The US-China AI Chip War: Southeast Asia’s Compliance Dilemma

In May 2026, US authorities publicly flagged a Bangkok-based firm tied to Thailand’s national AI push for allegedly helping divert billions of dollars’ worth of Nvidia-powered servers to Chinese companies, including Alibaba. The incident highlights how Southeast Asia finds itself in the middle of the years-long US-China AI chip war. While governments across the region continue to court data centre investments from both US and Chinese firms, Washington has shifted from broad rules towards targeted pressure and aggressive pursuit of diversion networks.

Southeast Asia faces two distinct but related dilemmas. The first is the strategic choice of aligning AI technology stacks with US or Chinese suppliers amid intensifying geopolitical competition. The second is the enforcement challenge of preventing illegal diversion of restricted chips through inadequate domestic export controls, as potentially illustrated by the Thailand case.

The core dilemma facing Southeast Asian governments is clear. They seek data centre and AI investment to support economic growth and national digital strategies, but at the same time they have to prevent Chinese companies from using those local facilities to access US-restricted advanced AI chips. This is particularly true for Nvidia’s high-end graphics processing units (GPUs), which Washington has been seeking to keep out of Chinese hands for years.

Failing to manage this dilemma engenders severe fallout. If a country is found enabling such diversion, it risks US secondary sanctions that can sever access to advanced US technology and supply chains, undermining its own AI development plans and deterring other foreign investors concerned about similar restrictions.

The US’ AI Diffusion Rule, introduced in January 2025, proved to be short-lived. By July 2025, investments for data centres were surging. Consequently, Washington began preparing licensing requirements for advanced AI chip exports to Malaysia and Thailand. After rolling back earlier measures, the Trump administration shifted away from broad restrictions towards a more targeted approach. Responding to this data centre investments surge, Washington was already preparing licensing requirements for advanced AI chip exports to Malaysia and Thailand. More recently, BIS (Bureau of Industry and Security) guidance closed an important loophole. US export rules were previously largely based on the buyer’s location, but the new guidance shifts the focus to ultimate ownership: any company whose parent is headquartered in China is now treated the same as one based in China, regardless of where its subsidiary operates in Southeast Asia.

The reality is that regional leaders have to walk a geopolitical tightrope to capture digital opportunities.

The verification of ultimate ownership, however, is far from straightforward. Many Chinese technology firms use complex corporate structures involving multiple layers of holding companies. These structures are often registered in jurisdictions with limited transparency, such as the British Virgin Islands, Cayman Islands, or Hong Kong. These structures frequently change through mergers, acquisitions, or internal reorganisation. Data centre operators and local regulators in Southeast Asia often lack access to reliable and up-to-date ownership information. Consequently, determining whether a company is ultimately controlled by a Chinese parent requires extensive due diligence well beyond standard know-your-customer checks. This matters greatly for the region, as the new guidance removes the workaround Chinese firms used to access restricted chips through local data centres. It also imposes a heavy compliance burden on Southeast Asian governments and operators, which have to verify full corporate ownership chains rather than just server location. This is a demanding task for regulators seeking to manage rapid data centre growth.

This burden is not temporary. As US enforcement grows more sophisticated, Southeast Asian governments will face increasing pressure to demonstrate credible oversight or risk being viewed as weak links in Washington’s campaign to restrict the export of high-tech technology and components to China. For many governments in the region, however, the real constraint is not political will but institutional capacity. Effectively tracing complex corporate ownership structures and monitoring end-use across rapidly expanding data centres requires technical expertise and resources that several Southeast Asian regulators still lack.

The region’s countries have responded differently depending on their exposure and regulatory capacity. Malaysia acted quickest, introducing in July 2025 a mandatory Strategic Trade Permit for the export, transshipment and transit of high-performance US-origin AI chips. This signalled that Kuala Lumpur preferred tightening controls over risking its reputation as a weak link.

In comparison, Thailand is more exposed. As part of national AI ambitions, data centre investments have expanded rapidly, yet the May reports tying a Bangkok firm connected to sovereign AI efforts to alleged diversion schemes have created political and reputational pressure.

Singapore operates from a significantly stronger position. The country already maintains robust export control and compliance systems, and its more mature data centre sector gives it greater room to manage competing demands. Still, any perception that Chinese-owned entities are routing restricted chips through Singapore could damage its reputation as a well-regulated hub.

The reality is that regional leaders have to walk a geopolitical tightrope to capture digital opportunities. If they lean too far toward Chinese investments without safeguards, they risk secondary sanctions that cut off access to US technology. If they lean too aggressively toward US compliance, they risk alienating Beijing and losing a major source of digital infrastructure capital.

Managing this tension requires more than ad hoc responses. Governments need to treat data centre and AI infrastructure decisions as matters of national economic and security strategy, not purely commercial ones. This requires deliberate choices about the kinds of investment that their countries want to attract and the compliance standards they are prepared to maintain.

They need to strengthen export controls and end-use verification in a more systematic way. This is not only about satisfying Washington but about protecting long-term credibility as technology and investment destinations.

Officials should also communicate clearly and consistently with both the US and China about their red lines and constraints. Governments would also benefit from greater regional coordination on export controls to avoid being played off against each other by external powers.

Finally, Southeast Asian governments should invest in building their own technical and institutional capacity to verify corporate ownership and end-use, rather than relying heavily on external guidance or pressure.

US enforcement is bound to grow more targeted and expand beyond hardware, while regional demand for advanced computing capacity will keep rising. As a result, the dilemma for Southeast Asian countries is unlikely to recede. On 12 June, the US imposed controls on Anthropic’s Fable 5 and Mythos 5. If this trend continues, Southeast Asian countries will face even greater compliance challenges, as they will need to monitor not only hardware flows but also access to and development of advanced AI models.

Time is running out fast, but the region still has a narrow window to shape outcomes rather than merely react to them. How governments strengthen their regulatory systems and communicate their limits in the coming months will largely determine whether the region preserves meaningful room to manoeuvre; failing which, they will find their choices narrowed by infrastructure decisions made under external pressure.

2026/194