US and Southeast Asia AI Regulation
There is no single US AI statute and no single ASEAN one. Obligations arrive state by state and country by country, so the work is sequencing — what actually binds you now, and what to build ahead of.
No federal statute, no ASEAN harmonisation — so compliance is a sequencing problem
An AI company entering the US meets a patchwork: state AI statutes, employment-discrimination rules applied to automated decision tools, and sector regulators each asserting jurisdiction over the same product. Entering Southeast Asia meets a different patchwork: six data protection regimes at different maturity levels, with AI-specific guidance layered on top in some markets and absent in others.
The practical error is treating this as a coverage problem — five markets, five compliance projects. It is a sequencing problem: a common baseline covers most of what every regime requires, and a thin local layer covers the rest. Companies that build five separate programmes pay five times and still miss obligations; companies that build one baseline and four adaptations move faster.
What we do
- Market priority assessment: where the product is actually used, at what volume, and which jurisdictions bind as a result
- Instrument mapping: for each market, the enacted statutes, the regulators, and whether obligations are in force or pending
- Baseline build: one data-protection and AI-governance foundation that satisfies the common core across markets
- Local adaptation layer: the specific additions each jurisdiction requires, kept separate so they can be updated without rebuilding
- Employment-tool review: automated hiring and evaluation tools carry distinct audit and notice duties in several US jurisdictions
- Local counsel coordination: Singapore, Thailand, Indonesia and Vietnam, where local opinions are required rather than advisable
The landscape, by shape rather than headline
United States. No comprehensive federal AI statute. Obligations come from three directions: state AI statutes (Colorado’s AI Act on high-risk systems and consumer protection; Texas’s TRAIGA; California’s frontier-model transparency and training-data disclosure requirements), employment law applied to automated decision tools (New York City’s Local Law 144 requiring bias audits of automated employment decision tools; Illinois rules on AI in hiring), and sector regulators applying existing consumer-protection and anti-discrimination authority. Status changes every legislative session, so any list is a snapshot, and the audit has to be run against the current text.
Southeast Asia. Data protection is the mature layer: Singapore’s PDPA, Thailand’s PDPA, Indonesia’s Law 27/2022, Vietnam’s Decree 13/2023, Malaysia’s amended PDPA and the Philippines’ Data Privacy Act. Most are GDPR-shaped but differ on registration, breach notification timing, cross-border transfer conditions and local representative requirements. AI-specific rules are thinner and mostly soft law — Singapore’s Model AI Governance Framework and its guidance on generative AI are the most developed, and while they are not statutes, they inform supervisory expectations and procurement.
What is different for an AI company
- The US is judged by state, not by federal rule. Colorado, California and others have dedicated AI statutes and disclosure duties; apply the law where users are, not where you incorporate.
- AI content labelling is mandatory in several markets. Beyond the EU, China, several US states and major platform rules require disclosure of generated content; build to the strictest standard once.
- Southeast Asia turns on local deployment and entity. Indonesia and Vietnam attach data-localisation and content-licensing duties; whether you deploy locally decides the licence path and the filing entity.
- Training-data provenance must be demonstrable everywhere. Copyright, personal-data and localisation rules differ, but all of them expect records; without them the position cannot be explained anywhere.
- Governance documents can be reused, mapped by jurisdiction. One risk-management set mapped clause by clause is cheaper than rewriting per country, but disclosure wording cannot be copied across.
Typical situations
Situation 1: Extraterritorial effect overlooked at state level
The company has no US entity and no US office. Its product is used by residents of states whose AI statutes attach on the basis of serving those residents. Jurisdiction follows use, not incorporation, and the assumption that “we are not in the US” fails the same way it fails under the AI Act.
Our approach: measure where users actually are, then map that distribution against enacted statutes rather than against the states the company thinks it operates in.
Situation 2: An automated hiring tool treated as an ordinary product feature
A screening feature ranks candidates. In several US jurisdictions that is an automated employment decision tool, subject to independent bias audit, published results and candidate notice. The feature ships as a product update, and the audit obligation is never identified.
Our approach: review every feature that makes or informs a decision about a person — hiring, evaluation, credit, pricing — against the jurisdiction-specific tool rules, and schedule the audits as recurring obligations rather than launch tasks.
Situation 3: Southeast Asia deprioritised as “lower risk”
A market entry is deferred on the assumption that enforcement is light. In practice, breach notification deadlines are strict, transfer conditions are formal, and a regulator’s inquiry arrives with a short response window. The cost of the assumption is highest in the market where nothing was prepared.
Our approach: build the baseline before entry, localise at entry, and where local counsel is required, engage before the first incident rather than after it.
Process and deliverables
| Stage | Work | Deliverables |
|---|---|---|
| 1 | Jurisdictional mapping against actual user distribution | Market obligation matrix |
| 2 | Gap analysis against enacted requirements | Priority register + remediation sequence |
| 3 | Baseline build (data protection and AI governance) | Policy set + records + assessment templates |
| 4 | Local adaptation and local counsel coordination | Market-specific addenda + local opinions |
| Ongoing | Legislative tracking and refresh | Quarterly update note + revised baseline |
AI-specific deliverables
- Per-market obligation matrix: filing, labelling and local-entity duties mapped by jurisdiction.
- Training-data evidence checklist: what each market requires you to be able to demonstrate.
Frequently asked
Do we need a US entity to be caught by state AI laws? No. Several state statutes attach on the basis of conducting business in the state or serving its residents, which is a factual test rather than a corporate one. The analysis starts with the user distribution, not the org chart.
Are Singapore’s AI governance frameworks legally binding? Not as such — they are frameworks rather than statutes. They nonetheless shape supervisory expectations, and they are frequently written into procurement and investor diligence requirements, which makes them commercially binding even where they are not legally binding.
Can one privacy policy cover all these markets? A single policy can cover the common core, but several jurisdictions require specific disclosures, named representatives, or language that a global policy will not contain. The workable structure is one baseline with a jurisdiction-specific annex, not one document stretched to fit.
How often does this need to be revisited? At least annually, and on any market entry. US state legislation moves every session and several of the enacted statutes have been amended before their effective dates, so a position paper older than a year should be treated as a draft.
Legal basis
- Colorado AI Act: high-risk system duties, impact assessments, consumer notice
- Texas Responsible AI Governance Act: prohibited uses and developer/deployer duties
- California: frontier-model transparency and training-data disclosure statutes; bot disclosure
- New York City Local Law 144: bias audit, publication and notice for automated employment decision tools
- Illinois: AI in hiring and video interview rules; biometric information statute
- Singapore PDPA and Model AI Governance Framework; Thailand PDPA; Indonesia Law 27/2022; Vietnam Decree 13/2023; Malaysia PDPA (2024 amendments); Philippines Data Privacy Act