundant. Whether effectiveness exists, and where, is much harder to establish. Effectiveness is also broader than enforcement: enforcement follows a breach, while effectiveness includes the power to refuse, condition, or delay a deployment before it happens.

Stop authority, in this sense, runs along a spectrum. At one end sits a supervisor declining to let a bank put a credit model into production. At the other sits an order that a running system be withdrawn, including the scenario that currently dominates international debate: a frontier model judged dangerous enough to shut down. The British government rejected a statutory “kill switch” of that kind in September 2026, on the grounds that blocking a model in one country would not prevent its development or misuse elsewhere. That objection has force against a national off-switch for a model trained and served from anywhere. It has less purchase on the question asked here, because the same three conditions apply at both ends: someone must be identifiable, able to act against the sponsor’s wishes, and competent to judge the evidence. A state that cannot refuse a credit model will not be able to withdraw a frontier one. The frontier end does need more than a domestic gate can supply, since a model trained abroad and served over a network reaches past any one jurisdiction. But nothing at that end works without the domestic layer either.

THE WRONG MEASURE

The instinct to measure AI governance by counting instruments is understandable. Instruments are visible, comparable, and announceable, and by that measure, the region has been busy. ASEAN’s Guide on AI Governance and Ethics, endorsed in February 2024, sets out seven principles and recommends national policy actions; an expanded guide for generative AI followed in 2025. Malaysia published National Guidelines on AI Governance and Ethics in September 2024. Indonesia issued an ethics circular in 2023 and has prepared draft presidential regulations pairing a national roadmap with safety and ethics obligations. Singapore’s Infocomm Media Development Authority (IMDA) has produced model frameworks for conventional, generative, and, in January 2026, agentic AI, alongside the AI Verify testing framework. Vietnam went furthest, passing a standalone Law on Artificial Intelligence in December 2025, in force from March 2026.

None of this is ceremonial, and much of it is necessary. An organisation cannot escalate a dispute about a system it has not inventoried, against criteria it has not articulated. Frameworks create the vocabulary in which conflicts can be stated; the mistake is to treat the vocabulary as the outcome.

As public attention to the risks of deployed AI grows, security failures among them, the question put to governments will shift from whether they have controls to whether those controls have ever done anything.

The regional guide is explicit about its own status: voluntary, not superseding member states’ laws, recommending rather than requiring. That is a description of what ASEAN’s institutions can do, not a criticism; but it means the guide has no view on who prevails when a regulator judges that a deployment should be stopped.

WHAT IT MEANS FOR GOVERNANCE TO BIND

If presence is the wrong measure, the right one is institutional rather than legal. A statute can be inert, while a voluntary framework can bind hard when it sits inside a supervisory relationship. What matters is whether an arrangement can change a decision that someone powerful wants to make.

Three characteristics matter. The first is locatable authority: an identifiable person or body empowered to approve, condition, delay, or stop a deployment, as opposed to a diffuse obligation to “ensure” responsible AI. The second is independence, in a modest and practical sense. Those exercising the authority should not, for career and budget purposes, report to the people whose project they may block, nor bear the full cost of delay while others capture the benefit of speed. The third is technical capacity, and it is the one most often assumed and least often built. An institution cannot refuse what it cannot assess. Judging a consequential deployment means being able to test for unequal error rates across the groups a system sorts, to check whether accuracy holds on data the model did not see in training, to establish whether a decision can be explained to the person it affects, to probe for security weaknesses and manipulation, and to verify that a human override works in practice. These are scarce skills, and without them, a regulator can only take the documentation on trust. Singapore’s investment in AI Verify and its AI Safety Institute can be seen as an attempt to build this capacity ahead of the authority that would use it.

All three are ordinary institutional criteria, which is the point: AI governance is best judged by the standards applied to any other exercise of authority. What AI adds is a harder test of the old kind. Its failures are statistical and diffuse, seldom events anyone witnesses, so a refusal must rest on evidence and that evidence often sits with a foreign provider the institution cannot compel. This is part of why the sectoral approach is the pragmatic one: sectoral regulators already hold the powers, the licensing relationships, and the domain knowledge a new AI authority would take years to acquire. It is a starting point, though not a complete answer, for reasons the Singapore case below makes plain.

None of the three is peculiar to the state. A bank’s model risk function, a hospital’s clinical governance committee, or a firm’s deployment review board can each hold locatable authority, and in most cases the first institution able to stop a system is the one deploying it. The question this paper asks is what happens when the deploying organisation, government entities included, does not: whether anyone outside it can intervene, and on what basis.

Regulated finance offers the closest working model. The Monetary Authority of Singapore’s (MAS) December 2024 information paper on AI model risk management, based on a thematic review of banks, describes the machinery in detail: oversight forums, system inventories, materiality assessments, and validation before deployment.

Two elements of that machinery transfer to other settings and two do not. What transfers is the requirement that a named function validate a system before it goes live, and the practice of recording approvals, conditions, and exceptions so a decision can be reconstructed afterwards. Neither depends on banking. What does not transfer is the supervisor and the consequence structure. A bank’s internal challenge function has weight because behind it stands a regulator with licensing power, examiners, and sanctions; the internal “no” is credible because an external “no” is possible. A regulated bank also faces explicit consequences for model failure, from supervisory findings to enforcement and financial loss. Public institutions are not unconstrained, but their consequences arrive through different channels and often land on different people. Singapore’s Minister for Digital Development and Information suggested in September 2026 that AI will need safeguards built on the civil aviation model, through standards, testing, and trained personnel developed alongside adoption. The analogy holds for the same reason banking does. Aviation safety works because a certification authority can refuse to let an aircraft fly, not because the industry published principles.

WHERE THE AUTHORITY IN SOUTHEAST ASIA ACTUALLY SITS

Southeast Asian jurisdictions differ less in how much governance they have published than in where institutional authority has been placed, and how deliberately. The four countries considered here are those whose instruments are furthest developed; the region’s other members are at earlier stages. The urgency differs too. In Singapore, where AI is deployed at scale across government and the supervised sectors, the question of who can stop a system is already live. Elsewhere it is a question of building the gate before the volume of consequential deployment arrives, which is the cheaper moment to build it.

It is easy to misread Singapore as a soft-law jurisdiction because its best-known instruments, the model frameworks and AI Verify, are voluntary. But the government’s position is that AI governance is applied sector by sector, with no omnibus statute and no cross-sectoral AI enforcement agency. The binding layer is the ordinary authority of sector regulators. MAS can make expectations about model risk effective in a way IMDA’s frameworks cannot, because they are read by institutions MAS licenses, inspects, and can penalise. The logic is coherent: attach AI to the places where the stop authority already lives.

The corollary should be stated plainly. Outside the supervised sectors, Singapore relies on general law, on the persuasive force of frameworks, and on internal government controls whose application to individual deployments is not public. The materials reviewed here identify no cross-sector authority able to withhold approval for a deployment by a company no sectoral regulator supervises. A screening tool used by an employer, a scoring model used by a landlord, an assistant handling customer complaints: the harms run from discriminatory outcomes and privacy violations to confidently stated false information, and those affected have recourse only afterwards, through general law, if they learn a system was involved at all. Data protection powers and targeted legislation may well constrain particular deployments; that is a different kind of constraint from an approval that can be refused. Closing that gap entirely is neither realistic nor desirable, since it would mean licensing ordinary commerce. The narrower question is whether the highest-consequence uses outside the supervised perimeter, those bearing on employment, housing, credit, or access to public services, should attach to some existing regulator rather than none. Singapore has preferred to build assurance and testing infrastructure first. That is defensible, and precisely a decision about where not to create stop authority.

Vietnam has placed its weight elsewhere: statutory authority first, institutions to follow. Its Law on Artificial Intelligence creates the strongest formal control architecture in the region. It sorts systems into high, medium, and low risk, with the tier turning on what a failure would do to a person rather than on how advanced the system is: high risk covers uses bearing on health, liberty, livelihood, and access to essential services, where error is hard to reverse and the affected person cannot practically refuse. Listed high-risk systems need conformity certification before service, face periodic inspection, and must have a local representative if supplied from abroad. This is authority in the strict sense: a listed system without certification cannot lawfully be deployed.

Whether that authority will bind cannot yet be known. An implementing decree issued in April 2026 details risk classification, labelling, and incident reporting, and the Prime Minister’s list of high-risk systems took effect on 15 August 2026, specifying a conformity pathway for each. The list runs to 46 systems across six fields, with transport accounting for more than two-thirds; existing systems have grace periods to March 2027, or September 2027 in health, education, and finance. The machinery exists on paper and on a schedule; but evidence of its exercise does not. Vietnam has put the legislative teeth in place, and the test is whether the ministry administering the regime, inside a state that has declared AI and semiconductors to be twin engines of national development, will apply it independently. It is too early to tell. One well-documented refusal of certification for a commercially significant system would tell us more than the statute’s text.

Malaysia is in mid-transition. Its National AI Office issued a public consultation paper on a proposed AI Governance Bill in July 2026, proposing a central authority working through existing sectoral regulators, a national baseline of principles, and a risk-based structure; the government has said the bill is targeted for completion by end-2026. Legislating an authority into existence at least suggests recognition of the limits of exhortation. How well a central authority works will depend on details the consultation paper leaves open, above all whether its decisions gate anything and how it settles disputes with sectoral regulators.

In Indonesia, two draft presidential regulations, on the national AI roadmap and on AI ethics, completed inter-ministerial deliberation in May 2026 and were still awaiting enactment in August. The ministry describes this as a first step toward eventual legislation. Earlier statements suggest the instruments will set direction and risk tiers while leaving sanctions to existing statutes and sectoral rules, though this cannot be confirmed until the final texts are published. The communications minister has cautioned government bodies against deploying AI before internal rules are in place, an instruction of unclear enforceability. That captures the policy challenge: the coordinating ministry can exhort, but authority to stop a deployment is scattered across sectoral regulators of very different capacities, and the data protection authority mandated in 2022 was still not established as of July 2026. That is what implementation looks like in a large decentralised state.

THE HARD CASE

The dimension that unifies these cases is what happens when governance becomes inconvenient. Every government here is simultaneously promoting AI adoption as a national priority. Malaysia’s lead AI agency is charged at once with driving the National AI Action Plan and with developing trusted governance. Indonesia seeks AI investment while its safety regulations await enactment. Singapore’s regulators operate in a state that has sought to become a trusted hub for AI. In each case the institutions that might be expected to constrain deployment sit inside a strategy that prizes adoption. That is a tension to be managed, not a verdict.

The tension is sharper here than elsewhere for two reasons. Investment competition among ASEAN members is real and proximate: the region has drawn record foreign direct investment while its governments compete for digital infrastructure, semiconductor, and data centre projects. The same authorities designing regulatory regimes are courting investment in the technologies they would regulate. Reliance on foreign model, cloud, and semiconductor providers also narrows practical authority, because formal powers are less useful where a regulator cannot obtain training data, evaluation results, incident records, and model documentation. That dependence is not unique to the region, but here it compounds the first reason since a government competing for a provider’s investment is in a weak position to demand disclosure from it. An institution that cannot establish what a system does is poorly placed to stop it. Vietnam’s regime shows both the lever and its limit. Requiring a local representative for foreign suppliers of listed high-risk systems gives its regulators someone to compel, but the list covers sectoral applications rather than general-purpose models, so a frontier model trained and served from abroad would sit outside it.

The same authorities designing regulatory regimes are courting investment in the technologies they would regulate.

There is a further awkward evidentiary point. The review behind this article covered regulator publications, ministry releases, official gazettes, and regulatory tracking for the four jurisdictions, in English and in translation, up to September 2026. Within that material, there appears to be no documented case in which a Southeast Asian regulator stopped or materially delayed a consequential AI deployment over its sponsor’s objection. Organisations no doubt hold systems back internally and have little reason to announce it; the gap is in the public record of external authority being exercised. Cases elsewhere make the point from the other direction. The Netherlands’ SyRI welfare-fraud system was halted in 2020 by a court, not the ministry running it; Australia’s Robodebt scheme ran for years before a Federal Court ruling ended it in 2019; England’s 2020 exam-grading algorithm was withdrawn within days, by ministers under public pressure. Each was stopped by litigation, crisis, or outcry after the harm, none by a gate that refused it beforehand. Absence of a regional case is not proof that authority is never exercised, since supervisory intervention is routinely confidential. But if its exercise is systematically unobservable, outsiders cannot distinguish governance that quietly binds from governance that quietly yields. Traceability is the only way effectiveness can be demonstrated rather than asserted. The concern will not stay static either. As public attention to the risks of deployed AI grows, security failures among them, the question put to governments will shift from whether they have controls to whether those controls have ever done anything.

The counterarguments deserve better than dismissal. Requiring approval before deployment has costs: it slows beneficial systems, and for most AI, accountability after the fact is proportionate and cheaper. Most deployments are low-stakes, their harms reversible, and a regime demanding approval for each would spend scarce capacity on the systems that least need it. Political systems also allocate authority differently for legitimate reasons, and Vietnam’s fusion of promotion and control reflects its constitutional order rather than an oversight. Voluntary instruments also shape behaviour, as Singapore’s assurance ecosystem shows. These are valid, which is why the argument here is not “more binding law” or “every jurisdiction needs an AI regulator”. It is narrower: for systems whose failure would be consequential, somebody identifiable must hold the authority to say no, with enough independence and capacity to use it, and the system must be able to show afterwards that the question was asked. Nor is the risk one-sided. An authority that refuses wrongly imposes real costs, and the same traceability that would expose a silent yield disciplines an unjustified refusal too.

POLICY IMPLICATIONS

The implications are modest.

The instruments now being drafted, Malaysia’s bill, Indonesia’s sectoral rules, Vietnam’s implementing decrees, will succeed or fail less on their principles than on whether they specify decision rights: who approves, who can override an approval or refusal, and on what recorded authority. An override provision honestly drafted is worth more than a prohibition waived silently. The practical test is whether a governance decision gates something the deployment needs. Vietnam’s conformity certificate gates market access, so a listed system cannot lawfully run without it. In Singapore’s supervised sectors, a bank cannot put a material model into production without its validation function signing off, because the supervisor can examine that decision and penalise its absence. In government deployments across much of the region, no comparable gate is evident. The sharpest recommendation available is therefore also the most concrete. Each jurisdiction should name, for its highest-risk category, the single approval without which deployment is unlawful, as well as the office that grants it.

The fusion of promotion and control cannot be drafted away, since every jurisdiction here houses both mandates in the same apparatus, but it need not be silent: separate reporting lines for the control function where stakes justify them, and published criteria constraining the promoter’s discretion where they do not. And governments should publish enough about their control mechanisms for outsiders to judge them: in aggregate, how many high-risk systems were assessed, how many refused or made conditional, what exceptions were granted and by whom, and what the assessments tested, namely accuracy on the population the system will meet, error rates across affected groups, explainability of adverse decisions, resistance to manipulation, and whether human override works. This is partly a public communications task. Citizens asked to accept AI in credit, benefits, and healthcare are entitled to know that somebody can stop it, and to see evidence that the question is put.

CONCLUSION

Southeast Asia’s AI governance debate has been conducted largely in the vocabulary of frameworks: which jurisdiction has one, how comprehensive it is, how closely it tracks the EU’s. The better vocabulary is institutional. It is also why regional harmonisation is not the first task: before ASEAN’s members can align their governance, each needs governance with enough domestic force to be worth aligning. The serious test is not what these arrangements say but what they can do when doing it is costly: when the system has passed its tests, the launch is announced, the investment case is made, and the person whose job is to object, objects. The jurisdictions that will actually govern AI here are the ones building institutions that can survive the day somebody important wants the machine switched on, and somebody responsible concludes it should stay off.

---

This is an adapted version of ISEAS Perspective 2026/70 published on 29 September 2026. The paper and its references can be accessed at this link.