Chinese Data Centers Will Shape ASEAN’s AI Norms

In June, Alibaba Cloud inaugurated two data centers in Johor, Malaysia, marking the company's expansion to a total of five data centers in Southeast Asia. This move coincided with ASEAN's endorsement of a Malaysia-led framework outlining guidelines for cross-border cloud computing, which established regional principles for data protection, regulatory oversight, and data hosting across borders.

However, despite Malaysia's leadership in drafting ASEAN's cloud regulations, the region's increasing dependence on Chinese data centers might inadvertently promote norms and safeguards shaped by Chinese law, even if member states' policies emphasize stronger protections. This could favor Chinese AI model developers who disclose less about their security measures while Beijing rigorously controls content related to sensitive political issues.

ASEAN governments should view data center investments as integral to AI governance and norm formation rather than mere industrial policy considerations. Major cloud providers possess the resources to supply vast computing capacity and comprehensive cloud and AI systems. Consequently, their platforms inadvertently dictate technical practices throughout the ecosystem.

Services built upon these platforms must align with providers' service requirements and adhere to provisions for access, configuration, and security. Given the prevalence of digital services on data centers, the technical standards and operational practices established in Chinese-built or operated facilities will significantly influence the services that run on them.

Therefore, these data centers present an opportune site to scrutinize whether Chinese involvement is exerting broader influence over technical standards and operational norms. Due to platform lock-in, this influence can solidify within systems, posing a risk that government agencies might lose practical control over their use of these systems.

Once government entities and highly regulated industries construct services around a single provider, transitioning to alternative privacy or security standards often necessitates extensive redesigns, retraining of personnel, and substantial migration expenses. Chinese cloud providers have been actively establishing their presence in Malaysia and Indonesia through strategic partnerships with governments and businesses, integrating their cloud services into the core infrastructure of the digital economy.

Even when operating overseas, Chinese cloud providers must adhere to China's Cybersecurity Law, Data Security Law, and National Intelligence Law. These statutes grant the Chinese government the authority to request access to data deemed pertinent to national security, akin to the USA PATRIOT Act, CLOUD Act, and FISA 702. The same obligations facilitated U.S. authorities in their pursuit of Chinese intelligence officer Xu Yanjun, who was apprehended in Belgium and subsequently extradited to the United States.

Alibaba is not only constructing AI infrastructure in Malaysia but also investing in training initiatives. In 2025, Selangor state acknowledged Alibaba Cloud as a provider under its Multi Cloud Services scheme. The company now offers training in its proprietary AI Toolkit and certification courses tailored for government agencies, educators, students, and local communities.

Moreover, Alibaba has collaborated with the Malaysia Digital Economy Corporation, the government agency spearheading Malaysia's technological advancement, to instruct small and medium-sized enterprises on adopting cloud computing and AI. In Indonesia, Huawei has similarly forged connections, such as partnering with the National Cyber and Crypto Agency and Institut Teknologi Del, establishing a Huawei Academy, and offering digital literacy and cybersecurity training to the Indonesian Air Force.

Huawei portrays these initiatives as efforts to disseminate "cybersecurity best practices" derived from its tools and expertise. By cultivating best practices and establishing norms, these endeavors are becoming entrenched in a region characterized by uneven digital regulations and enforcement, as well as heightened U.S.-China AI competition, rendering ASEAN nations increasingly susceptible to U.S. law enforcement scrutiny.

In Indonesia, a 2024 investigation revealed that ambiguous definitions, limited enforcement, and insufficient provisions for AI or big data in the country's 2022 data protection law undermined its implementation. Although the European Union's General Data Protection Regulation has indirectly influenced regional privacy laws, it has not engendered consistent standards or enforcement, thereby enabling providers' practices to assume default roles.

Malaysia's proposed safeguards may provide some relief, but businesses and agencies reliant on a single provider may find the transition prohibitively expensive and consequently accept practices that diverge from domestic privacy objectives. This proliferation of Chinese infrastructure may also directly facilitate advanced Chinese AI development.

The Financial Times disclosed in November 2025 that Alibaba and ByteDance were utilizing Southeast Asian data centers to train sophisticated AI models, leveraging Nvidia chips that are inaccessible in China. As these facilities become critical to Chinese AI developers' ability to train advanced models, Beijing may perceive Chinese-operated data centers in ASEAN as strategic assets rather than routine overseas investments.

As China's Data Security Law entitles countermeasures against nations that impede Chinese investment or trade involving data technologies, any actions by ASEAN governments within the bounds of these laws could potentially escalate into a source of contention. While there is no conclusive evidence to support this conjecture, it underscores the importance of closely monitoring the impact of Chinese data centers on ASEAN's AI landscape and digital governance.