By Jamie Ko, Acting Executive Director at Tech For Good Institute
At a glance
- AI proliferation is outpacing institutional readiness: Rapid regional adoption and high-fidelity generative tools—exemplified by a S$4.9 million executive deepfake scam in Singapore—are creating downstream risks far faster than public bodies can evaluate, regulate, or contain them.
- Paper policies mask deep operational deficits: While several Southeast Asian nations score high in formal AI strategy and policy formulation, institutional resilience remains low due to critical shortages of domain specialists and siloed intelligence across law enforcement, central banks, and tech platforms.
- Digital immersion increases exposure rather than resilience: Tech For Good Institute research shows vulnerability cuts across demographic lines, with 65% of digital-native youth (aged 18–34) encountering suspected scams compared to 44% of older groups, proving that generic calls for “individual vigilance” cannot counter synthetic media.
- Governance must evolve into dynamic, cross-border systems: Closing the readiness gap requires moving beyond static white papers and reactive public advisories toward embedded system-level safeguards, continuous multi-stakeholder operational learning, and unified ASEAN coordination.
Share this insight
A WhatsApp message arrives, ostensibly from Singapore’s Secretary to the Cabinet, inviting you to a confidential Zoom meeting with the Prime Minister and senior officials. You receive an official-looking letter and sign a non-disclosure agreement. When the call begins, the officials appear on screen, requesting urgent financial assistance for a state matter.
Except none of them is real.
This scenario took place in Singapore in May 2026. The participants were entirely fabricated using deepfake AI technology. By the time the victim contacted the real Secretary to the Cabinet, at least S$4.9 million had already been transferred.
Scammers have long exploited trust, urgency, and fear; AI now allows them to do so with unprecedented fidelity. Yet the time available for institutions and individuals to understand and counter these emerging threats is shrinking.
The core issue is not merely that AI is advancing quickly, but that its capabilities are spreading faster than societies can adapt to and govern them. Southeast Asia must invest in helping people and institutions respond effectively—and put that knowledge into practice.
A Compressing Learning Window
The pace of frontier capability development highlights the challenge. In 2023, a study evaluated large language models on 1,700 Chinese primary-school maths problems; GPT-4 was the only model to achieve at least 60 per cent accuracy across all six grade levels. Just two years later, an advanced version of Gemini achieved a gold-medal standard at the International Mathematical Olympiad. While these milestones promise substantial economic and social value, developing the institutional capacity to govern them is a slower, deliberate endeavour. Governments require technical expertise and operational machinery for implementation and enforcement. Citizens must understand how emerging technologies alter everyday risks and how their personal behaviours must adapt.Crucially, consumer-facing AI tools are readily accessible through common digital platforms. New capabilities can diffuse, and be deployed maliciously, well before public institutions have had time to evaluate them.
Southeast Asia is a primary market for these technologies. In July 2026, Google reported that active Gemini application users in the region had more than doubled in a single year. While frontier models are predominantly built elsewhere, their downstream risks and benefits land locally with immediate effect.
This does not render Southeast Asia powerless. Regional governments possess the regulatory authority to determine the conditions under which AI systems are deployed and commercialised within their borders. Where specific risks cannot yet be evaluated or mitigated, targeted restrictions or staged deployments are sensible options. Beyond contributing to global governance forums, the region must dramatically accelerate its internal capacity to learn and adapt. AI-enabled scams provide a tangible illustration of this broader readiness dilemma.
Institutional Readiness Beyond Paper Policies
Across Southeast Asia, policymakers are formulating national AI strategies, governance frameworks, and ethical guidelines. However, effective institutional readiness demands more than published principles: it requires the technical capacity to evaluate live models, translate high-level guidelines into enforceable operational rules, and coordinate real-time responses across jurisdictions.
The region begins from uneven baselines. Oxford Insights’ 2025 Government AI Readiness Index placed Singapore seventh globally, with five other Southeast Asian nations inside the top 50. Yet national aggregates conceal deep operational gaps. For example, Thailand and Malaysia both scored above 80 out of 100 for Policy Capacity, but below 40 for Resilience—a metric assessing institutional preparedness for wider societal transitions, including safety and security risks.
A comprehensive policy framework does not guarantee operational readiness. Drafting a policy is fundamentally different from having the technical ability to assess a novel model or contain an active incident.
Moreover, different tasks demand distinct competencies: evaluating a frontier model’s architecture is distinct from determining whether a specific consumer deployment is safe, which is different again from running an emergency mitigation workflow when systemic harm occurs.
Public agencies operate under tight resource constraints and cannot employ every required domain specialist. Critical operational signals remain fragmented: police forces, central banks, telecommunications operators, digital platforms, independent researchers, and affected civic groups each hold isolated pieces of the puzzle. Even when everyone is working on the problem, they may not be learning from one another.
The Uneven Nature of Societal Readiness
A parallel deficit exists at the societal level. Research conducted by the Tech For Good Institute across six Southeast Asian nations demonstrates that vulnerability to digital deception cuts across demographic divides. Some 65 per cent of surveyed respondents aged 18 to 34 reported encountering a suspected scam, compared with 44 per cent of older cohorts. Risk is therefore not confined to digitally inexperienced citizens; rather, scam exposure directly tracks everyday digital immersion.
The research also uncovers an acute disconnect between subjective confidence and actual capability. Fewer than half of respondents felt confident in their ability to detect scams, even though the average identification accuracy in the study’s objective test reached 71 per cent. Across the four distinct consumer personas identified in the study, varying combinations of confidence and capability demonstrate that different demographic segments require tailored interventions rather than generic warnings.
These empirical findings carry clear implications for AI safety. As generative models make impersonation effortless and synthetic media near-indistinguishable from reality, traditional public advisories urging citizens to simply “be more vigilant” turn into an exhausting game of whack-a-mole.
Individual vigilance cannot compensate for structural vulnerabilities. Building true societal readiness requires combining experiential public education with baseline safeguards embedded directly into the systems people use.
Looking Ahead
Diagnosing the readiness gap is only the first step. If the velocity of technology exceeds the cadence of traditional policy-making, Southeast Asia cannot rely on passive adaptation.
Bridging this divide requires shifting from reactive regulation to dynamic, continuous learning systems.
In Part 2 of this series, we examine concrete recommendations for the region: operationalising multi-stakeholder practice, fostering cross-sector accountability, and establishing coordinated cross-border mechanisms across ASEAN.
The views and recommendations expressed in this article published on November 2026 are solely of the author/s and do not necessarily reflect the views and position of the Tech for Good Institute.
