Closing the Gap: How Southeast Asia Can Accelerate AI Readiness

How can Southeast Asia accelerate readiness?

Addressing Southeast Asia’s artificial intelligence readiness deficit requires a fundamental change in governance strategy. As outlined in Part 1 of this series, neither top-down policy roadmaps nor conventional public advisories urging greater vigilance can keep pace with synthetic media and automated exploitation.

To govern technologies that evolve in weeks rather than legislative cycles, the region must treat readiness as a continuous, operational learning discipline.

Two principles can enable public institutions and society to build capabilities and respond faster.

Principle One: Learn Through Practice

Public agencies require regular opportunities to test and stress-test frontier AI tools directly within controlled, sandboxed environments equipped with robust data and security safeguards. This engagement must go far beyond deploying commercial models for basic administrative tasks. Regulatory officials must develop an intuitive understanding of how models degrade, hallucinate, fail, or lend themselves to malicious use, and what those vulnerabilities mean for their respective jurisdictions. Direct experimentation does not replace technical audits by computer scientists, but it equips policymakers to ask better critical questions.

Citizens likewise require experiential learning rather than passive warnings. Singapore’s National Simulated Scams Exercise in 2026 illustrated this approach by deploying simulated AI-enabled calls impersonating public officials. This exercise gave members of the public safe, realistic practice in identifying psychological manipulation, verifying identities through alternative channels, and initiating defensive protocols, rather than expecting them to visually detect hyper-realistic deepfakes. Community organisations can adapt similar simulation modules to reflect the real-world contexts of distinct demographic groups.

At an institutional level, governments and corporations routinely run internal cybersecurity tabletop simulations. Regulators should adapt this established methodology to frontier AI threats, convening multi-sector exercises involving law enforcement, commercial banks, telecommunications carriers, digital platforms, frontier AI developers, and civil society representatives.

Bringing these disparate stakeholders together will not be easy. They have different priorities, resources and limits on what they can share or act on. A first exercise will probably reveal more gaps than it resolves. But that is part of its value: helping participants understand where they need to work together, before a real incident puts those relationships to the test.

Consider a deepfake call impersonating a government official. A community group receives a report, a platform holds information about the account, and a bank detects a suspicious transfer. When does each actor have enough information to act? Who contacts whom? What evidence is needed to suspend an account or freeze a payment? Who supports the person targeted?

Participants may have different understandings of the threat, use different terminology, and operate under different action thresholds. This friction is part of the learning. Discovering these gaps in a safe environment gives participants a chance to address them before a real incident occurs.

This process should continue well beyond the exercise. Participants can take what they have learned back to their respective organisations, discuss what needs to change, and agree on who will follow through. When they reconvene, they can evaluate whether they are truly better prepared to respond.

Principle Two: Do Not Go It Alone

While public agencies must build internal technical capacity, systemic risks cannot be solved by the state alone. A digital platform may hold critical behavioural telemetry on coordinated synthetic networks; academic researchers may possess state-of-the-art detection benchmarks; and grassroots organisations understand why vulnerable citizens hesitate to report distress.

Governments should leverage their convening power to unite these distributed capabilities. Rather than procuring static solutions behind closed doors, public authorities can sponsor targeted innovation challenges and regulatory sandboxes—providing resources, legal clarity, and validation pathways for local startups and researchers developing verification and mitigation tools.

Crucially, collective action does not mean abdicating statutory responsibility. Regulators still need sufficient in-house expertise to scrutinise vendors and independently evaluate results. Similarly, model developers must mitigate misuse, while platforms, banks, and telecommunications operators must reinforce safeguards across their services.

Community groups play a vital role in scoping problems and determining whether solutions actually serve affected populations. For any of these partnerships to function, however, jurisdictions must establish clear information-sharing protocols that rigorously protect personal data.

Putting both principles into practice across ASEAN

Southeast Asia does not have to construct collaborative defence systems from scratch. The region already possesses a track record of practical coordination: the 2024 ASEAN CERT Incident Drill convened 19 national computer emergency response teams to simulate responses to AI-augmented cyberattacks.

ASEAN can build on this precedent by staging cross-border, multi-stakeholder exercises designed for AI-driven impersonation and systemic fraud. Executing this across borders introduces jurisdictional friction, uneven national capabilities, and divergent data-governance regimes.

A practical starting point would be a small pilot among a few willing countries, built around a realistic cross-border scenario: victims in one country, accounts or technical infrastructure in another, and illicit funds moving into a third.

Using synthetic data, participants could map out who contacts whom, what each party can realistically do, and where the process stalls. These findings would help participating states see what they can improve domestically and where alignment with regional partners is needed most.

This approach puts both principles into practice: learning by doing, and building capabilities through collaboration. Crucially, the exercise highlights where working together becomes difficult—and what can be done to resolve it. Over time, this shared practice will help ASEAN build the institutional muscle needed to respond as a cohesive region.

Accelerating Collective Readiness

The debate over whether global frontier AI development should decelerate will continue in international forums. Southeast Asia should actively contribute to these discussions, but regional resilience cannot wait for international consensus.

Southeast Asia holds a vital domestic lever: accelerating the speed at which its own institutions, commercial entities, and citizens learn and respond. Doing so requires sustained investment in specialist technical talent, practical simulation infrastructure, and the operational space to act on post-exercise findings.

Individuals cannot be expected to carry the burden of safety alone. As technology companies continue to make AI models more capable, regional institutions must become equally deliberate about collective learning, cross-sector coordination, and mutual defence. Preparing society to withstand emerging digital risks requires the same resourcefulness and commitment that fuels technological advancement.

The views and recommendations expressed in this article published on November 2026 are solely of the author/s and do not necessarily reflect the views and position of the Tech for Good Institute.