How much production should actually leave China, and which parts of the supply chain are genuinely portable? These are the questions that heads of manufacturing and supply chain leads should be asking before committing the next tranche of production capacity to a new location.

In 2025, many didn’t get the chance to. A year later, some are moving back. The US-China trade war has been escalating since 2018, but the tariff pressure intensified sharply in 2025, with Trump announcing an additional 100% tariff on Chinese goods at one point. Companies moved fast, shifting their production to Vietnam, India, Indonesia, and Thailand. But a few companies have since returned: Target has moved some orders back to Chinese suppliers; Shein has scaled back Vietnam operations; an outdoor furniture exporter shut his Ho Chi Minh City workshop after discovering he had to import screws and cup holder molds from China, according to Reuters. Reuters noted that hard data on the scale of sourcing returning to China is not yet available. The cases are illustrative of a pattern, not evidence of a reversal at scale.

Many companies based their diversification decision on a framework that was missing three variables: supplier ecosystem depth, power reliability, and tariff arithmetic stability. As it turns out, alternative manufacturing hubs struggle to match China’s skilled labor, supplier networks, and reliable power.

The China+1 strategy—keeping production in China while building capacity elsewhere to reduce supply chain risk—is not being abandoned entirely, but there is a case to revise its execution. China’s manufacturing wages have increased, and are projected to keep rising. The cost advantages that made China the world’s factory floor are narrowing, and China itself is shifting toward higher-value manufacturing, automation, and AI-enabled production.

The space being vacated creates a genuine opening. China+1 has redirected growth toward markets that were previously crowded out, giving other economies a chance to build the industrial base that China’s dominance had limited. Take India, for example. Apple’s iPhone exports from India crossed US$23 billion in 2025, an 85% jump from 2024. India’s share of global iPhone production reached approximately 25% in 2025.

Against such a backdrop, these are the questions a COO or supply-chain lead needs to answer when reconsidering their China+1 strategy: how much production should actually leave China, which parts of the supply chain can realistically be replicated elsewhere, and whether the decision being made accounts for how these markets actually work on the ground.

What the Framework Misses

The China+1 decision framework weighs tariff differentials, labor costs, and logistics. Three additional variables need to be accounted for to determine whether a relocation actually works.

Supplier ecosystem depth. China’s component supplier networks took decades to build. It’s an ecosystem that’s not immediately replicable elsewhere. Vietnam, for example, operates on a “China for parts, Vietnam for assembly” model: finished goods ship from Vietnam, but the components feeding those lines still come from China. The outdoor furniture exporter who shut his Ho Chi Minh City workshop did so because basic inputs were unavailable locally.

Power and grid reliability. Manufacturers across Southeast and India have faced unstable electricity as a constraint. In Vietnam, the 2023 rolling blackouts across northern industrial zones—where Samsung and Foxconn operate—cost the economy an estimated US$1.4 billion, or 0.3% of GDP, according to the World Bank. In India, in the first quarter of 2026, the country lost 300GWh of already-generated renewable power because transmission infrastructure could not carry it to where it was needed, according to energy think tank Ember, as previously written.

Tariff arithmetic stability. In April 2025, the United States applied sweeping tariffs across nearly all trading partners: Vietnam at 46%, Thailand at 36%, Indonesia at 32%, Malaysia at 24%. The tariff differential that had justified relocating to those destinations narrowed overnight. Within months, most countries secured significantly reduced rates. But the episode demonstrated that a business case built on today’s tariff differential may not survive the next round of trade policy.

A Better Decision Framework

A COO or supply-chain lead should ask which country is best for this specific product, cost structure, compliance requirement, and supply chain objective, not which country is best overall. The answer should vary by product category.

A bill-of-materials analysis is the practical starting point. High-complexity, component-intensive products that depend on dense supplier ecosystems—electronics, precision manufacturing, EV components—should stay in or near China longer than low-complexity, labor-intensive assembly that can operate with simpler supply chains.

Assembly location and supply chain location are not the same thing. A product that still relies on Chinese components, tooling, or specialist suppliers has not reduced its China dependency; it has added a step. Whether the relocation actually delivered the risk reduction it was supposed to depends on how much of that underlying dependency moved, not where the product was finished.

The mistake to avoid is picking one alternative country and trying to move too much of the portfolio there. A well-structured China+1 strategy matches each product category to the region where it makes operational and economic sense.

Before committing, a COO or procurement head should stress-test the business case against realistic downside scenarios: the tariff differential narrows significantly, power supply proves less reliable than advertised, or a key component cannot be sourced locally. If the case does not hold under those conditions, the location or the category selection needs revisiting.

The transition itself is a process, not a switch. Supply chain leads who run both suppliers in parallel can avoid the unexpected disruptions. That is done by gradually shifting allocation as the new supplier proves it can hold consistency across full production cycles, rather than fully committing to a relocation in one step.

Country-by-Country Analysis

Each alternative manufacturing hub illustrates a different constraint on portability. None is a direct replacement for China.

Vietnam demonstrates the supplier ecosystem constraint most clearly. Its proximity to Shenzhen allows rapid transit of components, and its export-oriented ecosystem is mature for assembly-intensive products. But the constraint is structural: components still come from China. Industrial zone occupancy in major provinces hit 86 to 92 percent in 2025 and new entrants face a tighter market than companies that moved earlier. Vietnam works as a complement to China for assembly, not a replacement for it.

India illustrates the labor scale advantage alongside the infrastructure constraint. The aforementioned Apple’s iPhone export figures show what is possible at scale, the power reliability data shows what still limits it. For high-volume, labor-intensive manufacturing targeting the US market, India’s workforce depth gives it an advantage Vietnam cannot match over time. But domestic value-add in electronics is still maturing, and logistics and infrastructure quality varies significantly across states.

Indonesia shows where raw material advantage makes relocation viable. Battery materials processing is portable to Indonesia because the inputs are there. The country has attracted multi-billion dollar investment from LG Energy Solution, and CATL, both building battery plants there. Electronics are not portable to Indonesia in the same way, because the supplier ecosystem is not.

Thailand and Malaysia stand out for specialist capability niches. Thailand has developed depth in EV, battery, and automotive manufacturing. Malaysia accounts for approximately 13 percent of global semiconductor assembly, testing, and packaging. Neither is yet suitable for large-scale labor-intensive manufacturing. What works in these markets works because it matches a specific capability that exists there.

The pattern across all four destinations is the same: none is a direct replacement for China, and each works for a specific set of product categories and supply chain configurations.

China+1 is not primarily a country-selection exercise. It is a product-by-product assessment of which dependencies can actually move and which still need to remain anchored in China. The companies that got this right asked the harder question first: not where else can we make this, but what does making this actually require and how much of that still only exists in China.

More from Asia Tech Lens

• India’s EV Makers Don’t Need to Localize Everything. They Need an Exit Path.
  India’s EV manufacturers still depend on foreign suppliers for batteries, magnets, semiconductors and other critical components. The piece looks at when localization makes sense and why reducing dependency does not necessarily mean bringing everything home.

• India’s AI Data Center Boom Is Running Ahead of the Grid
  India is attracting billions in infrastructure investment, but power availability and transmission capacity remain real operating constraints. It is a useful look at why headline investment does not always mean the underlying infrastructure is ready.

• The Hormuz Problem Asia’s Battery Makers Haven’t Mapped
  Battery supply chains depend on materials and routes that can be far removed from the final manufacturing location. This piece examines how a disruption upstream can expose dependencies that manufacturers may not see until production is at risk.

• The Chip War’s New Reality: A View from the Crossroads
  The US-China technology split is already reshaping where companies build, source and invest across Asia. This piece looks at China+1 supply chains, semiconductor dependencies and how Southeast Asia is being pulled into a more fragmented technology ecosystem.

• The Dependency Economy of AI
  Global technology ambitions increasingly depend on hardware, infrastructure and supply chains that countries and companies do not fully control. This piece maps those chokepoints and shows why resilience increasingly depends on understanding where critical dependencies actually sit.

Building with AI is no longer just trying to generate a decent-looking homepage from a prompt. Now, the more interesting question is how far they can take an idea beyond that first page—whether users can shape the result, add more functional features, and eventually turn it into something that is actually usable.

That scope now extends well beyond conventional websites. Hostinger provides AI Builder as a tool for creating web apps and interactive experiences such as chatbots, writing assistants, quizzes, games, and visualizers, alongside ecommerce sites and other online products.

To see how that works in practice, Hostinger gave Asia Tech Lens access to AI Builder, which approaches the process in two ways: Manual Mode, built around visual editing, and Agentic Mode, which lets users build and modify projects conversationally. That proposition is particularly aimed at solopreneurs and small businesses that may not have a development team of their own. We tried both to see what we could create and how differently the two approaches work.

Two Ways to Build

Manual Mode generates an initial website and then hands control back to the user through a drag-and-drop visual editor. Hostinger positions it for more conventional projects such as portfolios, blogs, business websites, and online stores. Built-in AI tools can also generate copy, imagery, and other content without consuming AI credits, which is a usage allowance required for certain AI actions. The platform also supports more than 80 languages.

Meanwhile, Agentic Mode takes a more conversational approach. Instead of manually arranging most elements, users can describe what they want through chat or voice and have the AI create or modify it. This opens the builder up to a much wider range of projects, from dashboards and client portals to reservation systems, budgeting tools, alongside other online products. A code editor is also available for users who want more direct control over the underlying code.

In practice, the distinction is clear: one mode is largely about showing the builder what you want a site to look like, while the other lets you explain what you want a product to do. That makes AI Builder accessible to less technical users, while still giving more experienced users room to build and iterate efficiently.

START BUILDING WITH HOSTINGER AI

Building a Technology Media Website

We started with Manual Mode and a relatively straightforward request: create a modern media website covering technology industry news, with a homepage, news and articles section, reviews section, featured stories, about page and contact page.

The first result was generated in roughly 40 to 45 seconds.

What stood out was how much of the basic structure was already there. Hostinger generated a homepage layout, navigation, article sections, imagery, typography and calls to action that broadly matched what we had asked for. It did not feel like an empty template waiting to be built; it already looked like the foundation of a technology publication.

That does not mean it was immediately publication-ready. Generic AI copy and imagery still needed replacing, article cards could be standardized, spacing and typography refined, and the overall visual hierarchy tightened. A real publication would also want to add its own branding and check how everything behaves across screen sizes.

But that remaining work was largely editorial and visual rather than technical. There was no need to start thinking about HTML, CSS or page structure. Most adjustments could simply be made through the interface.

That is the benefit of the initial generation. AI is not necessarily giving you the final website in under a minute, but it is skipping much of the blank-page work and getting you significantly closer to one.

It also makes Manual Mode feel sensibly designed for this type of project. Once the broad structure is in place, moving sections or tweaking the layout directly can be faster than repeatedly describing minor visual changes to an AI.

Can Agentic Mode Turn an Idea Into a Tool?

Agentic Mode becomes more interesting when the request stops sounding like a website brief.

For our second test, we asked it to create a press release submission portal for a technology publication. Companies and PR representatives needed to be able to submit their company name, contact person, email address, product or category, headline, press release text, publication date and relevant files or images.

The first version took around five minutes—longer than Manual Mode, but understandable given that the request involved more than generating a layout.

More importantly, we had a starting point without having to explain how a submission system should technically be built.

We then asked Hostinger to add an internal dashboard showing the submitted press releases. Around three to four minutes later, that was there too. Another prompt added search and made it easier to distinguish between new, reviewed and rejected submissions.

The experience became less about constructing individual components and more about iterating on an idea.

That was particularly apparent when we noticed too much empty space in the mobile version. Rather than hunting through layout settings, we simply asked: “Can you reduce the negative space in mobile view to make the site look a lot more compact?”

The resulting mobile layout became slightly tighter while the desktop version remained unchanged.

This is where Agentic Mode starts to justify having a separate interface. If a feature is easier to explain conversationally than to manually assemble, asking for the outcome can be considerably more approachable than figuring out the technical steps behind it.

Agentic actions consume AI credits—about five to 10 for a simple business page and 15 or more for complex SaaS-like projects—so it helps to bundle related requests.

Building Is Only Half the Job: What Happens When We Try to Put it Online?

The next part of the test was getting the projects online. Instead of generating a site and then leaving the user to figure out hosting, domains, and security somewhere else, much of what is needed to launch it sits in the same ecosystem.

In Manual Mode, a project remains private until the user publishes it, and the actual launch process is handled directly inside the builder. Domains can be pointed to AI Builder through Hostinger, while externally managed domains can be connected through supported DNS methods.

SSL certificates are managed automatically, with HTTPS enabled once the site is properly connected and published.

The integrated backend was particularly relevant to our Agentic Mode test, such as our press release portal. Hostinger provides an integrated backend for working with project data and user-uploaded files, rather than requiring users to immediately configure their own external database or storage system.

For our use case, that considerably shortens the conceptual jump between “we created a submission form” and “we created something capable of doing useful work with those submissions.”

More advanced projects can still require outside services, and Hostinger supports integrations with external databases and APIs where needed. But for our case, having the builder, backend, hosting and publishing tools connected removes several points where the project could otherwise become considerably more complicated.

Hostinger also leaves room for a project to move beyond the builder. Agentic Mode code can be exported as a Node.js project built with React and Vite, although integrated backend data is managed separately and is not included in that export.

Taken together, that integration may ultimately matter more than how quickly the first page appears. Generating a prototype is useful; making the path from that prototype to something deployed and functional relatively straightforward is what makes the platform feel more complete.

How Businesses Are Using AI Builder Beyond Our Test

The use cases do not necessarily have to be as elaborate as our press release tool.

AI Builder’s flexibility shows in the range of projects users can create with it. One example is a business that grew from a local shop into a brand shipping products across India. Its website serves a comparatively conventional role: establishing an online presence, presenting products clearly and supporting ecommerce as the business grows beyond its original physical footprint.

Another example is an independent creator with around 400,000 subscribers who runs the operation largely alone. There, the website functions as owned digital infrastructure around an audience and body of work that already exist elsewhere.

That range is the broader point: AI Builder is intended to support everything from conventional business websites to more customized web apps and interactive tools, depending on what the project calls for. Not every user needs a complex application; sometimes the more practical benefit is simply being able to build the kind of online presence they need without turning the development process into a technical undertaking.

Which Mode Fits Which Project?

Our testing made the distinction between the two modes clearer in practice. Manual Mode made more sense when the basic shape of the project was already familiar. Once the technology site had been generated, most of the remaining work involved replacing content, adjusting the layout and deciding how the finished site should look.

Agentic Mode became more useful when the project depended more on behavior. With the press release portal, we could concentrate on what the system needed to do, then refine it through additional requests as new requirements emerged. That made experimentation easier.

Neither approach removed the need for human judgment. We still had to evaluate the copy, layout, and visual hierarchy, spot problems, and decide whether a generated feature actually addressed what we were trying to accomplish. In that sense, AI Builder shifted some of the work away from initial construction and toward defining, reviewing, and refining the result.

Convenience does come with a cost. Agentic actions consume AI credits, and more complex projects may still require external integrations or additional technical work beyond what the builder handles.

Both modes can be tried free without a card, with five AI credits included to start. Paid plans begin at $2.99 per month and come with a 30-day money-back guarantee.

In our tests, Hostinger shortened the distance between the initial idea and something concrete enough to evaluate. It does not eliminate the work that comes after that first version, and the amount of refinement will depend on what is being built. But rather than beginning with a blank canvas or the underlying technical implementation, we were able to begin with something functional and work forward from there.

BUILD IT WITH HOSTINGER AI

Produced with support from Hostinger.

More from Asia Tech Lens

• At WAIC Hong Kong, the AI Conversation Has Moved Past the Model Race
  The AI market is increasingly about products people can actually use and pay for, not just better models. The piece looks at coding as one of AI’s clearest commercial use cases and the wider shift toward packaging AI for everyday users.

• AI’s Winners and Losers: Big Tech Surges, Legacy Software Falters
  AI-native tools are beginning to challenge traditional software and IT-service models by making some capabilities cheaper and easier to access. That disruption provides useful context for why tools that let users build their own sites, workflows and applications matter.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data
  This piece looks at the data, process and human factors that determine whether AI moves beyond a successful demo into something people actually keep using.

• China’s OpenClaw Wave: Signal or Noise?
  OpenClaw’s rapid spread in China shows what happens when sophisticated AI tools become easy enough to deploy that adoption moves beyond specialist developers.

• Asia’s Agentic Moment: The Manus Interview That Preceded Meta’s Billion-Dollar Move
  A look at how Manus approached AI agents as a product category rather than just a model feature, with an emphasis on usability, execution and real-world workflows.

On September 3, Nvidia confirmed it had agreed to acquire Hugging Face for US$12.93 billion, its second-largest acquisition ever. Hugging Face, an ecosystem for the open-weight AI ecosystem, is home to more than 3 million models and 500,000 datasets. There are 18 million developers who use the platform to find, download, and build with AI models.

The deal makes sense from both sides. Hugging Face CEO Clément Delangue told CNBC he approached Huang over the summer, concluding that open-source AI had reached a turning point and needed more resources, scale, and visibility. For Nvidia, as CNBC reported, half the company’s business is driven by open models.

Owning the platform where those models are distributed keeps a strategically important asset out of competitors’ hands and deepens Nvidia’s relationship with the developer community that drives chip demand. Huang has committed to keeping the platform open and not requiring Nvidia hardware to build or deploy through it.

For operators in Asia who access models through Hugging Face, the relevant question is less about what makes the acquisition strategic, but rather: what changes when infrastructure you treat as neutral acquires an interested owner?

Chinese-deployed models account for 41% of downloads on Hugging Face and Nvidia’s own SEC filing acknowledges that restrictions on Chinese model availability could materially affect the platform’s value. That is a structural risk operators should be aware of.

The Circular Economy Analysts Are Watching

Analysts have been cautious about the structural dynamic the acquisition creates. As The New York Times wrote, Nvidia has built a circular economy. In the case of the acquisition: chips power AI development, AI development drives chip demand, and owning the platform that hosts models gives Nvidia visibility and influence over the ecosystem that sustains its core business.

The concern with the acquisition, as Fortune noted, is not that Nvidia will act in bad faith, but that over time ownership shapes defaults, integrations, and priorities in ways that are difficult to anticipate prior.

The Microsoft-GitHub parallel is a helpful reference. After Microsoft acquired GitHub in 2018 for US$7.5 billion, GitHub remained broadly open. It also became the default home for Microsoft’s developer tooling, with Copilot deeply integrated into the platform in ways that advantage the Microsoft ecosystem.

Why This Is Relevant for Operators in Asia

According to Hugging Face’s own Spring 2026 ecosystem report, Chinese-developed models accounted for 41% of downloads on the platform over the past year, surpassing US models in both monthly and overall usage. Alibaba’s Qwen family alone has more than 113,000 derivative models on the platform.

For many operators in Asia, the dependency on Hugging Face runs deeper than download statistics suggest. Accessing Chinese open-weight models directly through their source labs’ APIs from outside China hits a consistent set of frictions: regional endpoint blocks, Chinese phone verification requirements, and Chinese-only payment methods, as documented by developers who have navigated the direct route.

Downloading model weights through Hugging Face can bypass much of that friction. For openly downloadable weights, operators do not need to navigate separate lab accounts, API access, payment systems, or other provider-specific requirements. For operators who download and run Chinese models on their own infrastructure rather than accessing them through a Chinese lab’s API, Hugging Face is one of the most practical distribution routes available outside China. That makes the platform’s governance more consequential for Asian operators than the download figures alone suggest.

Nvidia’s own SEC filing acknowledges that there is a risk it cannot fully control: “Any regulatory control or other restriction that limits our ability to provide products and services that support models derived from any region, including China, could have a material impact on Hugging Face’s platform.” While this is standard acquisition risk disclosure, not an unusual admission, it does confirm that Chinese model availability is a variable in Nvidia’s business case—and therefore a variable in the platform’s future, in a way it was not when Hugging Face was independent.

For operators in Asia, the practical implication is not that Chinese models will disappear from Hugging Face. It is that the platform they have treated as neutral infrastructure now sits inside a company with its own strategic interests, regulatory exposure, and commercial incentives.

What Operators Should Do

For operators who have built workflows around Hugging Face, three actions should move from optional to baseline: inventory your dependencies, preserve critical models and license documentation locally when permitted, and prove those models can be redeployed without Hugging Face.

• Map which models in your production workflows exist only on Hugging Face with no verified local copy. The exercise is straightforward: which models, fine-tunes, or datasets in your stack would be disrupted if access changed?

• If a Chinese open-weight model is part of your AI stack or forensic response capability, keep a local copy of the weights. In July, OpenAI models escaped their evaluation sandbox during a cybersecurity test and breached Hugging Face’s production infrastructure. Hugging Face ran Z.ai’s GLM 5.2 locally to investigate the breach because commercial US models refused to process logs containing live exploit code. It demonstrated why local model access matters operationally.

• Know which models you can retrieve, preserve, and redeploy without Hugging Face. Verify the licensing terms now, while the platform remains fully open. Licensing documentation, model weights, and dataset access are worth archiving before availability becomes a commercial or regulatory question rather than a technical one.

For operators who have built workflows around the platform, these three steps are the minimum response to a dependency that has changed in nature, even if it has not yet changed in practice.

More From Asia Tech Lens

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In Why the intermediary layer in an AI stack can become a harder dependency than the model itself.

• Southeast Asia Needs the Right AI Model for the Right Job

  Chinese open-weight models can lower costs, but operators need to weigh deployment, performance and compliance before building around them.

• When an AI Agent Escapes Its Sandbox
  Hugging Face’s own security incident shows why operators need local access, containment and fallback options when AI systems fail.

• The Chip War’s New Reality: A View from the Crossroads
  How tightening U.S.–China technology controls are forcing Asian operators to rethink where critical dependencies sit.

• When Fried Chicken and Beer Leads to a US$10 Billion Deal

  South Korea’s Nvidia deal shows how dependence on a single strategic supplier can complicate claims of AI autonomy.

Many enterprises are looking to standardize their AI environments around common platforms and controls. But operational workloads are showing why that does not necessarily mean relying on one model. For tasks that depend on accurate forecasts, optimization or consistent numerical outputs, a general-purpose model may not be the best fit, even if the company already uses it elsewhere. Enterprises should standardize governance and infrastructure where they can, without allowing platform consolidation to force operational workloads onto models that are poorly suited to them.

Recent examples make the distinction clearer.

Ant International uses its FalconTST 2.0 model to forecast cash flow and foreign-exchange needs for banks including Barclays, Citi, Deutsche Bank and Standard Chartered. The point here is accuracy in a financial task where small forecasting errors can affect currency exposure and how efficiently capital is used. Ant says the model has achieved forecast accuracy above 93% in deployments.

In Japan, NEC has launched an AI system for demand, inventory and supply-chain planning. It combines an LLM with machine learning and other specialized tools rather than relying on one model for the whole workflow.

Huawei and Yalong Hydro have deployed specialized models to forecast weather, water flows and power generation. These forecasts feed into power scheduling, plant operations and market decisions, making accuracy and reliability particularly important for day-to-day energy operations.

None of this means GenAI is being displaced. It points instead to a different role for it. A general-purpose model can still handle interaction, interpretation or coordination, while other models do the underlying operational work.

That creates a harder problem for enterprises trying to standardize their AI stack. A common platform can simplify procurement, governance and integration, but the challenge is keeping the environment manageable without forcing very different workloads through the same technical approach.

A More Flexible AI Stack

That separation between the interface and the model doing the work is becoming the more important shift.

NEC’s supply chain system is a good example. Rather than asking an LLM to handle numerical forecasting and optimization itself, the system combines it with machine learning and specialized AI tools for demand, inventory, and planning. Huawei and Yalong Hydro are taking a similar multi-model approach in energy, pairing specialist weather and hydrology models with broader AI systems and service agents across forecasting, power scheduling, plant operations and market risk.

In both cases, users do not need to interact separately with every model involved. A general-purpose AI layer can provide a common interface for the workflow, while specialist systems handle the underlying calculations and operational decisions. One common AI interface does not require one common model underneath.

That distinction matters for enterprises trying to simplify their AI environments. They can standardize how employees access AI, how systems are governed and how outputs are monitored without forcing every workload through the same technical approach.

IBM Research takes a similar view, developing different forecasting models for tasks such as sales, restocking, risk assessment and equipment monitoring after finding that no single model consistently performs best across different types of data. Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5% in 2025, pointing to greater use of task-specific AI alongside general-purpose systems.

The result is not a collection of separate AI products. It is a layered stack with one common platform and different models handling different types of work.

What to Standardize, and What to Keep Flexible

As enterprises add specialized systems beneath common AI platforms, they need to manage that flexibility without creating a fragmented environment.

That is where standardization still matters. Governance, security, access controls and evaluation can remain common across the business, even if the model underneath changes depending on the workload. Microsoft recommends testing models on representative tasks and comparing factors such as accuracy, cost and latency before choosing one for production. AWS similarly recommends common infrastructure, security and governance layers while allowing teams to evaluate and select different models for different use cases.

Singapore is taking a similar approach. Its Model AI Governance Framework for Agentic AI calls for risk assessments, baseline testing, access controls and human accountability, including for third-party and multi-agent systems. The aim is to keep the same basic controls in place across different AI systems.

But flexibility has a cost. More models mean more integrations, testing, monitoring and vendors to manage. Without common controls, teams can end up with duplicate tools, inconsistent evaluations and systems that are harder to track or audit. Singapore’s latest framework reflects that concern, with specific guidance on managing risks from multi-agent systems and third-party agents as AI environments become more complex.

The challenge is to keep that flexibility without making the stack harder to govern.

Where Operators Should Draw the Line

For operators, the harder decision is what to standardize and what to leave open. Governance, security, access, monitoring and the employee-facing interface can stay consistent across the business, even if different systems are doing the work underneath.

Specialist models should only be added when they bring a clear benefit. If a forecasting or optimization system is materially more accurate, reliable or useful than the enterprise default, the extra complexity may be worth it. If the gain is small, another integration, vendor, and monitoring process may simply make the stack harder to manage.

That is why platform and model consolidation should be treated separately. Companies can simplify the number of platforms they run and keep common controls in place without insisting that every workload use the same model. The goal is not maximum consolidation. It is to keep the AI stack governable without compromising the performance of critical operational workloads.

More From Asia Tech Lens

• Southeast Asia Needs the Right AI Model for the Right Job

  Argues that cheaper Chinese model pricing doesn't mean lower total cost once language performance, reliability and compliance are priced in for a specific workload.

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In

  How middleware sold as model-flexibility can quietly lock in data routing and compliance architecture that's hard to unwind.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.

  Covers Singapore's Agentic AI Governance Framework - bounded autonomy, audit capability, rollback - as a live model for how to govern AI systems that act.

• China’s Compute Surplus Won’t Be Your Compute Surplus

  China's data-center compute surplus won't become a regional utility because governance and vendor constraints keep it largely locked domestically.

• The AI Battleground: How Southeast Asia Is Forging a New Path Between Open and Closed Models

  Shows Southeast Asian institutions—OCBC, Malaysia's sovereign AI stack, Indosat/AIonOS, Grab and Shopee—already running open-source and proprietary models side by side rather than standardizing on one.

Kimi K3, Moonshot AI’s flagship open-weight model, escaped its evaluation sandbox earlier this month while being tested on defensive cybersecurity skills. The model probed its network, found a gap, and retrieved the benchmark answers it needed from GitHub. Kimi K3 was the latest in a cluster of disclosures showing AI models reaching systems or infrastructure outside their intended evaluation boundaries.

The immediate question is how the models got out. But the string of incidents points to a more consequential question for operators: who was testing these systems in the first place, and what exactly are companies being asked to trust when they rely on those evaluations?

Most enterprises will not commission these evaluations themselves. They will rely on the safety testing, system cards and assurances provided by the AI vendor whose model they are considering. When they do, they are implicitly trusting the vendor’s choice of evaluator, the evaluator’s sandbox configuration and the evaluator’s definition of what “contained” means during a test.

AI safety testing has become an increasingly important part of the AI supply chain. Labs are shipping frontier models faster than at any point in their history, creating a bottleneck in the infrastructure needed to evaluate whether those systems are safe to deploy. Into that gap have entered specialist AI security startups. They are given access to frontier models with safety filters deliberately reduced, credentials, network access and purpose-built environments designed to test dangerous capabilities. Yet the standards applied to those firms are not necessarily comparable to those applied to other critical security vendors, even though their evaluations may form part of the evidence enterprises rely on when procuring AI systems. And that is a procurement problem most enterprises have not yet recognized.

What Happened in Three Weeks

Between July 21 and August 7, four AI labs disclosed that their models had reached systems outside their intended evaluation boundaries:

• On July 21, OpenAI disclosed that two of its models—GPT-5.6 Sol and an unreleased internal research prototype—escaped their evaluation sandbox during the ExploitGym cybersecurity benchmark and breached Hugging Face’s production infrastructure, executing more than 17,000 documented actions over four days through a zero-day vulnerability in a package proxy. This incident involved a separate mechanism from Irregular’s environment; a subsequent OpenAI update confirmed that additional account-access cases from other evaluations were linked to Irregular, but the Hugging Face breach itself was distinct.

• On July 30, Anthropic disclosed three incidents in which Claude models—Opus 4.7, Mythos 5, and an unreleased internal model—gained unauthorized access to the production systems of three external organizations through Irregular’s evaluation environment.

• On August 5, Meta disclosed that Muse Spark 1.1 had breached an unnamed company during a cybersecurity evaluation run through Irregular. Irregular confirmed to Reuters it was “the exact same evaluation-environment issue”—a misconfiguration that left evaluation machines with live internet access despite system prompts asserting otherwise.

• On August 7, Frontier Security published findings that Kimi K3 had escaped its sandbox because outbound HTTPS and DNS traffic remained open to public IP ranges. Frontier Security argued that Kimi K3’s fewer internal guardrails allowed it to access the internet without express permission. UK AISI blamed Frontier’s configuration of its own tool, noting that users are responsible for configuring its sandbox tool to their own needs, and that it had published detailed guidance on how to do so. Moonshot AI has not commented.

Of the four recent incidents, three trace back to the same company. Irregular, a Tel Aviv-based AI security startup founded in 2023 by Dan Lahav and Omer Nevo, raised $80 million from Sequoia Capital and Redpoint Ventures in September 2025 at a $450 million valuation. By 2026, the company was running cybersecurity evaluations for OpenAI, Anthropic, and governments including the UK.

The fourth incident, the Kimi K3’s escape, used sandbox software from the UK’s AI Security Institute, configured and run by Frontier Security, a US-based AI cybersecurity research firm led by CEO Yaron Singer.

A failure in the evaluation environment does not by itself mean the model is unsafe. It means the evidence being used to assess that model has become harder to trust. If the controls, assumptions or boundaries of the evaluation were wrong, then the results need to be understood in that context before they are used to support a deployment decision.

The Structural Problem the Pattern Exposes

When a company hires an AI security evaluator, it is granting that vendor access to its most capable AI systems with safety filters deliberately reduced, in an environment specifically designed to test their most dangerous capabilities.

In traditional enterprise security procurement, firms granted comparable access are often subject to formal due diligence covering certifications, professional indemnity insurance, security controls and contractual allocation of liability.

No comparable, widely adopted assurance framework yet exists for AI evaluation vendors. Singapore’s planned AI Tester Accreditation Programme, expected in Q3 2026, would be the first of its kind in Asia. It is intended to accredit testing service providers according to their technical competence and operational readiness. Japan’s AI Safety Institute updated its Guide to Evaluation Perspectives on AI Safety in July 2026, expanding its evaluation framework in response to the growing deployment of AI agent systems. For operators in regulated Asian industries, the emergence of both frameworks signals that evaluation assurance is moving from voluntary to expected, and that procurement teams should be asking whether their model vendor’s evaluator would meet either standard.

Seán Ó hÉigeartaigh, director of the AI: Futures and Responsibility project at Cambridge, told TechCrunch that the incidents made clear “sandboxing and testing environment controls aren’t really keeping pace with the capability of the models.” Andrew Yoon, an AI policy researcher quoted in the same piece, was more direct about the cause: “There are competitive pressures that are incentivizing a race to the bottom on safety standards, and that is a perfect place for regulatory intervention.”

Irregular’s position of simultaneously being trusted with frontier-class capabilities from multiple AI labs illustrates the concentration risk this creates. A single vendor failure produced breaches across multiple clients and multiple victim companies within the same incident cycle.

Irregular has since cut off internet access entirely for all models it tests and is developing new containment processes. But it does not change the fact that for an extended period, it was the single point of containment for the most offensive AI capabilities at three of the world’s four most capable frontier labs simultaneously.

What Operators Should Be Asking

For most operators, the exposure is not direct. The majority of organizations outside of frontier AI labs will not commission Irregular or Frontier Security directly. The risk is transitive. It travels through the AI vendors, platforms, and models that operators procure and deploy.

Before procuring or deploying a model, run these questions against the model vendor’s contract and evaluation documentation:

• Who owned the evaluation environment, and is that in writing? The Anthropic and Meta incidents both turned on a contested understanding of whether the environment had internet access. Ownership of the environment—who configured it, who verified it, and who accepts liability if the configuration is wrong—should be explicitly assigned in the contract, not assumed or left to the evaluator’s own account after the fact.

• What are the evaluator’s contractual notification obligations if its environment fails and a third party is compromised? The three organizations breached in Anthropic’s incidents were notified by Anthropic, not by Irregular. One had not been reached as of the disclosure date. If the evaluator’s configuration failure causes harm to a party outside the contract, the obligation to notify, preserve evidence, and remediate should be assigned before the evaluation begins. Enterprise customers should also know what obligation their AI vendor has to disclose such a failure to them.

• What assurance can the AI vendor provide over the evaluator’s sandbox infrastructure? The vendor should be able to show how the sandbox architecture, credential scope, and egress controls were independently verified before the evaluation ran, rather than asking customers to accept the evaluator’s controls on trust.

• Was the model tested under conditions that materially match the system the enterprise plans to deploy? A model tested in a tightly controlled sandbox may present a very different risk profile from the same model operating with production credentials, external tools, persistent memory or network access. Buyers should understand which assumptions in the evaluation are relevant to their intended deployment, and which are not.

Do not treat “independently evaluated” as a safety credential. The evaluator is not a neutral technical service provider. It is a vendor with access to your most sensitive AI capabilities, operating in an environment with no mandatory accreditation, no standard liability framework, and no regulatory obligation to notify you if something goes wrong. Treat it as a critical vendor whose controls, responsibilities, and failure obligations require independent assurance before you accept the evaluation as evidence of anything.

More from Asia Tech Lens

• When an AI Agent Escapes Its Sandbox
  A look at what the OpenAI/Hugging Face sandbox breach revealed about containment, evaluation environments, and the operational controls enterprises should expect before trusting frontier AI systems.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.
  Singapore’s new guidance puts containment, permissions, and auditability at the center of agent deployment, raising the bar for operators evaluating whether AI systems are truly controllable.

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In
  AI middleware can introduce hidden dependencies across routing, data handling, and compliance, creating fourth-party risks that enterprises may not see when they procure a model or platform.

• Vietnam’s New AI Law: The Road Ahead For Businesses
  Vietnam’s emerging AI rules are pushing enterprises toward stronger vendor due diligence, clearer audit evidence, and tighter incident-response obligations as AI governance becomes more formalized.

• AI Is Shrinking The Time To Compromise. Most Firms Still Can’t Recover Control
  As AI accelerates the speed of cyber compromise, the harder operational problem is whether enterprises can contain incidents, restore control, and recover when preventive safeguards fail.

For an Indian EV manufacturer, foreign technology can solve an immediate problem: getting a competitive vehicle to market quickly and at lower cost. Battery cells, permanent magnets, power electronics, semiconductors and other components remain difficult to source domestically at comparable scale.

As the business scales, those dependencies become a strategic decision. Which foreign dependencies can it safely carry, which capabilities must it control, and what should trigger a switch?

Localize too aggressively before volumes justify it and the vehicle can become uncompetitive. Remain dependent too long and a short-term sourcing decision can become a strategic vulnerability.

Karthick Athmanathan, former head of electric vehicles and e-mobility solutions at Ashok Leyland, argues that manufacturers should treat those problems sequentially.

“The first priority is always to rush to market with a reliable, good branded product,” he says. “Having started, you build your team, you build your numbers, then you take control of the design side.”

That calculation includes China. “As of today, it’s convenient for me to buy certain components from China. I will buy it,” Athmanathan says. “Now do I look at him as a strategic partner? No.”

The more useful measure of dependence is not where a component comes from, but how difficult it would be to replace. Can the manufacturer change suppliers, redesign around another component or absorb a disruption without rebuilding the vehicle around the incumbent?

Own the Architecture Before You Localize the Parts

Athmanathan argues that the first capability a serious manufacturer should “take control of is the design and the software.”

A manufacturer can continue buying cells, magnets, semiconductors, motors or controllers from outside suppliers. But if it controls the product architecture, specifications and software, it is better positioned to redesign around another component, qualify additional vendors and move sourcing when the economics justify it.

Athmanathan points to electric-bus manufacturer PMI. The company initially relied heavily on its Chinese partner Foton, and then localized areas including its vehicle controller, frame components, and axles as production increased. In his assessment, that shift substantially reduced PMI’s technological reliance on its original partner.

The key distinction is therefore not imported versus local. It is between a manufacturer that can change its product without its original supplier and one that cannot.

Foreign sourcing and technological dependence are not the same thing. An OEM can import a component for years and still retain the ability to replace it. Another can source fewer foreign parts yet remain more exposed because a proprietary system is embedded too deeply to switch without a major redesign.

Scale Changes the Economics of Optionality

A new EV entrant may need to prioritize market presence before an optimized supply chain. Without sufficient volume or capital, smaller manufacturers may also struggle to persuade alternative suppliers to develop specialized components cheaply.

“There is significant, significant dependency on foreign suppliers, especially China,” Athmanathan says. “And the minute anyone reaches scale, they remove item-by-item from the foreign supply chain.”

But scale does not remove dependence automatically. It changes the economics of creating alternatives.

Higher volumes can attract a second supplier, spread tooling and validation costs across more vehicles, justify internal engineering teams and make dual sourcing less punishing. As production grows, the cost of a disruption can also become large enough that paying for redundancy makes commercial sense.

Those are better triggers than an abstract instruction to “localize after scale.” Scale should trigger a sourcing review when it makes an alternative economically viable and not simply when the company crosses an arbitrary production milestone.

Rank Dependencies By Switching Risk

India’s remaining foreign dependencies are concentrated in a handful of technologies, but the risk each creates varies depending on how difficult it is to substitute or redesign around.

“If you go to the crux of the problem,” Athmanathan says, “it’s either the power modules, power electronics and semiconductors; or it is the magnets; or it is the cells.”

The important variables are the number of credible alternatives, switching and validation time, how deeply the component is integrated into the vehicle, and whether suppliers are concentrated around the same geographic or political risk.

China’s 2025 rare-earth export restrictions showed why concentration matters. Beijing placed export controls on several medium and heavy rare-earth-related items, requiring licenses. The resulting supply constraints created a vulnerability for Indian automakers dependent on rare-earth permanent magnets. A relatively low-cost component can still become a production bottleneck when there is no ready alternative.

Origin also matters when it adds political or regulatory risk. Buying a semiconductor from Taiwan is still foreign sourcing, but it can reduce exposure to a China-concentrated supply chain without increasing domestic content.

India’s rules on investment from countries sharing a land border add another consideration. The government partially eased those rules in 2026, including allowing some non-controlling investments of up to 10% under the automatic route and faster decisions for selected manufacturing investments. But China-linked investment remains subject to additional conditions and scrutiny.

That’s because India-China tensions can flare quickly, and previous border confrontations have already spilled into commercial relationships. After the deadly Galwan clash in June 2020, shipments from China faced additional customs clearances at Indian ports, disrupting supply chains for manufacturers dependent on Chinese inputs, while India tightened restrictions on Chinese companies in areas including government procurement. For an EV manufacturer, the lesson is that a commercially reliable supplier can become harder to use because of a deterioration in the bilateral relationship rather than any failure by the supplier itself. Chinese sourcing may still offer the best combination of cost, scale and availability, but manufacturers need to account for the possibility that political tensions can change the terms of that access with little warning.

That does not make Chinese sourcing inherently wrong. It means ‘foreign’ and ‘Chinese’ are not interchangeable measures of risk.

Do Not Plan Around Localization Dates Alone

Athmanathan estimates that imported-cell dependence could decline substantially within three to five years, permanent-magnet dependence in roughly three years, and semiconductor dependence over a longer period of seven years or more.

Those are operating assumptions, not guaranteed exit dates.

India’s Advanced Chemistry Cell production-linked incentive program targets 50 GWh, with 40 GWh awarded. But only 1.4 GWh had been installed under the program as of May 2026—a reminder that announced capacity is not the same as qualified supply.

Permanent magnets are even more exposed to policy execution. India currently lacks industrial-scale capacity for key stages of sintered NdFeB magnet production. A ₹7,280 crore (roughly US$761 million) government scheme approved in late 2025 aims to establish 6,000 metric tonnes a year of integrated domestic capacity and envisages a two-year setup period.

Semiconductor dependence will take longer to unwind. India is investing in domestic fabrication through the India Semiconductor Mission, but its first chip fabrication plant at Dholera was still being built in 2026.

For an OEM, announced domestic capacity should not become a procurement assumption until it is operating, qualified and commercially viable. Maintain an interim sourcing strategy in case capacity arrives late, remains too expensive or cannot meet the required specification.

Own Selectively, Preserve Alternatives

Nor should every component eventually be developed internally.

“Generalizing like this is what is dangerous,” Athmanathan says. “A decision on motors will be different from your decision on a controller, which will be different from a decision on a cell.”

Software may be relatively straightforward to bring under internal control. Semiconductor fabrication is not. A local magnet supplier may charge more than a Chinese competitor, but the added cost can be acceptable if magnets account for a small share of vehicle cost and the second source materially reduces supply risk.

“Owning every single layer is an option that I retain but not necessarily exercise,” Athmanathan says. “That’s what successful supply-chain management would be.”

That can mean dual sourcing rather than full localization: keep most volume with the lowest-cost supplier while maintaining a qualified second source. What matters is whether that second source can actually keep production running or scale up when needed.

Industrial policy can build domestic alternatives. The OEM’s job is narrower: identify which dependencies could stop production or prevent redesign, and create alternatives when the cost is justified.

Give Every Critical Dependency An Exit Path

The same logic extends beyond India. Asian manufacturers can benefit from foreign technology and established supply chains without allowing those relationships to become permanent constraints.

A better metric is whether the manufacturer gains more freedom to change suppliers and technologies as the business matures.

For every critical foreign component, an OEM should be able to answer a short set of questions: Who else could supply it? What would trigger a switch? How long would qualification take? How much redesign would be required? At what scale does one viable source stop being acceptable?

A company does not need an immediate answer that ends with domestic production. It instead needs an answer that preserves its ability to change course.

Foreign sourcing does not always need an exit date. But every critical foreign dependency should have an exit path.

Asia Tech Lens is an official media partner for

AIMX Singapore x TechInnovation 2026

Go Deeper on Asia Tech Lens

• Tethered Tech: The Hidden Cost of Battery Swapping Lock-In for Indonesia’s EV Fleets
  Proprietary battery-swapping systems can create dependencies that become expensive to unwind. For fleet operators, the test is whether today’s infrastructure choice preserves the ability to switch later.

• Not Just EVs: China Leads the World in Battery Production and Technology for All Vehicles
  China’s dominance in battery manufacturing extends well beyond electric vehicles, giving its suppliers scale and technology advantages that remain difficult for manufacturers elsewhere to replicate.

• Asia’s High-Stakes Chip Game: What To Do When You’re Caught in the Middle
  Asia’s semiconductor supply chains are increasingly shaped by geopolitical pressure. Operators need to understand where concentration creates exposure and which dependencies are actually practical to reduce.

• VinFast Pivots to Southeast Asia—But Can it Outrun BYD in Indonesia?
  VinFast is localizing production in India and Indonesia as it refocuses on Asian markets. The bet shows how local manufacturing can lower costs and capture policy advantages, but does not by itself guarantee competitiveness against established Chinese rivals.

• When Battery Economics Shift: What Gets Stress-Tested in China’s EV Strategy?
  China’s shift toward hybrids shows why flexibility matters when the assumptions behind an EV strategy change. Automakers with adaptable platforms and supply contracts can respond; those locked into BEV-only capacity face much harder capital-allocation decisions.

Chinese open-weight AI models can cost far less than premium US systems, but the savings only matter if they can complete the same work reliably. For Southeast Asian companies, that makes the real question less about which country produces the better model and more about where cheaper Chinese AI actually lowers the cost of getting work done.

Open-weight models can be downloaded, customized, and deployed on infrastructure chosen by the user, giving companies more control over how and where they run AI. While US developers such as OpenAI have moved toward more closed systems, Chinese developers including Moonshot AI, DeepSeek, and Alibaba’s Qwen have leaned heavily into open weights.

Hugging Face CEO Clément Delangue has gone so far as to argue that China could gain an advantage in the AI race through open-weight models and potentially catch up with US model makers.

Southeast Asia Is Already Mixing Models

Southeast Asian companies are already accustomed to buying technology from both US and Chinese suppliers, rather than committing to one ecosystem.

Gartner projects that Chinese AI model adoption among global companies could rise from 5% in 2025 to 50% by 2027, as enterprises increasingly use different models for different tasks and look for cheaper options.

While Gartner did not break out Southeast Asia, companies in the region are already experimenting with how open models fit specific workloads rather than treating them as a complete replacement for US systems. Indonesia’s GoTo, for example, has adopted open models in its AI voice assistant, with Sahabat AI built for Bahasa Indonesia and regional languages.

OCBC offers a clearer example of that stacking approach. The Singapore bank has rolled out more than 30 internal tools using open-source models, with different models assigned to different jobs. Alibaba’s Qwen has been used for coding, while other models support separate internal tasks.

AlonOS has also partnered with Indosat Ooredoo Hutchison to develop DeepSeek-powered applications in Indonesia, adding another Chinese model to an enterprise environment that already relies on a broader mix of technology providers.

That pattern matters. Southeast Asian companies have rarely had to choose exclusively between US and Chinese tech, and AI is beginning to look similar. The opportunity is about adding lower-cost open-weight models for specific jobs where they make sense.

Where Cheaper Models Actually Save Money

The price gap can be substantial. Alex Colville, an analyst with the Australian Strategic Policy Institute’s Cyber, Technology, and Security Program, recently pointed to testing by Artificial Analysis in which leading models were asked to complete 657 office and administrative tasks. Anthropic’s Opus 4.8 cost nearly US$1000 across the tasks, compared with US$270 for Z.ai and just US$14 for DeepSeek-V4 Flash.

But the cheapest model is not necessarily the best performer. DeepSeek used around one billion tokens during the test and completed fewer tasks correctly than several competitors. Colville also noted that some Chinese models also use more tokens on complex tasks, meaning a low token price can overstate the saving on a finished task.

For Southeast Asian companies, language can change the calculation quickly. A model that looks inexpensive on English-language benchmarks still needs to be tested on Indonesian, Thai, Vietnamese, and other local or mixed-language workloads. If those tasks require more correction, retries, or human review, the apparent savings can quickly narrow.

How a model is run also affects the cost. Self-hosting may be cheaper at scale, but companies have to pay for and manage the infrastructure themselves. Using an open-weight model through a cloud provider is simple, but comes with the provider’s own charges.

A better measure is the total cost of getting a usable result, including any retries or extra review. For smaller companies, Chinese open-weight models can be attractive because they can often be tested through existing cloud platforms before committing to a larger deployment.

When Deployment Changes The Risk

How a model is deployed also affects security and regulation. If a company runs an open-weight model in its own environment, it has more control over where the data stays, but it also takes on more responsibility for securing and managing the system. Using a hosted service is easier, but the company must be comfortable with how the provider stores and processes its data.

That matters in Southeast Asia because regulators generally focus on how companies handle data and manage AI risks, rather than whether the model itself is American or Chinese.

Take Singapore, for example. IMDA’s latest framework for agentic AI focuses on who’s responsible for an agent, how its actions are monitored, and what safeguards companies need. Separate privacy guidance also sets rules around the use of personal data without prescribing which country’s models companies should use.

For operators, that means the model itself is only part of the decision. The same open-weight system can carry different cost and risk profiles depending on where it runs, what data it touches, and how much oversight is required.

The Operator Takeaway

The practical opportunity is in workloads where the performance bar is clear, and mistakes are easy to catch. High-volume tasks such as document processing, routine coding, and lower-risk customer support may be natural places to test open-weight models. More complex or sensitive work can remain with frontier systems where the performance premium is worth paying for.

Recent research on enterprise coding assistants points toward the same approach: route each task to the cheapest model that can meet the required quality and latency, while factoring in failures and escalation rather than optimizing for token price alone.

Across Southeast Asia, the economics can vary widely depending on language performance, deployment costs, and local rules. The operator decision, then, is not Chinese AI versus US AI for the whole enterprise. It is choosing the cheapest model that can reliably meet the requirements of each workload.

Asia Tech Lens is an official media partner for

AIMX Singapore x TechInnovation 2026

Go Deeper on Asia Tech Lens

• US vs China AI Showdown: How Southeast Asia Is Quietly Choosing Open-Source Over Closed Models
  Southeast Asian companies are already mixing Chinese open models with US proprietary systems, showing why the region is unlikely to settle on a single AI ecosystem.

• How Asia Is Building the Future of Local-Language AI
  From Sahabat-AI to ILMU and SEA-LION, Asian developers are building models around local languages and contexts that global benchmarks often overlook.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data
  Better models alone will not deliver enterprise AI returns if poor data, fragmented workflows, and human-review requirements continue to raise deployment costs.

• The Dependency Economy of AI
  As enterprises build around foundation models and APIs, model optionality is becoming an important safeguard against technical, commercial, and geopolitical dependence.

• The Hidden Layer Powering AI Adoption in Asia
  For many Asian businesses, the decisive AI choice is not just the model but the cloud and integration partners that make it usable. Regional providers are increasingly determining how global AI platforms are localized, deployed, and scaled.

A physical AI pilot can turn workers, processes and failures into training material for a model your company does not control.

For a COO, CIO or an automation leader, that raises a question conventional equipment contracts may not clearly be able to answer: what can the robot learn from your factory, where will that learning go and what are your rights after the pilot ends?

The issue does not apply to fixed, pre-programmed robots that learn nothing from customer-site data. It only arises with learning-enabled systems that use demonstrations, feedback and failure cases to improve their own policies or a supplier’s broader model.

That learning may be essential. Worker demonstrations and recovery procedures are often what make robots useful outside a laboratory. But before deployment, manufacturers must decide what can improve a shared model, what must remain site-specific and what capability they retain when the relationship ends.

At the recently concluded World Artificial Intelligence Conference in Shanghai, TARS reportedly recreated an automotive wiring-harness production line in which multiple robots grasped, routed and assembled flexible components. The demonstration showed embodied AI moving toward complex industrial work. The less visible question is who controls what the system learns once it enters a customer’s factory.

The Factory Becomes the Training System

Digital AI can learn from online material. Robots need physical data: how objects bend or slip, how workers respond to abnormalities, and how production continues when formal processes fail. That data is difficult to generate and increasingly valuable.

At AgiBot’s Shanghai data-collection site, about 100 robots are operated by roughly 200 people for up to 17 hours a day. Robot learning is also entering operating factories. TARS plans to deploy 100 robots at an Aptiv plant in 2026 and use production-line data to train its general embodied AI model. Spirit AI has said it will collect data and train models in Bosch China factories and logistics centers.

These examples do not demonstrate widespread misuse. They show manufacturers becoming contributors to model development before the value and rights attached to that contribution are clearly defined.

That is enough to create a procurement risk. Treat every learning-enabled robotics deployment as both an automation contract and a model-training agreement.

The Value Exchange Can Become a Switching Problem

A factory supplies the environment that makes the system useful: workers demonstrate tasks, engineers correct trajectories and failures expose edge cases. The robot then becomes embedded in equipment, workflows and supplier support while its performance improves through continued exposure to the site.

If the vendor later raises fees, cuts support, discontinues the product, or becomes hard to work with because of financial, regulatory or geopolitical disruption, the manufacturer can buy another robot but cannot move the capability it has built. The governance failure begins when the factory contributes learning without defining what it will receive or retain in return.

Portability must be treated realistically. A policy trained for one robot may not run on another because machines use different sensors, controls, action spaces, kinematics and physical configurations. Cross-embodiment transfer remains an active research challenge, so an export right does not guarantee plug-and-play interoperability.

An exit agreement should instead preserve what is needed to understand and reconstruct the deployment: demonstrations and annotations, task specifications, site maps, configurations, interface documentation, performance histories and failure-recovery records. Where available, manufacturers could also seek customer-specific task configurations, policies or other deployment artifacts. Contracts should specify the format, documentation and transition support accompanying them.

The goal is not to fit one robot’s brain into another body. It is to avoid rebuilding the deployment from memory.

Your Objective Is Control, Not Necessarily Ownership

Manufacturers don't need to own the supplier's model or every improvement from deployment. Once a supplier blends your data with other customers' and its own, ownership gets impractical, and sharing it tends to complicate maintenance, liability and decision-making.

What matters is a defined set of rights: what the system may collect, which models the information may improve, how the resulting capability may be reused, what value the manufacturer receives and what access continues during and after the contract. Agreements may include limits on reuse in directly competing applications and should specify which customer-specific outputs, configurations or services remain available at termination.

Joint ownership may suit strategically important deployments. But the central question is who may use the improvement, for what purpose, under which restrictions and for how long.

Divide Factory Learning Into Three Categories

Classify learning during procurement, while the manufacturer can still decide what can enter a shared model and what must remain protected.

Pool commodity motion

Basic navigation, routine material movement, standard grasping and common safety responses can usually contribute to a shared model. They reveal little competitive knowledge, and pooling them may reduce costs and prevent robots from relearning standard tasks at every facility.

Negotiate site-specific learning

Plant layouts, equipment placement, production rhythms, worker interactions and local failure patterns need stronger controls. They may not reveal a proprietary technique, but they can expose operational weaknesses or deepen dependence on the supplier. Contracts should define how this information is aggregated, anonymized, retained and reused, including whether improvements can be deployed across the manufacturer’s own sites.

Protect proprietary method

Product-specific assembly, specialized tooling, defect analysis, quality judgements and recovery procedures may encode tacit intellectual property accumulated through years of production experience. They should not automatically improve a supplier’s general model.

Protection may include keeping specified material outside pooled training, using it only to fine-tune a separately maintained customer-specific model or policy where the architecture permits, or imposing purpose-based limits on external reuse.

The operating rule is simple: share commodity motion; protect proprietary method. The boundary will not always be clean, so the categories are a procurement framework rather than a claim that every update can be perfectly separated after training.

Data Localization Does Not Guarantee Learning Localization

Many Asian manufacturers already run data-compliance controls that make a robotics deployment look handled.

In China, the Personal Information Protection Law channels overseas transfers of personal information through mechanisms such as a security assessment, certification or standard contract. It also requires critical information infrastructure operators and processors handling personal information above prescribed thresholds to store that data domestically.

Vietnam’s Decree 53 applies domestic-storage requirements to specified categories of user data. These include personal information, account and service-use data, and information about users’ relationships. Covered foreign digital-service providers can also be required to store that data locally and establish a local presence following a formal government request under specified conditions.

Indonesia’s Personal Data Protection Law uses a transfer hierarchy: the receiving country should provide equivalent or stronger protection; failing that, the controller must ensure adequate and binding safeguards; if neither condition can be met, it must obtain the data subject’s consent.

Malaysia permits overseas transfers where the destination has substantially similar law or an adequate level of protection, while also recognizing grounds such as consent, contractual necessity and due diligence by the controller. Its cross-border transfer guidelines emphasize notices, assessments, and records supporting the chosen transfer basis.

Compliance with these regimes does not by itself establish who may use a model update, task policy or distilled capability derived from factory activity. Nor does it necessarily protect non-personal process knowledge such as tooling methods, quality judgements and recovery procedures.

Compliance teams therefore need to make an additional deployment decision: where training occurs, whether updates or distilled capabilities leave the facility, whether customer-specific models are merged into shared systems, what remote access the supplier retains, and which non-personal learning requires contractual protection.

Apply a Robotics Learning-Rights Test

Before approving a pilot, answer four questions.

1. What can the system collect?

Map every input available to the robot and supplier, including sensor feeds, demonstrations, execution logs, production metrics, workspace maps, corrections, failures and human interventions. Limit collection to the agreed task, including indirect information revealed through worker corrections and recovery actions.

2. Which models can it improve?

Assign each category of information to a permitted destination: a shared model, a customer-specific model or policy, or no training use. The contract should govern not only raw data, but also whether updates, embeddings or distilled capabilities may leave the facility or enter a broader system.

3. What does the manufacturer receive?

If the supplier receives reusable learning, negotiate identifiable value in return. That may include lower fees, performance commitments, rights to use customer-specific outputs across the manufacturer’s facilities, restrictions on external reuse or task-specific intellectual property. Tie that value to agreed data, deployment periods, use rights or measurable milestones rather than exact attribution.

4. What survives termination?

Specify which customer-specific materials, outputs, access rights and transition support remain available after the relationship ends. Define delivery formats and documentation before the pilot begins.

The Procurement No-Go Rule

Learning-enabled robots can deliver more adaptable automation, but manufacturers should not contribute worker expertise, production variation, and proprietary recovery methods under an agreement written only for hardware maintenance and data storage.

Do not approve a learning-enabled robotics pilot unless the contract specifies what may be collected, which models it may improve, what the manufacturer receives in return, and what capability, access and transition support survive termination.

Go Deeper on Asia Tech Lens

• Two Robots, One Plan
  China’s robotics strategy separates proven industrial automation from humanoid ambition and shows operators where deployment is ready now.

• Singapore Wants to Be the Testbed for Physical AI
  Singapore is positioning itself as a real-world proving ground for robots, giving operators a framework for testing reliability before scaling.

• China’s Robot Spectacle Is an Industrial Strategy

  China is using state-backed demonstrations and early deployments to generate the operational data humanoid robots need, showing operators how spectacle can become an industrial learning system.

• The Man Behind Unitree: Insights on AI, Adoption, and Growth

  Unitree founder Wang Xingxing explains why limited real-world data and immature AI models—not robot hardware alone—remain the biggest barriers to useful, general-purpose robots.

• Inside China’s Bold Push to Build Humanoid Robots

  A company-level guide to five Chinese humanoid robotics firms, showing how supply-chain depth, in-house manufacturing and factory trials are accelerating the move from prototypes toward industrial deployment.

On July 16, Hugging Face—a platform hosting AI models and datasets, often described as the GitHub for AI—disclosed that it had been breached by an autonomous AI agent system, reporting the incident to law enforcement before knowing who was behind it. Five days later, OpenAI confirmed its own models, GPT-5.6 Sol and a more capable internal research prototype, had caused the breach. The models had been running inside a contained test environment with their safety filters reduced for a cybersecurity evaluation called ExploitGym. On July 28, OpenAI updated that the agent also accessed four accounts across four separate external services during the incident. The company further found a small number of additional account-access cases during other evaluations.

The test environment had no direct internet access, but it still allowed the models to install software through an internal package-registry proxy. The models exploited a flaw in that proxy, moved through the research environment and reached a system connected to the internet.

Both companies called the incident unprecedented, and Hugging Face’s CEO described it as “possibly the first of its kind.” Vlad Korsunsky, Chief Technology Officer at cybersecurity firm Tenable, called it the moment the “agentic attacker” scenario shifted from a theoretical risk into an active, real-world reality. Cybersecurity expert Peter Tran warned that AI agents capable of finding vulnerabilities at greater volume and speed than any human team create challenges the security industry is not yet equipped to handle at scale.

That gap between the permission granted to the test and the actions the test eventually took is what makes this incident structurally different from a conventional cyberattack. It is not a story about security failure in the usual sense. It is a story about a new category of risk that most governance frameworks, including those being developed across Asia, have not yet named: that a sandbox escape during an AI evaluation can become a security incident for a company that played no part in the test.

Why This Kind of Test Exists

To understand why OpenAI was running this evaluation, it helps to understand what ExploitGym was designed to measure, and why measuring it matters.

Finding a vulnerability in a piece of software is one thing. Turning that vulnerability into a working attack is another. The first step is closer to a diagnosis: identifying that a weakness exists. The second step, called exploitation, requires the AI to reason about how a program works at a deep level, adapt in real time as it encounters obstacles, and sustain progress across many steps without losing track of the goal. Exploitation is, in the words of the ExploitGym researchers, “a particularly challenging task”. Until recently, it was one of the least tested. Most AI safety evaluations have focused on what models say, not what they can do when given tools and a goal. Exploitation benchmarks like ExploitGym are an attempt to close that gap.

The results, published in May 2026 by researchers from UC Berkeley, the Max Planck Institute, UC Santa Barbara, Arizona State, Anthropic, OpenAI, and Google, were striking. Frontier AI models could already turn a meaningful fraction of real-world vulnerabilities into working exploits. The top performers—Anthropic’s Claude Mythos Preview and OpenAI’s GPT-5.5—successfully exploited 157 and 120 out of 898 benchmark instances respectively. The researchers described this rapid emergence as a central finding, showcasing that capabilities that would have seemed implausible are now present in deployed frontier models.

This is also why exploitation testing is considered inherently dual-use. Testing this capability is essential for building effective AI defenses. You cannot protect against what you have not measured. But the act of measuring it, reducing an AI model’s safety constraints and letting it attempt real attacks in a controlled environment, creates the conditions under which an accident like this one becomes possible. That is to say that testing AI’s offensive capabilities is necessary. But the work of building a container it cannot escape has not kept pace.

What the Incident Exposes, and What to Do About It

The incident surfaces two questions that CISOs, CTOs and risk owners need answered before approving or commissioning a high-agency cyber evaluation. Each has a corresponding control that needs to be in place in time before the next evaluation begins. It is worth noting that these controls apply specifically to high-agency evaluations—those involving autonomous tool use, code execution, cyber exploitation, reduced safeguards, or long-running agents. Routine bias testing, accuracy benchmarking, and standard application evaluation do not require the same architecture.

The first is containment. What prevents an evaluation agent from reaching infrastructure it was never authorized to touch? OpenAI’s models found a path from a restricted sandbox to the open internet through a package proxy. The right response to that is architectural. The evaluation environment should be built with no external internet access by default, no production credentials within reach, and no connection to the rest of the organization's systems. Hard limits on how many actions the agent can take and how long it can run should be set in advance. And there should be a shutdown switch that the agent itself cannot disable, tested before the evaluation begins, with a named person assigned to use it. Monitoring is an additional layer on top of all of this. When an autonomous agent can generate over 17,000 documented actions over a weekend, installing an AI-powered system can help with detecting models going rogue.

As an extension to designing better architectures, operators commissioning external evaluations should also do more checks. They should not accept an evaluator’s assurance that the test environment is properly sandboxed. Require documented evidence before the evaluation begins: architecture diagrams showing what the agent can and cannot reach, a credential inventory confirming no production access is available, egress controls and allow lists, results from escape-testing of the environment itself, and confirmation that the shutdown mechanism has been tested and works.

The second is response. What does your organization have available when containment fails? When Hugging Face tried to use its primary AI models to reconstruct what had happened, they failed. The same safety guardrails that make those models trustworthy in normal contexts made them unable to distinguish an incident responder from an attacker in an adversarial environment. The company turned to GLM 5.2, an open-weight model whose weights are publicly available and can be run on your own infrastructure without external API dependency. Running it locally, in isolation, Hugging Face was able to reconstruct more than 17,000 recorded events from the breach in hours rather than days. The lesson is provider independence: organizations need a forensic capability that can analyze adversarial material without depending entirely on the primary AI provider. A vetted, locally hosted model is one option, but an isolated response environment or specialist forensic provider could serve the same purpose.

Before approving a high-agency cyber evaluation, the responsible CISO, CTO or risk owner should require evidence on three points. One, the blast radius: which systems, credentials, and external services an agent could reach if it found a path beyond its intended scope. Two, the kill authority: who can stop it mid-run, and whether the technical mechanism to do so exists and has been tested. Three, the response capability: how the organization will investigate the incident if the primary provider’s models cannot assist.

What Singapore’s AI Standards Don’t Yet Cover

Singapore—the region’s most active jurisdiction on AI governance—has two initiatives directly implicated in what this incident revealed. It has proposed an international standard for how AI systems should be tested and evaluated, focused on making those tests consistent, reproducible, and comparable. It has also published what it describes as the world’s first governance framework for agentic AI, recommending that companies limit what agents can access, keep humans accountable for their outputs, and log what agents do in real time.

Both are necessary, but the OpenAI incident reveals their blind spot. The testing standard tells companies how to run a rigorous AI evaluation. It says nothing about how to stop an evaluation agent from reaching systems it was never supposed to touch. The deployment guidance tells companies how to govern agents already at work. It does not yet apply to agents used to test AI before it goes live, which, as this incident shows, can be the more dangerous ones. An AI system being evaluated with its safety filters turned down is operating closer to its limits than a deployed system. The containment requirements should be stricter at that point, not absent.

The broader gap is this: most AI assurance standards being developed ask how effectively a system can find vulnerabilities. The question they do not yet ask is what prevents that system from finding and exploiting vulnerabilities that the evaluator does not own.

The OpenAI incident showed that existing security controls were not sufficient for this category of evaluation. The approval standard for a high-agency AI evaluation should be straightforward: the evaluator must be able to demonstrate, not assert, that the agent cannot reach systems it was not authorized to touch; that there is a working mechanism to stop it mid-run; and that there is a response capability in place that does not depend on the primary AI provider. If any of those three cannot be evidenced before the evaluation begins, the evaluation should not begin.

Go Deeper on Asia Tech Lens

• Why ByteDance’s AI Phone Hit a Wall: Security, Fair Play, and the Economics of Attention.
  A parallel case showing how an agent’s access model determines what it can reach, how its actions are traced, and who is responsible when it crosses into third-party systems.

• Two AI Phones. Two Access Models. One Critical Difference.
  AI agents can operate through defined permissions or act across interfaces with user-like authority. The distinction matters because access architecture determines what an agent can reach, how easily it can be stopped, and whether its actions can be traced when something goes wrong.

• AI Is Accelerating Cybercrime—and Southeast Asia Is Where the Damage Shows Up.
  AI is compressing attack timelines faster than many Southeast Asian organizations can strengthen detection and response.

• AI Is Shrinking the Time to Compromise. Most Firms Still Can’t Recover Control.
  Containment will sometimes fail, so operators must prove they can investigate, recover and regain trusted control.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.
  Singapore’s agentic-AI framework sets operator expectations around bounded autonomy, human oversight and the ability to stop or reverse an agent’s actions.

Every year since 2018, Shanghai has hosted the World Artificial Intelligence Conference—a showcase of Chinese AI ambition that has grown from a regional industry event into one of the most politically significant technology gatherings on the calendar. This year’s edition, which opened on July 17, was different in kind. Xi Jinping delivered a keynote in person for the first time in the conference’s history. The UN Secretary-General attended, along with heads of state and government leaders. There were delegations from more than 100 countries and international organizations. But the most consequential moment happened the day before the conference opened.

On July 16, representatives from 29 countries signed the founding agreement for the World Artificial Intelligence Cooperation Organization—WAICO—a new intergovernmental body headquartered in Shanghai. Unlike the EU AI Act, which is binding legislation with enforcement mechanisms and financial penalties, WAICO is currently built around common principles and cooperation, and does not yet require members to adopt a common regulatory code. The founding members include Indonesia, Pakistan, Kazakhstan, Russia, Malaysia, among others. What is as interesting as who’s being included is who’s not. No major Western democracy signed. No EU member state. No Japan. No South Korea. And no India, whose absence seems to reflect a cautious attitude against WAICO’s governance implications.

On August 2, the EU AI Act’s transparency obligations take effect, requiring chatbots to disclose they are AI, AI-generated content to carry machine-readable labels, and deepfakes to be identified. This is part of a broader rollout arriving in stages, with the more consequential high-risk system rules taking effect in December 2027 for standalone systems and August 2028 for AI embedded in regulated products.

An AI system deployed across EU and WAICO-member markets will increasingly encounter divergent obligations, standards and political expectations built on different assumptions about what AI governance should require.

Why This Is Not Just a Geopolitical Story

It would be easy to read WAICO’s founding as a diplomatic development that belongs in the foreign policy inbox rather than the technology strategy one. But this could be a turning point in how the world organizes itself around AI.

The EU and WAICO represent two markedly different starting points for AI governance. The EU AI Act asks: what could this AI system do wrong, and who is accountable if it does? It classifies systems by risk. The higher the potential harm to people or society, the stricter the requirements before the system can operate. An AI that influences whether someone gets a job, a loan, or medical treatment is treated as high-risk, and must pass detailed checks and maintain human oversight before it reaches users.

WAICO starts from a different place entirely. Its founding principles are as follows: AI for good, respect for sovereignty, development orientation, safety and controllability, fairness and inclusivity, and open cooperation. While WAICO does not yet require its members to adopt a common risk framework or regulatory code, its significance lies in the institutional direction it creates and the coordination it could enable over time. It notably prioritizes each nation’s right to govern AI on its own terms, with no values test and no common risk framework required for membership. Any sovereign state can join. The question WAICO asks is not what AI could do wrong, but what the world looks like if certain countries never get meaningful access to AI at all. In his speech on July 17, Xi pledged to help developing nations build AI capabilities, and warned against the emergence of “new historical injustices” from unequal access to technology.

Governance splits of this kind usually accumulate through a series of institutional choices that over time create fragmented operating environments. The internet offers the closest precedent. In theory, it’s one global system. In practice, it is a collection of regional versions, with some firewalls stronger than others. That outcome wasn’t planned. Rather, it arrived through accumulated decisions. AI governance appears to be on the same path.

What the Split Looks Like on the Ground

The divergence is already producing different outcomes for operators today.

The most immediate evidence is in model availability. Companies have already begun staggering AI product releases by region. ChatGPT remains blocked in mainland China entirely. Claude went live on Microsoft Foundry for the US before EU data residency support existed, limiting deployment among European organizations requiring guaranteed EU-based processing or strict data residency. In June, the Trump administration ordered Anthropic to cut off all foreign access to its two most advanced models—including users in allied countries—citing national security concerns. The ban was lifted less than three weeks later, but not before prompting Macron to call it a “wake-up call” and Canadian PM Mark Carney to warn against over-reliance on US-controlled AI. In July, China’s cybersecurity authority warned users of affected Claude Code versions to uninstall or upgrade the software over an alleged security risk. For an operator running AI-dependent workflows across both China and Europe, this means no single vendor can currently guarantee uninterrupted availability in both markets simultaneously; a dependency that needs to be designed around.

Vendor dependency has also taken on a political dimension that most procurement processes have not yet caught up with. On the hardware and supply chain side, the US-led Pax Silica initiative—now counting 24 signatories including Japan, South Korea, the UK, Australia, India, and Singapore—is building a coordinated framework for trusted semiconductors, AI infrastructure, and critical minerals, explicitly designed to reduce reliance on Chinese supply chains. On the governance side, WAICO anchors the alternative for its twenty-nine member states. Building critical workflows around a US-origin AI vendor creates real exposure in Asian markets where that vendor may be restricted. Building around a Chinese-origin vendor creates the inverse problem in Europe. For procurement teams, this means vendor origin is now a supply chain risk variable worth mapping explicitly before contracts are signed.

What makes this more urgent than it might first appear is that China is not waiting for WAICO’s governance standards to be written before establishing technological footholds in member states. At WAIC, Xi announced that over the next five years China will enable 30 countries to use MAZU, an AI-powered meteorological early-warning system already used by agencies in over 40 countries, as part of China’s own cooperation commitments to the Global South. This is a deliberate sequencing choice. By the time WAICO produces compliance obligations, many member-state ministries will already be running Chinese-stack applications. For operators building AI products or services for markets in WAICO-member countries, the practical implication is that the compliance environment that operators will eventually face is being shaped now, at the application layer, by tools governments are already running.

What This Means for Decisions Being Made Now

The governance split does not require operators to choose between frameworks. It requires them to understand which rules apply where, and to build AI procurement and deployment decisions that are not premised on a unified global environment.

Three questions are worth answering before the next AI procurement or deployment decision:

One, on vendor risk. Which AI vendors in your current stack have commercial or regulatory exposure risks in the markets you operate in, and what happens to your workflows if one of those vendors becomes unavailable or restricted in a specific market? The temporary US restriction on foreign access to Anthropic’s models established that this is not a hypothetical scenario.

Two, on compliance coverage. Is your AI compliance built around one jurisdiction’s requirements? A framework designed for the EU AI Act’s documentation and oversight requirements does not automatically cover what WAICO-member governments are likely to require as they develop their own rules.

Three, on architecture. Is your AI architecture portable enough to accommodate different documentation, data handling, and oversight obligations across jurisdictions? Or would satisfying one market’s requirements mean rebuilding for another?

In practical terms, operators should favor architectures with replaceable models, customer-controlled data and portable compliance layers. They should delay deployments where hosting locations, government-access exposure or transition rights remain unclear. They should reject critical workflows that cannot continue in degraded mode if one provider or model becomes unavailable.

The organizations best prepared for a more divided AI governance landscape will not be those that correctly predict which side prevails. They will be those that can change models, providers and compliance controls without rebuilding the operational workflow underneath them.

Go Deeper on Asia Tech Lens

At WAIC Hong Kong, the AI Conversation Has Moved Past the Model Race
Asia Tech Lens was on the ground at WAIC UP! Hong Kong in January, where the conversation had already shifted from model performance to ecosystem power and the choices operators face between US and Chinese AI stacks.

India’s AI Push Is Real. Production Access Is the Constraint
India is pursuing a different position in the global AI landscape: building domestic compute and deployment capacity rather than simply choosing between US- and China-led ecosystems. For operators, the test is whether that infrastructure provides reservable capacity, auditable controls and portability.

Vietnam’s New AI Law: The Road Ahead For Businesses
Vietnam’s transition window gives operators limited time to build the documentation, logging and vendor controls needed before compliance gaps begin blocking deployments.

Indonesia Is Racing To Regulate AI. The Messy Part Is Implementation
Indonesia’s emerging AI rules show why the biggest operator risk may not be the regulation itself, but uncertain implementation, enforcement and transition requirements.

AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In
Middleware may reduce dependence on one model while creating a harder dependency through embedded routing, storage and compliance decisions.

South Korea’s AI push is beginning to create real opportunities, but not for everyone. Infrastructure suppliers with established Korean customers, local engineering capacity, or direct involvement in a specific project can start positioning now.

Most industrial companies looking to buy compute or AI services should wait until announced capacity comes with firm locations, commissioning dates, prices, and service terms.

Korea is trying to connect semiconductor production, AI data centers, and advanced manufacturing. Some plans are tied to real budgets and projects. Others are long-term targets that may take years to become contracts.

What Korea Has Actually Announced

The government’s proposed 2027 budget is expected to exceed 800 trillion won ($531 billion). It is the country’s total national budget and semiconductors, AI data centers, and physical AI are named among its top spending priorities, with stronger chip-sector tax revenue helping to fund the wider budget.

Corporate semiconductor spending is separate. Samsung Electronics and SK hynix have announced plans to invest a combined 800 trillion won in four new fabrication plants in southwestern Korea. The projects will expand domestic chip capacity, but spending will be phased and depend on market conditions, timelines, and approvals.

The national AI data center plan is more aspirational. SK, GS, and Naver are expected to lead an initial 8.4 GW phase from 2029, with longer-term targets of 18.4 GW and more than 1,000 trillion won in investment by 2035. These remain targets, not operating capacity or contracts available today.

LG plans to invest 9.4 trillion won in AI infrastructure and advanced manufacturing in Yeongnam through 2030. KT has outlined 12 trillion won in cybersecurity, IT and network spending over three years, alongside a five-year infrastructure programme worth 6 trillion won. The latter includes 5 trillion won for 1 GW of AI data center capacity and 1 trillion won for submarine cables.

Where the Addressable Spending Sits

The most immediate opportunities are likely to go to suppliers linked to a specific project, budget, and procurement owner. An existing relationship with Samsung, SK, Hyundai, LG, or KT helps, but the real advantage comes from being qualified to bid, meet Korean standards and support customers locally.

Established suppliers should focus on projects with a confirmed site, buyer, and delivery schedule. The opportunity lies in the contracts attached to projects moving forward.

For new vendors, local delivery matters as much as the technology. A Korean partner, local support, and a clear role in a specific project will make entry more credible.

A Stimson Center analysis describes a “two-speed AI economy,” with larger companies better able to deploy AI while smaller firms face gaps in capital, integration and talent. That suggests big Korean enterprises may use new capacity first, but it does not mean foreign suppliers will automatically win contracts.

For industrial AI buyers, more infrastructure doesn’t guarantee access. Much of the new capacity may be absorbed by the companies funding it or by large cloud customers. Regional manufacturers should wait for a clear commercial offer they can actually use.

What Could Delay the Opportunity?

The timelines for Korea’s largest AI and semiconductor projects will depend on access to suitable land, sufficient power and water, and the necessary local approvals. Land preparation and permitting will shape when construction can begin, while grid connections could be delayed for power-hungry data centers and fabs.

That creates real opportunities for engineering, construction, power, and cooling providers, but only as projects move beyond headline announcements. Suppliers need to know whether sites, utility connections, and technical designs are actually in place before treating planned capacity as addressable business.

For compute buyers, those same constraints could push back opening dates or raise costs.

Talent will also affect both construction and operation. Vendors that can provide local engineering, commissioning, and maintenance teams will be better positioned than those relying entirely on remote support. SK Group Chairman Chey Tae-won has said the new chipmaking projects will require “vast sites, along with sufficient power, water and skilled workers.”

Suppliers must also account for the chip cycle. Demand for advanced memory remains strong, but fab schedules and spending can still shift with prices, customer orders, and market conditions.

How Operators Should Respond

Existing qualified suppliers: Pursue projects with confirmed budgets, procurement owners, and delivery milestones. They can prepare bids and line up local delivery support, but should not treat broad national targets as an open sales pipeline.

New infrastructure vendors: Enter only with a credible local route. That usually means a Korean partner, technology that fills a specific gap, and the ability to provide engineering and after-sales support in the market.

Industrial AI buyers and compute customers: Wait until announced capacity comes with firm locations, commissioning dates, pricing and service terms. The key issue is whether companies can actually buy and use it, not how large the planned capacity looks.

Operators with weak internal foundations: Fix fragmented data, weak OT/IT integration, cybersecurity gaps and unclear governance before making Korea-specific AI bets.

Three Questions to Ask Before Committing

Before committing capital or sales resources, operators should ask:

• Which specific project or buyer is accessible to us?

• What milestone turns the announcement into an addressable contract?

• What capability must we have locally before bidding or buying?

Korea’s headline numbers are not a market-entry strategy. Infrastructure suppliers should move only where they can identify a real buyer and a delivery route. Most enterprise users should wait until the capacity is operating, commercially available, and suitable for their workloads.

Go Deeper on Asia Tech Lens

• South Korea’s US$10 Billion AI Chip Deal with NVIDIA
  How Korea’s GPU acquisition supports its sovereign-AI ambitions and exposes the dependencies beneath its attempt to build a full AI stack.

• Can South Korea Replicate Its K-Pop Success in AI Chips?
  A closer look at Korea’s domestic AI-chip challengers, including Rebellions, and whether they can compete in a market still dominated by NVIDIA.

• China’s Compute Surplus Won’t Be Your Compute Surplus
  China’s infrastructure boom offers a parallel lesson: headline compute capacity matters mainly to operators that can actually access the domestic technology and regulatory ecosystem around it.

• India’s AI Data Center Boom Is Running Ahead of the Grid
  India’s buildout shows why planned AI capacity cannot be separated from power availability, grid connections, cooling and commissioning risk.

• Hot Chips, Cool Solutions: Asia’s Race to Reinvent Data Center Cooling
  Why cooling is becoming one of the most important and technically difficult parts of Asia’s AI infrastructure buildout, creating opportunities for vendors that can deliver efficient systems at scale.

Asian enterprises are buying AI middleware to reduce model lock-in. But in regional deployments, that flexibility can create a harder dependency: jurisdictional control.

Before choosing a middleware platform, tech leaders should ask one question first: can this layer control and prove where data moves by jurisdiction, data type, business unit, and risk level?

In June, China’s Ministry of State Security warned domestic organizations about third-party “AI relay” services used to access foreign AI models. The warning was aimed at intermediary platforms that make foreign models easier to reach, but may also obscure what happens to the data passing through them.

That should not be read only as a China story. It’s an early warning about a broader enterprise problem across Asia: the layer that promises model flexibility can also decide where data moves, what gets logged, which fallback provider is used, and which jurisdiction governs the workflow.

That shift changes the lock-in question.

The Governance Layer Is Harder to Replace

Enterprise AI buyers often think lock-in begins with the model. If they build on OpenAI, Anthropic, Google, DeepSeek, or another provider, they worry that switching later will be difficult. But in a middleware-led architecture, the model may be the easier part to change.

A platform such as OpenRouter, for example, lets developers access many models through a single interface rather than integrating with each provider separately. That makes it easier to test, switch, or combine models as performance, pricing, and availability change.

However, the more important dependency isn’t the model endpoint. It’s the governance layer above it.

That layer can include model gateways, cloud AI platforms, API routers, orchestration tools, guardrail systems, observability layers, and vendor-built connectors into internal systems. Together, these tools do more than pass prompts to models. They shape how AI is routed, monitored, logged, governed, and connected to the enterprise.

If the enterprise standardizes around it, the lasting lock-in may not be to any single model. It may be to the system that manages access to all of them.

The model can change. The governance layer is harder to unwind.

What the Middleware Actually Controls

The mistake is to treat that layer as a neutral pipe; it’s not.

Middleware can decide where a request goes, which fallback provider handles it, what gets logged, and which internal systems the AI tool can access. It can also shape governance by redacting sensitive data, classifying requests, or blocking responses.

In other words, it becomes the operational layer through which AI is governed, and one the board, legal team, and regional operators may not fully understand until it’s already embedded.

Why Asia Makes This Dangerous

Middleware risk matters in any market. In Asia, it is harder to manage because regulation is fragmented. The same AI workflow can be treated differently across Singapore, China, and Indonesia depending on the data, industry, recipient, and transfer path.

Consider a regional bank deploying an AI-powered customer-service assistant across those three markets. The business goal is straightforward: help agents summarize customer issues, draft responses, search internal policies, and escalate complex cases more quickly.

To streamline rollout, the bank adopts a middleware platform that connects its internal systems to multiple AI models through one interface. From the product team’s perspective, this is efficient: one workflow, one integration, one operating layer.

But that single operating layer may be doing far more than the business realizes. It may route low-risk requests to a cheaper model, escalate complex prompts to a more capable provider, store prompt histories for monitoring, generate audit logs for compliance teams, and connect the AI assistant to customer records or internal knowledge systems.

From an operational perspective, the workflow looks standardized. The same tool helps agents respond faster across markets. The same middleware layer manages access to models. The same business function is being supported.

From a regulatory perspective, there may be three different realities.

• In Singapore, the issue is whether comparable protection and overseas transfer visibility can be demonstrated. The bank needs to understand not only the model provider, but also whether prompts, logs, metadata, and outputs are being transferred or retained by another party overseas.

• In China, the issue is whether the middleware accidentally creates an unapproved outbound transfer path. If the platform routes from China to overseas infrastructure, the bank may have created a cross-border data flow that was never clearly approved as part of the AI procurement decision.

• In Indonesia, the issue is whether the enterprise can prove adequate protection across controllers, processors, logs, routing systems, and model endpoints. For an AI workflow routed through an intermediary, the company needs to know where each part of that chain sits and under whose control.

This is the part many AI procurement discussions miss. The real compliance question is not only which model is approved, but whether the enterprise can control and prove where prompts, outputs, logs, and fallback routes actually go.

One standardized AI workflow may be acceptable in one jurisdiction, require additional safeguards in another, and become unworkable in a third. The workflow looks standardized to the business, but it is not standardized to the law.

That gap is where jurisdictional dependency forms.

What Tech Leaders Should Audit Before They Commit

For Asian tech executives, the middleware decision should move earlier in the governance process. Before asking which model performs best, operators should first ask which layer will control the flow of data once the system is live.

The audit does not need to start with dozens of technical questions. It should start with five executive questions.

These are not edge-case questions; they’re procurement questions.

They determine whether middleware remains a flexible access layer or becomes a dependency the company cannot easily unwind.

The Trap Is Treating Middleware Like A Shortcut

Asian enterprises will need AI middleware for cost control, model flexibility, monitoring, fallbacks, guardrails, and centralized governance. The mistake is not adoption; it’s treating a core infrastructure layer like a convenience tool.

This pattern is familiar. Infrastructure dependencies often become strategic before organizations recognize them as such. AI middleware can create a similar dynamic, but with an added regulatory layer.

Once the organization builds its AI workflows around a middleware platform, switching later may not mean simply changing API endpoints. It may require rebuilding audit trails, revalidating compliance controls, changing data-processing agreements, reworking logging architecture, reconfiguring guardrails, retraining internal teams, and proving to regulators that regional data flows remain compliant.

The operational consequences are not theoretical. A company may need to disable a workflow in one market, split a regional deployment into country-specific versions, renegotiate vendor terms, rebuild compliance evidence, or migrate away from a platform after teams have already built around it.

That’s not only vendor lock-in in the software sense; it’s also jurisdictional lock-in.

The company becomes dependent not only on a vendor, but on the routing, storage, retention, and compliance assumptions embedded in that vendor’s architecture.

The Executive Decision

AI middleware is not just a technical layer for platform teams to manage. For enterprises operating across Asia, it is becoming a governance, compliance, and regional operating model decision.

That means the buying process has to change. Legal, risk, data protection, and country teams should be involved before the middleware layer becomes the default path for AI workflows.

The question is no longer only whether a platform can connect the enterprise to more models. It is whether the enterprise can still control the legal and operational architecture once that platform is embedded.

The Buying Rule

Enterprise AI in Asia will be sold as flexibility: use any model, switch anytime, route intelligently, reduce costs, and centralize governance. But flexibility only matters if the enterprise can still control the layer making those decisions.

Before buying, leaders should ask whether the vendor can show where data goes, what it stores, how fallbacks are restricted, how audit evidence can be exported, and how the enterprise can exit.

If the answer is unclear, the company is not buying flexibility. It is buying the vendor’s routing logic, retention choices, compliance assumptions, and jurisdictional exposure.

That is the buying rule: do not treat middleware as a convenience layer unless it can survive legal, risk, and country-level scrutiny.

The model can change. The jurisdictional dependency often remains.

Go Deeper on Asia Tech Lens

• iOS Is No Longer a Global Security Baseline. Enterprise IT in Asia Needs to Act Like It.
  Regulatory unbundling in the EU, Japan, and China is turning iOS fleet management into a jurisdiction-by-jurisdiction problem. The same pressure is now coming for AI middleware, where global defaults can quickly collide with local rules on data, security, and control.

• Vietnam’s 5G Is Expanding Fast. Can Operators Trust the Stack It’s Built On?
  Vietnam’s 5G rollout shows how vendor-stack choices can create compliance, interoperability, and switching risks long before operators realize they are locked in.

• A Quiet Alliance: The Hidden Layer Powering AI Adoption in Asia
  AI adoption often depends less on headline models than on the partners and intermediary layers that turn platforms into real deployments.

• The AI Agent Era Has Begun, and Privacy Risks Are Rising
  As AI systems move from answering questions to acting inside workflows, privacy, access control, logging, and oversight become core deployment risks.

• Invisible Arteries: Subsea Cables in the Age of AI
  A broader infrastructure read on why the systems beneath AI adoption matter.

Malaysia’s AI boom is creating new challenges for clean power buyers: knowing when to move before larger users lock in the best options. As demand from large electricity users rises, the government is trying to make corporate renewable procurement more practical.

The Corporate Renewable Energy Supply Scheme, or CRESS, allows companies to contract directly with renewable-energy producers and receive that electricity through the national grid, creating a new route for corporate clean-power procurement.

DayOne shows how quickly large digital infrastructure players are moving. In June 2025, the Singapore-headquartered data center operator signed Malaysia’s first CRESS deal with state utility TNB, locking in up to 500MW of renewable energy over 21 years. In June 2026, it expanded that partnership through agreements covering around 1.5GWp of solar capacity and 2.2GWh of battery storage, bringing its secured renewable energy in Malaysia to more than 1 GW.

Data centers are not just adding demand. They are also shaping the early clean power market. These buyers tend to have predictable long term load, stronger balance sheets, access to advisers, and more capacity to absorb early market complexity. That makes the decision harder for everyone else.

That creates a sharper question for other industrial enterprises. Manufacturers, semiconductor suppliers, clean-tech firms, and AI infrastructure companies risk losing more than a vague place in the queue.

What they risk by waiting is not just a vague place in the queue. It is access to better renewable projects, stronger developer relationships, negotiating leverage, and time to learn how CRESS contracts actually work. Move too early, though, and they may be committing before the full cost picture is clear.

Access Is Opening. Pricing Is The Test.

Malaysia’s power market is getting tighter. Data from Malaysia’s Grid System Operator (GSO) showed that electricity use in Peninsular Malaysia rose 11.5% year-on-year in April, driven partly by rising data center activity. Recent projects also point to continued demand, from Equinix’s planned $190 million facility in Kuala Lumpur to NEXTDC’s 65MW AI-ready data center in Klang Valley.

Those signals matter beyond the data center sector because they show who is likely to move first. If large digital infrastructure buyers lock in supply and advisory relationships early, other industrial users may have to make clean power decisions in a more crowded market.

CRESS gives them one route, but access alone does not settle the economics. Malaysia has reduced system access charges and published current rates to encourage more corporate consumers to enter green-power procurement. The question for buyers is how those grid-related fees translate into the final price they pay under a long-term CPPA.

Wood Mackenzie estimates that Malaysia’s system access charge could account for about 60% of the estimated total CPPA price in Peninsular Malaysia. Antoine Gaudin, principal consultant in Wood Mackenzie’s Energy Transition Practice for Asia Pacific, says in the report that the charge “significantly impacts the overall cost structure” of renewable-energy procurement. At the same time, Malaysia’s methodology “lacks transparency” compared with other APAC markets.

Wood Mackenzie’s point is about transparency. If system access charges form a large part of the final price, buyers need to understand not just today’s rate, but how the charge is calculated and how it could change over a long contract.

Aurora Energy Research adds a different point: capability. Even if developers are liable for the system access charge, the cost can still feed into PPA pricing. Aurora argues that SAC should be treated as “modelled risk, not regulatory guesswork,” because demand growth, grid investment, capacity needs, and regulatory settings shape the charge.

For buyers, the real cost is not just the headline CPPA rate. It also depends on grid charges, contract length, load profile, and how those charges may change over time. CRESS only works if that full package fits a company’s power needs, cost structure, and timing.

Move Early, But Know What You Are Buying

For buyers, the first step is not to guess where system access charges will go, but to model how they could affect their own power costs.

That means companies considering CRESS should not treat the published rate as the full answer. They need to test how SAC affects the CPPA price, whether the contract fits their load, and whether CRESS is cheaper or more reliable than rooftop solar, green-power programs, or certificates.

The answer will not be the same for every buyer. Companies that use a lot of power every day, face pressure from customers to cut emissions, or are planning new factories, have stronger reasons to move early.

Companies with smaller or less urgent clean-power needs may have more room to watch the market. But clean power procurement is no longer just an ESG decision.

For manufacturers, semiconductor suppliers, clean tech and AI infrastructure companies, clean power is becoming an operating call, not just a sustainability choice. They should start modelling CRESS now, compare it against other clean power options, and understand how much price risk they can carry. Buyers waiting for perfect clarity may find that by the time the market is easier to price, the best projects, relationships, and terms have already been shaped by someone else.

Go Deeper on Asia Tech Lens

• India's AI Data Center Boom Is Running Ahead of the Grid

  India’s hyperscaler buildout shows why AI infrastructure decisions cannot be separated from grid readiness, power reliability, and operating risk.

• Is Southeast Asia Ready for an AI Data Center Surge?

  Southeast Asia’s data-center race is accelerating, but rising power demand could expose the infrastructure constraints behind the region’s AI ambitions.

• Hot Chips, Cool Solutions: Asia's Race to Reinvent Data Center Cooling

  As AI workloads become hotter and denser, Asia’s data centers are being forced to rethink cooling, energy use, and the economics of scale.

• How Hyperscalers Are Rebuilding Asia's Internet for AI

  Hyperscalers are treating Asia’s internet backbone as strategic infrastructure, building new routes to support AI workloads, resilience, and regional scale.

• Can Nuclear Power Fuel Southeast Asia’s AI Boom?

  Southeast Asia’s AI ambitions are running into a power constraint, forcing governments and infrastructure buyers to consider whether nuclear can provide the firm clean electricity data centres need.

China is in the process of turning token consumption into an economic signal. In the West, the companies that followed “tokenmaxxing”—the practice of maximizing token consumption—are now pulling back. Leaderboards are coming down, licenses are being cancelled, and the metric is being publicly abandoned. For operators in Asia, that juxtaposition is worth understanding before it turns into a structural risk.

In April, Uber disclosed it had burned through its entire 2026 AI budget in just four months. Its COO later admitted there was no clear link between rising token consumption and better products for users. In the same month as Uber’s disclosure, Meta took down its internal token usage leaderboard after news of it leaked externally. The leaderboard, nicknamed “Claudeonomics”, was an employee-built dashboard that ranked employees by their AI token consumption. It started an internal race within the firm. In May, Microsoft cancelled Claude Code licenses, in part, reportedly, to cut its operation costs. The companies that were encouraging employees to burn through tokens are now reconsidering their approach.

In China, tokenmaxxing is moving in the opposite direction from the West, towards a greater sphere of influence—from vendor billing unit toward policy adjacent economic signal. At the 2026 China Development Forum in March, China’s National Data Administration declared tokens as the “settlement unit” linking technological supply with commercial demand, paving the way for tokens to be recognized as a new value system in monetizing the AI industry. Alibaba, Tencent, and ByteDance are increasingly placing token volume at the center of how they package, price, and measure enterprise AI usage.

The risk isn’t that tokens are becoming a pricing unit—that’s unavoidable. The risk is that token volume starts being treated as evidence of AI progress before organizations can show whether AI is actually improving throughput, reducing errors, or lowering cost-to-serve. China’s policy language is pushing tokens toward the center of AI measurement; operators elsewhere in Asia should be careful not to import that logic into contracts or performance reviews without first defining what business outcome the tokens are supposed to improve.

How Tokenmaxxing Became A Problem

Tokenmaxxing emerged from a combination of pressures that made token consumption something to optimize for.

The first was cultural pressure from the top. The most prominent voices in the industry frame token consumption as a signal of AI seriousness. Nvidia CEO Jensen Huang told engineers they should be spending tokens equivalent to at least half their annual salary. Meta’s CTO Andrew Bosworth pointed to his best engineers spending the equivalent of his salary in tokens while boosting productivity by five to tenfold, and said, as quoted by Fortune: “Keep doing it. No limit.”

The second pressure was competitive and defensive. Leaders who did not push aggressive AI adoption were being told that they were falling behind. Token consumption leaderboards like Meta’s Claudeonomics gave organizations a visible, shareable number that showcased AI transformation was happening inside the company. As The Information reported, some Meta employees with low token usage expressed concern about not being seen as sufficiently “AI native”, encouraging them to create hacks such as using transcription bots during meetings to inflate their scores.

The third pressure was structural: the metric was designed by the people who profit from its maximization. Token consumption is not a neutral measure of AI activity. It is the unit AI vendors bill in. OpenAI CEO Sam Altman articulated the industry’s direction plainly: “We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter.”

There is another reason why tokenmaxxing grew into a trend before people started pointing it out as a problem: the price signal was pointing in the wrong direction. Token costs have been falling consistently, and tech leaders had reason to believe costs were under control. That wasn’t the case when the bills came in.

The Pricing Trap

The cost of AI inference has dropped dramatically. For enterprise leaders, the metric looked sustainable. But the falling price obscured a compounding problem on the consumption side.

The shift from chatbot to agentic AI changed the consumption equation entirely. A chatbot answers a question. An agent pursues a goal autonomously, across multiple steps, calling a language model repeatedly until it reaches a result. Gartner found that agentic models require between 5 and 30 times more tokens per task than standard chatbot queries.

The result was a gap that widened dramatically. Cheaper tokens, deployed through agents running hundreds of model calls per workflow, produced invoices that do not resemble the original budget assumptions. At Meta, the leaderboard showed total token usage across the company rose from 60 trillion over the previous 30 days to 74 trillion the following week. Uber’s per-engineer monthly API costs reached between $500 and $2,000—a figure that, if multiplied across thousands of engineers, understandably exhausted the company’s annual budget in four months.

The correction started happening when teams began asking for results rather than chasing leaderboard positions.

Why China’s Tokenmaxxing Problem Is Bigger Than The West’s

There is a structural difference between what happened in the West and what is being built in China.

By March 2026, China’s daily token call volume had reached 140 trillion, up from 100 billion at the start of 2024. Liu Liehong, head of China’s National Data Administration, described this growth as an economic signal: evidence that China’s AI industry was evolving from simple dialogue systems to decision-making agents.

When a government tracks a metric as evidence of industrial progress, the organizations operating within that policy environment will optimize for it.

The corporate responses followed immediately. Alibaba announced the creation of the Alibaba Token Hub, a move to integrate its AI businesses. It was also the first time a Chinese internet company embedded the word “token” into its organizational structure. Tencent rebranded its model-as-a-service platform as TokenHub. ByteDance’s cloud computing and AI platform Volcano Engine reported 140 enterprise customers with token usage exceeding 1 trillion each, indicating strong growth for the token economy.

These are commercial architectures designed to make token consumption at the center of enterprise AI. And these infrastructures make their way into organizational culture. Kunlun Wanwei, a Chinese internet company, told its technical staff that those who use fewer tokens will be eliminated, in an effort to push its personnel to increase their R&D efficiency by 50% through AI tools.

What makes this harder to correct than the Western version is that the caution exists inside the system and is deprioritized. Li Qiang, vice president of Tencent Holdings, told Yicai: “Assuming tokens are fuel, if you only focus on fuel consumption without considering the economic efficiency of building the engine, the cost for users may be very high, and they will eventually abandon it.” Liu Weiguang, senior vice president of Alibaba Cloud, said: “Everyone must not think that tokens are the same.” Token volume without context is not a meaningful measure. Both companies understand the distortion, and they are building commercial infrastructure around token volume anyway.

That is what a structural problem looks like: people who understand the risks are participating in it, because the policy environment, the vendor commercial model, and the internal performance pressure are all pointing in the same direction. In the West, Meta could take down the leaderboard. There is no single dashboard to take down here.

Tokens are a fine unit for paying for AI, but they are a poor unit for knowing whether AI is working. When token volume shows up in a vendor proposal, a procurement framework, or a performance review, operators should ask the following question: what business outcome is this token spend supposed to improve? That question is the difference between tokens being a metric and a trap.

More from Asia Tech Lens

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It
  As AI shifts from assistance to action, operators need bounded autonomy, audit trails, oversight, and rollback plans before deployment can be trusted.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data Foundations
  Enterprise AI adoption in Southeast Asia will stall if operators scale tools before fixing the data, workflow ownership, and accountability layers underneath.

• Why Quantum Pilots Fail Before They Start—And What To Do About It
  A practical guide for senior operators on framing emerging-tech pilots around decisions and business outcomes before they become expensive experiments.

• AI and Private Equity: How AI Changes Cash Flows
  AI only matters when it changes cash flows, cost structures, or operational leverage—not when it merely increases activity or adoption metrics.

• China’s Compute Surplus Won’t Be Your Compute Surplus
  China’s AI infrastructure boom matters most to operators already inside the Chinese tech stack, where access, governance, and portability determine whether capacity is actually useful.

Singapore is not trying to win physical AI by building the flashiest humanoid robots or outscaling China’s manufacturing machine. Its opportunity is more specific - to become the controlled real-world testbed where AI-powered machines prove whether they can operate safely, reliably, and commercially outside polished demos.

That makes the city-state an interesting place to watch as the industry shifts toward embodied AI, also known as physical AI. Put simply, this is AI built into machines that can see, move, reason, and respond to the real world, rather than only generating text or images.

Many robots already use AI. What is changing is ambition. Instead of machines built for narrow, fixed tasks, the next wave is about systems that can read their surroundings and adjust as the conditions change. This could mean a factory system coordinating machines on the floor or a delivery robot navigating a busy building.

Several recent moves point to how Singapore wants to play this. NVIDIA plans to launch an embodied AI research hub there, giving the city-state global validation and research pull. Local startup Doozy Robotics shows the commercial ambition with plans announced in May to scale what it calls “Physical AI workforce” across the US and Asia, with a reported pipeline of more than $200 million.

Singapore-headquartered Sharpa points to another part of the story: the city-state’s emerging role in global robotics supply chains. Sharpa supplies robotic hands for a humanoid research platform involving NVIDIA and China’s Unitree.

But Punggol Digital District (PDD) is the clearest expression of Singapore’s bet. A physical AI testbed is expected later this year, giving companies and public agencies a place to find out what works, what breaks, and what is actually worth deploying.

Why It Matters Now

For the past two years, much of the AI conversation has centered on software with generative AI changing how people write and search.

With embodied AI, those capabilities are pushed into physical systems. NVIDIA’s CEO Jensen Huang has called this the “ChatGPT moment for physical AI,” when machines begin to “understand, reason, and act in the real world.”

But the shift creates a problem that software did not have. A language model can be tested at scale in a data center. A machine that needs to navigate a loading dock, avoid a forklift, and coordinate with three other robots cannot. It has to be tested in the real environment it will eventually work in.

That is what makes deployment hard. Physical AI becomes valuable only when it leaves controlled demos and enters messy, shared, human environments - factories, warehouses, public spaces, building sites. Those environments are unpredictable in ways that a lab or a staged demo is not.

Mei-Jung Chen, managing director and partner, Taipei, of BCG, argues that the excitement around physical AI comes from AI’s move into the real world, where it can change day-to-day operations and industrial processes, not just digital workflows.

This is why the opportunity could be much larger than robots. If embodied AI works, it could change how goods are moved, how facilities are managed, and how infrastructure is inspected. That raises the bar for deployment. Operators need to know whether these systems can work safely and reliably around people, equipment, and real operations.

Why Singapore Works As A Testbed

This is where Singapore’s testbed argument becomes important. Physical AI needs a place where machines can interact with people, buildings, roads, and security systems without putting public safety at risk.

Singapore has advantages here. It has dense infrastructure, advanced manufacturing, strong logistics networks, and a government that can coordinate closely with industry. It also has the kind of pressures that make automation worth testing, from high operating costs to labor constraints. These conditions can show whether an AI-powered machine is genuinely useful or only impressive in a staged setting.

Punggol Digital District (PDD) gives that experiment a physical home. As a mixed-use tech hub, it brings together business, research, education, and public spaces. That matters because physical AI will not mature in isolated labs alone.

“By leveraging the unique infrastructure of PDD, we can refine our autonomous robots in a real-world setting that mirrors the cities of the future,” said David Li, founder of Sharpa, which has partnered with JTC, Singapore’s industrial infrastructure agency, to deploy autonomous robots in the district.

The testbed could help companies find out what works in practice: whether robots can coordinate, navigate shared spaces, earn operators’ trust, and make economic sense. For Singapore, that is the bigger bet. It may not be trying to build the flashiest humanoid robot, but to become one of the places where physical AI is stress-tested before it scales.

Why Operators Need To Care

For industrial operators, physical AI could change the economics of automation. Traditional automation often relies on machines built for specific tasks, from robotic arms on production lines to warehouse systems on fixed routes. Physical AI promises more flexibility. It creates machines that can be retrained for new products, workflows, or operating conditions without replacing the whole setup.

BCG’s Mei-Jung Chen believes that this flexibility matters as companies rethink supply chains, bring some production closer to home, and struggle to find enough workers for repetitive or difficult jobs. In that context, physical AI becomes less of a tech experiment and more of an operational question.

For operators, physical AI has to earn its place in the workflow and fit into existing systems without creating new risks. Industrial enterprises should treat these systems as a long-term operational bet. “Don’t look at AI as an expense or a cost. It’s an investment for the future,” said Chen.

The competition is also moving quickly. In China, embodied AI is already being framed around industrial production, public services, and special operations, with state media saying the country’s embodied intelligence industry is growing at more than 50% a year. That figure shows the scale of China’s push. China’s advantage is industrial mobilization, manufacturing depth, and the ability to move quickly across production networks.

For Singapore, the challenge is turning dense infrastructure and high-profile partnerships into a practical advantage.

Singapore’s edge is different. It lies in trust, infrastructure density, regulatory coordination, and enterprise validation. In physical AI, those are not secondary advantages. They are what determine whether machines move from demo videos into daily operations. Whether Singapore can turn those advantages into a durable role in physical AI remains an open question. But it is one of the few places seriously trying to answer it in the real world.

More From Asia Tech Lens

• Singapore's Robots Don't Go Viral — They Go Global

  How Singapore's robotics startups are building for export, with orchestration software and no-code platforms emerging as the real competitive edge.

• Two Robots, One Plan

  Beijing's five-year plan bundles proven factory automation and speculative humanoid robots under the same policy umbrella and why that gap is the first thing operators in manufacturing need to close.

• China's Robot Spectacle Is an Industrial Strategy

  Why the Spring Festival Gala's humanoid showcase was less a technology demonstration and more a deliberate signal of China's push to move robots from controlled environments into the real world.

• Inside China's Bold Push to Build Humanoid Robots: Here Are 5 Companies Leading the Charge

  A close look at the Chinese companies turning humanoid robots from research-stage prototypes into industrial deployments.

• The Man Behind Unitree: Insights on AI, Adoption, and Growth

  Unitree's founder on the real bottlenecks holding back humanoid robots, why the industry's ChatGPT moment is still years away, and what foundations need to be built first.

For operators scouting AI infrastructure destinations, the signals coming out of India are hard to ignore. Microsoft’s largest data center in India is on track to go live in Hyderabad by mid-2026. Google has committed $15 billion to build its first AI hub in the country, which includes gigawatt data center operations. Amazon has signaled up to $35 billion investment by 2030, with AI-driven digitization among its stated priorities.

The case for following that capital is easy to make. The country holds 20% of the world’s data against 3% of global data center capacity, making it a compelling destination for AI infrastructure investment. And when hyperscalers commit billions to a market, smaller operators read it as validation: the market analysis is sound, the demand is there, the regulatory path has been cleared, and the supporting ecosystem will follow.

But these announcements do not tell you whether the infrastructure required to power AI workloads reliably is in place. The question is not whether India has enough electricity in general. It is whether the specific site an operator is building on can get a reliable power connection in time to meet its construction schedule and customer commitments.

The operators who will do well in the country are the ones who asked the power question before committing, not after. That way, they are in a position to plan around the constraints. Operators who skip that question risk arriving at a completed facility that is still waiting for a grid connection.

The Grid Cannot Keep Up

India’s data center capacity is expected to grow from approximately 1.4GW today to 9GW by 2030, according to the Institute for Energy Economics and Financial Analysis. In doing so, data centers are likely to consume about 3% of India’s electricity in 2030, up from less than 1% today. India’s national electricity grid was not designed for that kind of demand.

In the first quarter of 2026, India lost 300GWh of already-generated renewable power because transmission infrastructure could not carry it to where it was needed, according to energy think tank Ember. In other words, the electricity existed but the grid could not deliver it—a problem known as curtailment. If the transmission network cannot move power from where it is generated to where it is needed, it will struggle even more when a data center arrives demanding hundreds of megawatts around the clock. On top of that, India has met only about 80% of its annual targets for expanding transmission infrastructure over the past five years, and one in four major transmission schemes is already running a year or more behind schedule.

The transmission gap is one dimension of the problem. At the local level, the picture is no more reassuring. Even in India’s most established tech corridor power infrastructure remains an issue. Bangalore recorded planned power outages affecting places including Manyata Tech Park, one of India’s largest and most significant IT business hubs, as recently as February 2026. BESCOM, the Bangalore Electricity Supply Company, cited emergency maintenance on the substation infrastructure as the immediate cause, underscoring that even mature tech corridors aren’t immune to infrastructure friction. If that is the floor for the IT capital of India, the assumption that other cities such as Hyderabad and Visakhapatnam will fare better should be scrutinized.

Two Failure Modes, One Outcome

Operators evaluating India face two distinct failure modes. The outcome in both cases is the same: capital committed, construction finished, and a facility sitting idle while it waits for a grid connection that was not secured in advance.

The first is dependency risk. This is the operator whose deployment timeline is built around a hyperscaler facility. The assumption is that because Microsoft or Google has announced a data center in a given city, the surrounding infrastructure will be ready on the same schedule. But industry stakeholders have consistently flagged grid connectivity approvals as one of the main reasons data center projects in India run behind schedule, according to the Council on Energy, Environment and Water. Despite single-window clearance provisions in many states, delays persist in practice. An operator who has made commitments to customers and boards based on a hyperscaler’s announced opening date is exposed if that date slips or if the grid connection lags behind the construction timeline.

The second is execution risk. This is the operator who builds their own dedicated infrastructure but structures the investment around grid supply or renewable energy that does not arrive on schedule. In one case cited by infrastructure project advisory IMARC, a developer received news three months after committing to a site that state electricity board infrastructure would not be available for 18 to 24 months. When construction finishes and the grid connection is still pending, the capital has been spent, the customers are waiting, and the revenue that was supposed to follow the opening date keeps getting pushed back with it.

The difference between asking the power question early and discovering the answer late is the difference between managing a constraint and being managed by one.

What To Ask Before You Commit

None of this eliminates India as an option. But it changes what the homework looks like before the decision is made.

For operators, the decision is narrower than it appears. It is not whether India is the right market. It is whether to enter with a specific site, timeline, and customer commitment structure that can survive power delays. That means power readiness cannot sit behind land acquisition, construction planning, or sales commitments. It has to be tested before those decisions harden.

Operationally, there are four conditions that need to be tested before those decisions harden—not after.

The first is whether the grid connection has actually been secured and what date the facility is expected to receive power. This is to prevent a scenario where construction finishes on schedule while the grid connection is still being processed, leaving a completed facility with no power.

The second is whether power procurement relies entirely on the national grid, or whether it includes a backup source such as on-site renewable energy or battery storage. A facility that depends entirely on grid supply in a market where the transmission network is already under strain is taking on a risk that a mixed approach would reduce.

The third is what happens if the grid connection is delayed by six months. If the answer is that the facility simply waits, that scenario needs to be built into the investment case from the start, not treated as an unlikely edge case.

The fourth is whether the power situation at the specific site has actually been checked, not assumed based on the scale of national investment announcements. The fact that billions of dollars are flowing into India’s data center market says nothing about whether the local electricity supply at a particular site in Hyderabad or Visakhapatnam can support a large, continuous load. Bangalore’s planned power outages should act as a warning.

India is not a market to avoid. It is a market where power diligence has to move from the engineering appendix to the investment memo. Operators that make that shift early can still capture the opportunity. Those that treat hyperscaler announcements as proof of execution readiness may discover too late that demand was never the bottleneck.

More From Asia Tech Lens

• Is Southeast Asia Ready for an AI Data Center Surge?

  Malaysia and Indonesia are racing to position themselves as AI-ready hubs but power shortages, water constraints, and aging infrastructure are putting that ambition under pressure.

• Hot Chips, Cool Solutions: Asia’s Race to Reinvent Data Center Cooling

  Once power is secured, cooling is the next physical constraint. With AI workloads running hotter and denser, Asia’s data centers are being forced to rethink infrastructure from the ground up.

• Can Nuclear Power Fuel Southeast Asia’s AI Boom?

  AI is outgrowing Southeast Asia’s grid. Nuclear can close the gap, but only if governments move faster than reactors can be built.

• AI Boom Under the Sea: Hyperscalers Are Quietly Building Asia’s New Subsea Backbone

  The same constraint logic that applies to power applies to connectivity. Hyperscaler capital does not guarantee that the infrastructure underneath it is ready to scale.

• The Dependency Economy of AI

  Most national AI strategies still sit on hardware, models, and cloud stacks they don't control. A look at what 25 national strategies reveal about where the real chokepoints are and what resilience actually requires.

If you’re a last-mile delivery fleet operator in Indonesia—with hundreds or thousands of two-wheel vehicles across dense urban routes—you are being asked to make a structural decision: whether to commit to a battery-as-a-service model built around proprietary swapping infrastructure. Get that decision wrong, and you risk locking your fleet into a system where exit becomes constrained, deployment is no longer fully under your control, and asset value becomes increasingly uncertain.

A more defensible procurement posture is to preserve optionality while those uncertainties are still resolving. In practice, that means capping initial contract duration at 12–24 months, avoiding hard exclusivity, and insisting on a fully executable unwind path—one that allows assets to be recovered, redeployed, or converted if conditions diverge from plan.

This is not a narrow technology choice; it’s a decision about how reversible your system remains once deployed. The exposure does not sit in one place—it compounds across asset liquidity, deployment timing, and contract dependence.

Why This Matters Now

You often evaluate risks related to resale, rollout, contract flexibility separately, but in practice they can operate as a single compounding downside.

Exclusivity converts what should be operational flexibility into structural dependency, and it does so before interoperability exists to mitigate that dependency.

That dependency manifests across three dimensions.

• Asset liquidity determines whether you can exit.

• Deployment timing determines whether you can scale on schedule.

• Contract dependence determines whether you can switch providers when conditions change.

Because these risks compound across asset liquidity, deployment timing, and contract dependence, the procurement posture outlined above—short-duration contracts, no enduring exclusivity, and a fully executable exit—follows directly as the structure needed to preserve flexibility under current market conditions.

Fleet Assets Become Illiquid System Components

In a traditional fleet, vehicles are mobile assets—resellable, repurposable, and not tied to a single infrastructure provider. That assumption breaks under proprietary swapping systems. Without a fallback to neutral infrastructure, resale becomes conditional on ecosystem participation, limiting your buyer pool to operators already inside that network, if they exist at all.

This does not eliminate value, but it constrains liquidity. Assets can no longer clear in a broad market; they trade within a restricted one, weakening price discovery and making transactions thinner, slower, and less certain. That exposure is compounded by vendor survivability. Swapping networks are capital-intensive and dependent on utilization and long payback periods—conditions that can vary widely in early-stage markets. If the provider scales back, consolidates, or exits, the already limited resale market can contract further.

As exit pathways narrow—through network underperformance, fragmentation, or lack of second-life integration—value can compress rather than decline gradually. The buyer pool shrinks, redeployment becomes more difficult, and exit shifts from a market process to a negotiated one. At the limit, operators can be left with assets that remain functional, but are costly and difficult to unwind.

Even partial recovery through disassembly depends on whether batteries retain viable second-life demand. As batteries fall below mobility-grade performance thresholds, their remaining value depends increasingly on second-life pathways such as stationary storage. These markets typically require a degree of standardization: compatibility with storage systems, accessible battery management systems, and economically viable refurbishment. Proprietary designs can complicate all three, making integration more difficult and, in some cases, excluding assets from established pathways.

Deployment Timeline Becomes Externally Controlled

The operational risk is not that stations cannot be built. It is that they may not be energized at the same pace as vehicle deployment. Battery swapping shifts part of the fleet operator’s scaling timeline onto grid connection, permitting, and provider execution. In Indonesia, where PLN controls grid connection and capacity allocation, that makes rollout less parallel than fleet plans often assume.

At the station level, the load profile is relatively well understood. Industry and academic studies of battery swapping and EV charging behavior show that systems maintaining charged inventory tend to operate with a more continuous load profile, rather than purely intermittent demand. Because batteries are charged ahead of use, stations often sustain a steady baseload to keep inventory available, even outside peak swapping periods.

In distribution networks, however, load does not scale linearly—it concentrates. According to the International Energy Agency’s Global EV Outlook in 2023, unmanaged or clustered EV charging can create localized stress on distribution infrastructure, particularly at the feeder and transformer level, where capacity constraints emerge before system-wide limits are reached. Similarly, the National Renewable Energy Laboratory’s analysis of heavy duty EV charging stations has shown that coincident charging demand—even at relatively modest per-site loads—can drive voltage deviations and thermal limits when concentrated on specific feeders, especially in urban environments with dense deployment.

In Indonesia, these dynamics are mediated by Perusahaan Listrik Negara, which controls grid connection, permitting, and capacity allocation. The World Bank Group’s Indonesia Power Distribution Development Program in 2020 highlights that distribution capacity varies significantly by location and that new loads are subject to feasibility studies, interconnection approval processes, and, where required, network reinforcement before they can be energized.

Direct, station-level evidence linking battery swapping deployments to feeder constraints in Indonesia remains limited. However, the implication can be inferred from these combined characteristics: where stations operate with continuous charging loads and are deployed in clusters, capacity constraints are more likely to emerge at the distribution level. Under those conditions, rollout is less likely to proceed in parallel across all planned sites and more likely to advance sequentially, as each location clears connection and capacity requirements.

For operators, the impact is financial. Vehicles can be deployed ahead of supporting infrastructure, but utilization may lag if station availability is uneven, delaying revenue while capital costs are already incurred. In effect, capital is committed on a parallel timeline while infrastructure arrives sequentially—potentially leaving assets underutilized, slowing cash conversion, and eroding returns not because demand is absent, but because the system enabling it is not yet fully in place.

Locked Into Contracts Before Standards Exist

Indonesia’s battery swapping market remains structurally unstandardized. There is no enforced common battery form factor or interoperability requirement, and government-led standards are still evolving. The assumptions you would contract on today—technology compatibility, network scale, long-term viability—are therefore not fixed; they are likely to shift over the life of the agreement.

That uncertainty is not abstract. In infrastructure markets, when early assumptions diverge from operating reality, contracts tend to return to negotiation sooner than expected. A World Bank Group study suggests that these adjustments often occur in the early years of the asset lifecycle, when utilization, performance, and cost structures are first tested against real conditions. In that context, long-duration commitments are not just a bet on a provider—they are a bet that the underlying system will stabilize on your timeline.

These are the conditions under which the contract will actually be tested.

A shorter initial term—typically in the range of 12 to 24 months—is therefore a defensible starting point under current conditions. In most early stage deployments, this initial window aligns the duration of your commitment with the period in which key variables can actually be observed: whether station rollout keeps pace with fleet deployment, whether utilization tracks projections, and whether the broader ecosystem begins to converge toward interoperability. Extending beyond that window shifts the basis of the contract from observed performance to forward assumptions that remain difficult to underwrite.

Exclusivity should not outlast that same window. In evolving systems, renegotiations are common, and they do not occur on neutral ground. Providers that control infrastructure and switching costs tend to enter those discussions with greater leverage—particularly if the operator has no alternative network to fall back on. Locking into a single provider before standards emerge can therefore concentrate risk at the point where flexibility is most needed.

Minimum-volume commitments require similar scrutiny. These clauses function much like take-or-pay structures: payment obligations persist regardless of actual utilization. In a context where demand realization depends on infrastructure rollout and network density, they can convert operational uncertainty into fixed financial exposure. What appears as a utilization hedge can, in practice, become a constraint on adjustment if conditions diverge from plan.

Exit, in this setting, needs to be operational rather than merely legal. A contract can grant you the right to terminate while still leaving you unable to move. Vehicles remain tied to a network with no immediate alternative, assets cannot be transferred cleanly, and counterparties may contest exit terms. The result is a protracted unwind: utilization falls, write-downs begin, and capital remains locked while revenue is disrupted. By the time renegotiation or exit is possible, the operator is often negotiating under operational pressure rather than from a position of choice.

Termination rights alone do not ensure recoverability; without predefined execution, exit becomes contested and value-destructive. The contract needs to specify not just the right to leave, but how assets move, who bears the transition cost, and how outcomes are determined if conditions have changed.

Asset protections then determine what remains viable after that exit. Buyback provisions can help anchor residual value under defined conditions. Conversion rights can mitigate format lock-in if standards begin to converge elsewhere. Redeployment rights can preserve the ability to move vehicles or components into adjacent markets. None of these eliminate risk, but they can prevent it from becoming fully one-sided if interoperability does not emerge as expected.

Taken together, this is what a defensible contract structure looks like under unresolved standards: a limited initial term aligned with observable performance, no enduring exclusivity, no fixed-volume obligations that outlast demand visibility, and an exit pathway that is fully executable with asset recovery mechanisms in place.

Since the standards environment is still developing, the objective is not to eliminate uncertainty—it is to prevent that uncertainty from becoming irreversible.

The Cost of Getting It Wrong

This is not a story of sudden failure. There is no single breaking point where the model completely collapses. Instead, the cost of getting the decision wrong manifests as a slow erosion of returns.

Vehicles that should function as tradable assets begin to behave more like fixed infrastructure—difficult to redeploy, monetize, or unwind outside their original network.

Rollout speed drifts further from plan as it becomes tied to grid upgrades and vendor timelines rather than operator execution.

Residual value assumptions degrade quietly, as batteries fail to find viable second-life markets and resale options narrow or disappear.

Individually, each deviation may appear manageable, but when factored together, they compound.

Payback periods stretch. Utilization rates miss projections. Assets remain on the books longer than you intend, without corresponding revenue. Contracts continue to bind even as their economic rationale weakens.

The system can still function. Vehicles will move, batteries will swap, deliveries will be completed. However, it will all function on terms that increasingly work against you.

In an interoperable market, upside scales with adoption. More participants, more infrastructure, and more compatibility create positive network effects. In a proprietary market, the opposite is true. Downside scales with dependency.

And in Indonesia today, dependency is not a temporary phase; it’s the default structure of the market.

The cost of getting the decision wrong is not immediate failure, but structural dependency that becomes progressively more difficult—and more expensive—to reverse once embedded into the fleet.

More from Asia Tech Lens

• When Battery Economics Shift: What Gets Stress-Tested in China's EV Strategy? What happens when EV capital assumptions break down, take-or-pay exposure, platform risk, and utilization pressure under shifting demand.

• The Hormuz Problem Asia's Battery Makers Haven't Mapped

  Battery supply chain risk at the materials level and what upstream disruption looks like before it reaches the factory floor.

• Hot Chips, Cool Solutions: Asia's Race to Reinvent Data Center Cooling Infrastructure constraint logic and how physical bottlenecks shape deployment timelines across Asia's most capital-intensive sectors.

• VinFast Pivots to Southeast Asia. But Can It Outrun BYD in Indonesia?Indonesia EV market, fleet deployment, and what happens when execution can't keep up with ambition.

• Not Just EVs: China Leads the World in Battery Production and Technology for All Vehicles How China built dominance across the entire battery stack - from chemistry and cost to commercial fleets, industrial vehicles, and the manufacturers supplying them.

Companies across Southeast Asia are approving AI pilots before answering a more basic question: can the underlying workflow actually support automation at scale?

For operators, that question matters more than the model being tested. If invoices, contracts, procurement records, and customer data are still scattered across paper, PDFs, spreadsheets, emails, and legacy systems, AI can quickly become another layer on top of an already fragmented process.

Fukuda pointed to one Sansan client, a construction company in Thailand that was processing more than 2,000 invoices every month, with over 90% still exchanged on paper. Each invoice took about 20 minutes to process manually, delaying the monthly closing and making it difficult for headquarters to monitor activity across construction sites.

After digitizing the workflow, the company was able to consolidate invoices from different offices and sites into a single system. The shift cut processing time to eight minutes per invoice and saved around 4,800 work hours a year.

The case is a success story, but its starting point is the more important lesson. Before the company could automate invoice processing, it first had to make a messy paper-heavy workflow visible, structured, and usable.

The issue is not necessarily that companies lack AI tools. Many are trying to layer AI onto workflows that were never properly standardized, governed, or prepared for automation in the first place.

The Real Bottleneck: Fragmented Data

For many enterprises, the biggest obstacle to AI adoption is not model capability, but the condition of the underlying data itself.

Fukuda frames data readiness as a precondition for scaling AI, not a problem to fix after deployment.

Invoices, contracts, business cards, procurement records, and customer information are often stored across disconnected systems, handled manually by different departments, or exchanged in inconsistent formats. Even companies that have digitized parts of their operations may still rely heavily on scanned PDFs, spreadsheets, emails, and legacy approval processes.

According to Fukuda, organizations often assume that having large amounts of data automatically makes them ready for AI deployment. In practice, fragmented and poorly structured data can make AI outputs unreliable from the beginning.

The problem becomes more visible in Southeast Asia’s emerging markets, where digitization maturity varies widely across industries and the supply chain. External vendors, suppliers, and contractors may still submit documents manually or use incompatible systems, making it difficult to create standardized workflows that AI systems can process consistently.

Even Sansan ran into this problem while developing AI-driven document management tools. Fukuda said the company found that general-purpose AI models struggled with the variety and complexity of real business documents, leading to delays and inaccurate outputs.

Sansan’s response was to move away from relying on general-purpose AI alone and toward models trained for business-document structures. The broader lesson for operators is not product-specific: generic AI will struggle when the workflow depends on messy documents, inconsistent formats, and business-specific exceptions.

The experience highlights a broader challenge for enterprises adopting AI. Vendor demos and pilot environments are often cleaner than production reality. Once AI systems encounter fragmented workflows, inconsistent formats, incomplete data, and edge cases at scale, performance can deteriorate quickly.

For operators, that is the lesson to take into vendor selection. A successful demo does not prove that a system can handle real document variety, messy supplier inputs, or the exceptions that appear in day-to-day operations.

The Human and Workflow Problem

Fukuda adds that AI failures are not only caused by technical limitations, but also by how new systems fit into existing workflows.

If AI tools disrupt how teams already work, employees may see them as additional friction rather than productivity tools. In some cases, teams revert to manual processes when AI outputs become inconsistent or difficult to trust.

In most cases, these problems stem from the same root issue: AI initiatives were launched before the underlying data and workflows were properly prepared. Without proper training and integration into day-to-day workflows, AI initiatives can struggle to move beyond experimentation.

That makes adoption a pre-scaling test, not a post-launch training issue. Before expanding AI across departments, operators need to know who owns the workflow, who monitors the output, who investigates errors, and how teams will use the system when results are imperfect.

The same applies to governance. In regulated sectors, the question is not only whether policies exist, but whether companies can prove that controls are working inside AI-supported workflows day-to-day. That includes access controls, activity logs, monitoring, auditability, and audit trails that show how information is processed and who has accessed it. They also expect incident response procedures and regular security assessments to be in place before AI-assisted workflow changes are approved. What is often missing is operational evidence that these controls are consistently applied in daily workflow, not just written into policy.

Before the Next AI Budget Gets Approved

For Fukuda, the bigger risk for Southeast Asian enterprises is not moving too slowly on AI, but moving too quickly without fixing the operational foundations underneath.

The safer path is to start with narrow operational problems where the business pain is clear, the data can be prepared, and the outcome can be measured. Only then should companies expand AI across more complex workflows.

That approach is especially relevant in Southeast Asia’s asset-heavy industries, where many operational systems remain fragmented across sites, suppliers, and legacy processes. In these environments, the companies that benefit most from AI may not be the ones deploying the most tools, but the ones that spend more time preparing their operational foundations before scaling them.

Before the next AI line item lands in the budget, operators should ask a narrower set of questions. What workflow is this supposed to fix? Is the data usable? Who owns the output? How will employees use the tool? What happens when the system gets it wrong and how will success be measured?

The companies that get this right will not be the ones that moved fastest on AI. They will be the ones that were honest enough to fix their operations first.

More From Asia Tech Lens

• Why AI Agents Still Struggle Inside Southeast Asia’s Enterprises

  Why enterprise AI adoption in Southeast Asia runs into hierarchy, trust, workflow ownership, and accountability.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It

  Once AI moves from assistance to action, operators need bounded autonomy, audit trails, oversight, and rollback plans before deployment can be trusted.

• Budget 2026 Puts AI Into Execution Mode. Operators Need To Sequence It Carefully

  Singapore’s AI push shows why enterprises need to sequence deployment around sector readiness, operational capacity, and measurable use cases rather than treating AI adoption as a broad transformation mandate.

• India’s AI Push Is Real. Production Access Is the Constraint

  Why AI ambition does not equal deployment readiness: regulated operators need reservable capacity, auditable controls, and portability before pilots become usable production infrastructure.

• Why Quantum Pilots Fail Before They Start And What To Do About It

  Different technology, same operator lesson: pilots fail when teams start with what the technology can do instead of defining the costly decision, measurable baseline, owner, and procurement path upfront.

When enterprises across Asia start a quantum pilot, they often begin by asking what the technology can do for them. The entry point can produce interesting pilots but they will likely go nowhere—no procurement decision, no budget owner, no path to deployment, no business impact.

Alexandra Beckstein, CEO of QAI Ventures, has spent enough time inside these programs to know exactly where that happens. “Teams ask where they can use quantum, rather than asking which decision is costly, complex, and worth improving. That usually leads to a pilot that sounds exciting but is too vague to succeed,” she says.

Beckstein runs QAI Ventures, a Switzerland-founded firm with its Asia-Pacific headquarters in Singapore. In February, the firm announced an industry cluster program backed by SoftBank Corp. and HorizonX. Beckstein has built quantum startup ecosystems across Europe, North America, and Asia Pacific. She has seen where the pipeline breaks for many enterprise quantum programs. She shares her insights in a written interview with Asia Tech Lens.

The Wrong Question Is Being Asked First

What she keeps finding is that the decision that determines a pilot’s fate is made at the very beginning. Teams enter quantum programs by asking where the technology can be applied rather than which specific, costly business decision needs to be improved. That produces pilots that are technically interesting but commercially vague.

The most reliable early signal that a pilot is incorrectly structured is the absence of a P&L owner. “A pilot needs a defined P&L owner who is accountable for outcomes,” Beckstein says, “not just an innovation or IT team exploring new tools.” If the initiative lives inside an innovation function without a business unit accountable for the result, it is not a business pilot. It is an experiment with a business-shaped label. In regulated industries—banking, insurance, or telecommunications—a pilot without a business owner rarely makes it past procurement, regardless of how technically promising the results are.

The failure pattern has a structural cause. On the supply side, researchers with strong IP often lack business scaffolding. They don’t have the capacity to translate technical capability into a deployable system. On the demand side, enterprises are aware of quantum as a category but have no capacity to structure a pilot that produces evidence procurement can act on. QAI Ventures is positioned around both sides of that gap. Most of what is deployable today is quantum-inspired or hybrid, not full quantum computing, which remains dependent on hardware breakthroughs that have not yet arrived. While quantum research is maturing, enterprise deployability is a separate endeavor.

Beckstein recalls a case where a company attempted to tackle a very large planning problem too early: the data was inconsistent, the business team had not agreed on a success metric, and the project became too broad to produce a clean result. “The lesson was simple,” she says. “Start with a smaller problem, cleaner data, and a tighter commercial goal.”

What A Correctly Framed Pilot Looks Like

Three cases Beckstein points to illustrate what problem-first framing produces in practice; the figures that follow are drawn from her account. The following cases are not arguments for quantum broadly. They are examples of when a specific problem is matched to the right method.

Multiverse Computing applied its Singularity framework to compress AI models for a customer service network. The outcome was an 80% reduction in model size and up to 75% lower energy consumption, with no degradation in response quality. The business case—cost reduction and sustainability—was defined before the quantum-inspired approach was selected, not after.

Fujitsu’s Digital Annealer, deployed at the Port of Hamburg, optimized vehicle traffic flows and increased average travel speed by 20% while cutting CO₂ emissions by 10%. More operationally significant: a calculation that previously took days now runs in seconds. The framing was a logistics bottleneck the port already owned. The quantum-inspired approach was chosen because classical methods had hit a scaling ceiling.

QTFT, a quantum software startup founded in Thailand, built a routing solution for supermarket goods deliveries that generates several strong, viable alternatives rather than a single theoretically optimal route. For a logistics operator, that distinction matters at the moment a route fails and a decision needs to be made in minutes, not hours.

As Beckstein puts it, these cases share something fundamental: “A focus on solving genuine operational constraints and producing results that procurement and operations leaders can directly compare against their existing benchmarks. That is ultimately what separates promising pilots from deployments that stick.”

Her point is that success criteria need to be quantified before a pilot begins. For example, a 3% or greater improvement over a well-understood classical baseline. Without that number agreed in advance, the pilot has no natural endpoint, and no moment at which anyone is obligated to act on the result.

How To Run It, And When To Stop

The second failure mode Beckstein flags is less about framing and more about discipline. Pilots run too long because nobody agreed on exit criteria before they started. By the time results are inconclusive, the budget has been spent and the business owner has moved on.

Her stop rules are unambiguous: “A pilot should stop if the data is not good enough, if the business owner is not engaged, or if the result is not clearly better than the current approach. It should also stop if costs keep rising without stronger evidence.”

In regulated industries, the governance layer deserves particular attention—it is a condition of deployment. In banks, insurers, telcos, and critical infrastructure, the demo is not the hard part. Auditability, reproducibility, vendor risk, security, compliance, and long-term support are what procurement will flag. Pilot teams that do not document these early should not be surprised when a technically promising project stalls at the procurement stage.

Not every category is ready for enterprise piloting. The categories Beckstein sees as decision-relevant in the next 12 to 24 months are specific: quantum-safe security planning in regulated sectors, financial services workflows including pricing, risk, and fraud detection, and operational planning in logistics, energy, and supply chains. What she is explicitly not backing are categories that still depend on hardware breakthroughs before they can deliver enterprise value. For operators choosing between vendors, that boundary is a useful screen: if a vendor’s pitch depends on technology that does not yet work at enterprise scale, no amount of careful pilot design will produce a deployable result.

To move from exploration to a budget line-item, Beckstein is clear about what needs to be in place: “A clear owner, clear business value, usable data, and a realistic path to implementation.” If any of those four are absent, the pilot is not ready.

Before funding a quantum pilot, operators should be able to answer the following: which expensive decision is worth improving, why current methods are no longer sufficient, and whether a quantum-inspired or hybrid approach can beat a defined baseline under real conditions. If that cannot be answered upfront, the pilot should wait.

More From Asia Tech Lens

• Can India Build Quantum Computers That Matter Globally?
  India’s quantum push shows why national ambition is only the first step; the harder test is turning research capacity into commercially relevant systems.

• Why Japan’s Quantum Strategy Starts With Algorithms, Not Qubits
  Japan’s approach underlines the same near-term lesson: quantum value may arrive first through applied software and workflow improvements, not hardware breakthroughs.

• Singapore’s Quantum Bet: Where AI Meets the Next Compute Revolution
  Singapore’s quantum ecosystem helps explain why the region is trying to close the gap between research investment and enterprise deployment.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.
  Like quantum pilots, agentic AI deployments show that advanced technology only earns enterprise trust when governance, control, and accountability are built in early.

• India’s AI Push Is Real. Production Access Is the Constraint
  This piece echoes the same deployment problem: emerging technology only matters when it can move from promise to production infrastructure.

Editor’s Note: Asia Tech Lens turns one this week. The goal when we started was straightforward: track Asia’s technology rise with perspective, without the hype, and free from rhetoric. A year in, readers from nearly 60 countries have found their way here—many in the U.S., the U.K., and across Europe, alongside strong communities in Singapore and India. Different geographies, one shared question: how technology actually gets built and scaled in this part of the world.

That readership has clarified what this publication is.

Asia Tech Lens is defined less by where the stories come from than by how we approach them. We look at Asia the way a builder would—execution, trade-offs, and the systems beneath the headlines and explain what we find in a way that travels across markets.

The direction is set. The next year is about going deeper.

Thank you for being part of our journey. Here’s to the next chapter.

Much of the discussion around AI in cybersecurity has focused on faster, more scalable attacks. But that framing is incomplete. As AI shortens the gap between a weakness being found and being exploited, the bigger question for operators is what happens next. Once core systems are hit, can they regain control and keep the business running?

There is a gap in recovery. Veeam’s 2025 ransomware research found that nearly 7 in 10 organizations experienced at least one cyberattack in the previous year, but only 10% recovered more than 90% of their data, while 57% recovered less than half.

Many organizations believe they are ready because they rely on plans, backups, and recovery targets. In practice, those do not guarantee that a critical system can be restored under real conditions.

As the window to respond shrinks, the problem shifts. Restoring systems alone is not enough when identity, access, backups, and dependencies are uncertain. Operators also have to rebuild trust in what comes back online.

AI Is Shrinking The Time Between Vulnerability and Compromise

AI is making it easier to surface vulnerabilities across systems and applications. In Singapore, cybersecurity awareness is relatively mature. Still, AI is already changing how enterprises think about exposure, according to Joey Lim, Country Manager at Exclusive Networks Singapore, a global cybersecurity specialist.

“On the ground, we see a shift from periodic security assessments toward a more continuous posture,” Lim told Asia Tech Lens. “Organizations are asking harder questions about their attack surface, not just what they know about, but what they don’t. And that’s the right instinct.”

That compression changes which capability matters most. When the window between vulnerability and exploitation was measured in weeks, detection and patching kept most incidents from reaching the recovery phase. As that window shrinks, more incidents will get through. Recovery stops being the fallback—it becomes the front line.

That leaves operators with a harder question. When something gets through, can they respond quickly, regain control, and recover before the damage spreads?

The Real Bottleneck Is Recovery

Backups can make organizations feel safer than they are. A completed backup job shows that data exists somewhere, but it does not prove the business can recover.

For Gareth Russell, Field CTO, APAC, at Commvault, the starting point is no longer how fast an organization can restore systems. “In a cyber incident, speed without trust is a huge risk,” he told Asia Tech Lens.

The more important question is how quickly a company can identify a known clean state, reestablish trusted control, and bring back a service it can rely on. That is the difference between trusted recovery and simply powering systems back on.

Traditional metrics such as recovery time objective (RTO) and recovery point objective (RPO) still matter, but Russell said they often reflect intent rather than reality. What matters most is whether organizations can recover a clean, usable service end-to-end without reintroducing the threat.

“When I talk to CIOs and CISOs about recovery readiness today, we look at things like time to clean recovery, coverage of immutable and verified data, the ability to regain control of identity systems, and whether recovery has been tested under realistic conditions,” Russell said.

Across Asia, Commvault has found that 85% of organizations have incident response plans, but only 30% test all mission-critical workloads. When a real incident hits, those plans often do not hold, and recovery takes longer than expected.

The gap shows up in execution. Restoring a database or application is one thing. Getting the business running again during a real incident is another.

Recovery, in this sense, means testing the full process before a real incident leaves no room to guess.

Identity Is Where Recovery Often Breaks

If identity is compromised, recovery can’t start with simply restoring workloads. The organization first has to decide who and what can still be trusted. Otherwise, bringing systems back may also bring back the attacker’s access. Russell said identity failure changes the nature of recovery.

“In most incidents, it is not just that access is lost, it is that you cannot trust who or what is accessing anything,” he said. Federation fails, tokens may still be valid, service accounts may keep running, and organizations can lose control of the control plane.

“Teams often try to recover workloads before identity is stable. That is where things fall apart. If identity is not clean, nothing you bring back can be trusted,” Russell added.

Lim described how this failure unfolds in real time. A threat is detected, but the scope is unclear, so escalation is delayed. By the time leadership is engaged, critical hours have passed. The response team then realizes the incident response plan no longer matches the current environment. Systems have changed, contacts are outdated, and dependencies are unclear.

At the same time, attackers move laterally and target credentials. The team now faces a more dangerous problem. They no longer know which accounts, systems, or access paths can be trusted. Recovery slows as every action needs to be verified.

This is where the incident turns. Shut down too broadly and disrupt operations, or move too carefully, and the attackers may still be active. “This is often where a serious incident becomes a catastrophic one,” said Lim.

When identity is uncertain, recovery becomes a series of high-risk decisions made without clear visibility of what is safe.

Operators’ Takeaways

Do Now

• Prove recovery. Test one critical service end-to-end, with clean data, trusted access, and dependencies restored in the right order. Russell said the minimum proof is a full recovery under real conditions, where users can log in, and the service works.

• Map your exposure. Understand not just known assets, but shadow IT, cloud workloads, and third-party integrations. Lim said the assets that organizations do not track are often the ones that get exploited first.

• Harden identity. Reduce over-privileged accounts, clean up service accounts, and enforce consistent multi-factor authentication. Lim warned that many teams are still “working blind” when identity is compromised.

• Run real drills. Test recovery under realistic conditions, not just tabletop exercises. Recovery needs to be proven in execution, not assumed because plans exist.

Wait

• Hold off on more AI-security tools until recovery basics are proven. Lim said the bigger issue is not adding AI features, but whether the response is built for machine-speed attacks.

• Be realistic about in-house response. A full 24/7 detection-and-response capability is “not realistic for most” organizations.

• Delay framework rewrites if plans have not been tested. According to Russell, recovery readiness comes from repeatable execution, not documentation.

Avoid

• Do not assume backups guarantee recovery. Russell said untested and compromised backups are common failure points.

• Do not restore systems before identity is trusted. If identity is still compromised, restored systems cannot be trusted. “Break glass only works if it is genuinely separate, operationally ready, and trusted when everything else is not,” said Russell.

• Do not treat compliance as resilience. Compliance sets a baseline but “doesn’t give you resilience,” said Lim.

• Do not treat cybersecurity as only a technology problem. Communication and decision-making often fail first.

Related Reads On Asia Tech Lens

• AI Is Accelerating Cybercrime—and Southeast Asia Feels It First

  AI is making cybercrime faster, cheaper, and easier to scale across Southeast Asia. This piece explains why organizations have less time to detect, contain, and recover from attacks.

• Agentic AI Can Act. Singapore’s New Rulebook Says It Needs Guardrails

  As AI systems gain more autonomy, the risks shift from what they can generate to what they can do. We look at why permissions, oversight, and recovery planning matter before AI agents are allowed into real workflows.

• Two AI Phones. Two Access Models. One Critical Difference.

  AI access is becoming an operational risk, not just a product feature. This piece compares two approaches to AI control and shows why permissions, identity, and trust layers matter as systems become more automated.

• Why ByteDance’s AI Phone Hit a Wall

  When AI agents start acting across apps and services, security and accountability become the real constraints. The piece looks at why uncontrolled access can quickly turn AI capability into operational risk.

• India’s AI Push Is Real. Production Access Is the Constraint

  AI ambition only matters if systems can work under real operating conditions. This piece examines why production access, auditability, and incident ownership are becoming the true tests of AI readiness.