Most banks know what software they buy, but fewer know what is running inside it. A customer-service platform, a fraud-detection tool, a document-processing system—each of these may have had AI quietly switched on in a recent product update, without the bank being consulted. Singapore has just decided that it does not matter. If the AI is in software a bank pays for, the bank is responsible for it.

On October 7, the Monetary Authority of Singapore issued its final Guidelines on AI Risk Management, setting out how MAS expects banks, insurers, payment providers and other regulated firms to govern AI. Banks had asked MAS to limit the scope to AI they knowingly procured. MAS declined. “FIs [financial institutions] remain accountable for AI used in the services they deliver,” it said.

What does that mean in practice? Take DBS for example. DBS has deployed AI across more than 430 use cases, including a tool that drafts corporate credit memos by working through more than 70 tasks. From October 2027, DBS and other MAS-regulated institutions will be expected to manage AI risks across their operations, including AI inside the software they buy.

The Guidelines take effect in stages from October 2027. The responsibility of meeting them falls mainly on heads of vendor and third-party risk, chief risk officers, model risk leads, CIOs, and procurement heads at MAS-regulated financial institutions. The software vendors serving these institutions face a parallel task: their product and sales leaders need to be ready with answers when customers start raising questions.

Read more

For anyone building AI infrastructure in Japan, power availability has become the defining decision that shapes site choice, timeline, and customer commitments, as a new grid connection in Tokyo can take five to ten years to secure. A new arrangement between Japan’s largest power generator and two technology partners offers a new option.

On October 1, JERA, Japan’s largest power generator, signed a memorandum of understanding (MoU) with Dell Technologies and RHAELM Holdings, a London-based sovereign AI infrastructure developer, to plan an AI data center of up to 400 MW at its gas-fired power station in Chiba, near Tokyo. The facility would take electricity directly from the plant, sidestepping the years-long wait for a grid connection.

Apollo Global Management has signaled its intent to finance, with total capital deployment expected to exceed US$15 billion. Operations are targeted around 2028, under a power supply contract running 15 to 25 years.

The same day, Japan tightened its connection rules to clear out developers who were holding queue positions without serious intent to build. From October 1, any customer who does not pay the required contribution within three months of approval loses their place in line. The new requirement applies to extra-high-voltage customers, a category that covers large data centers.

For developers and tenants weighing whether to follow JERA’s model, getting power sooner is a real benefit. What is less clear is who carries the risks that come with depending on a single plant, and on what terms.

The Chiba Project: What Is Confirmed and What Is Not

The Chiba project would be the largest single-site AI infrastructure deployment in Japan, if built. So far, the partners have confirmed the location, a capacity of up to 400 MW, a target opening around 2028, and a power contract of 15 to 25 years.

What is yet to be confirmed: a final investment decision, committed financing, and a named anchor customer. For a project of this scale, all three would normally need to be in place before construction begins, though the involvement of JERA and Apollo gives the announcement more weight than a typical early-stage MoU.

A final investment decision is when partners formally commit to building, with construction contracts being signed and the site being prepared. Until it is made, every other timeline, including the 2028 target, is contingent. Confirmed financing means the capital has a committed source with agreed terms. Apollo has signaled intent to finance RHAELM’s share, but at US$15 billion across all phases, intent and commitment are different things. An anchor customer is the first major tenant who signs before the facility is built, committing to take defined capacity at a defined price. It is their contracted revenue that lenders use to underwrite the project’s economics.

Taken together, they describe a project with a credible foundation and significant details still to be resolved.

The Risks of Taking Power Straight From the Plant

For operators who need capacity by 2028, a behind-the-meter arrangement is not a marginal advantage. But taking power directly from a single plant raises three questions.

How is the electricity priced? The Chiba Thermal Power Station runs on LNG (liquefied natural gas), which Japan imports almost entirely from overseas and is priced in US dollars on global markets. That means the cost of generating electricity at Chiba moves with global gas prices and with the yen-dollar exchange rate. Japan has already seen what that exposure looks like in practice: when LNG spot prices spiked during the Hormuz crisis earlier this year, Tokyo Gas suspended all new high-voltage and extra-high-voltage contracts to prevent negative margins.

Whether that volatility lands on the tenant depends on how the power agreement is written. Under a pass-through arrangement, the tenant pays a price that moves with fuel costs, which means a tenant signing today cannot know what power will cost in, say, 2035. Under a fixed-price arrangement, JERA absorbs the fuel cost risk and charges a flat rate, giving the tenant predictability but likely at a premium. At present, the pricing structure for Chiba has not been disclosed. Before signing, a prospective tenant should ask for the pricing formula, request historical LNG price data to model downside scenarios, and confirm what happens if JERA’s costs exceed the agreed price.

What happens when the plant goes down? The more serious risk is not a routine maintenance window but a site-wide disruption—an LNG supply interruption or a fault affecting multiple generating units. None of the Chiba announcements describe the backup arrangement, and the JERA press release does not address what happens when the plant goes offline. A well-designed site keeps primary supply and backup supply distinct: either a grid connection kept on standby, or on-site battery storage sized to cover an interruption. Before committing, a prospective tenant should require written disclosure of the backup arrangement: what it covers, how long it can sustain operations, and who bears the cost when it is used.

How long is the lock-in, and on what terms? A 15-to-25-year power contract is longer than most enterprise technology cycles. The workloads running in a data center in, say, 2040 may look nothing like the workloads that justified the original build. Exiting or renegotiating a power agreement of this duration with a counterparty that controls the physical infrastructure on which the facility depends is not straightforward. Before signing, a tenant should ask for the exit provisions: under what conditions the agreement can be terminated, what penalties apply, and whether the power agreement transfers or terminates if the facility changes hands.

When This Makes Sense, and When the Grid Is Still Better

The core question for any tenant evaluating a behind-the-meter site is whether the facility can guarantee power continuity when the plant is interrupted, and whether the workload can tolerate an interruption if it cannot.

A site with confirmed backup supply—a standby grid connection, on-site battery storage, or both—can support workloads that need to stay on continuously. A site without a disclosed backup arrangement cannot reliably support any workload that cannot afford to go dark. The Chiba project has not yet publicly confirmed what its backup arrangement is. That is the question to resolve before any tenant commits.

For data center developers serving customers whose workloads run in scheduled batches and who cannot wait years for a grid connection, a behind-the-meter arrangement is worth evaluating seriously, provided the backup question has a satisfactory answer. For those running systems that need continuous availability without confirmed redundancy, or who have made public commitments to use clean energy that gas-fired power cannot meet, the grid queue is still the better option, even with the wait.

One more regulatory development is worth watching before making a final site decision. Japan’s Agency for Natural Resources and Energy has outlined a proposal, targeted for April 2027, that would impose stricter rules on large facilities drawing 30 MW or more from the grid. Under the proposal, a developer who delays its planned supply start date by more than a year would face a cost settlement, with the method still under consideration, and one that scales back its contracted capacity partway through a phased rollout could lose the unused portion of its grid slot. This is not yet confirmed policy, and the final threshold may change before it takes effect. For any operator currently holding a grid connection slot while weighing alternatives like Chiba, this proposal is the one to watch in early 2027.

What Chiba offers is concrete: power sooner, without the queue. But a 15-to-25-year power contract signed today will still be running when AI workloads, energy markets, and Japan’s grid have all changed significantly. The pricing structure, backup arrangements, and exit terms agreed at signing will determine how much room a tenant has to adapt to those changes, or whether the speed advantage at the start becomes a constraint that outlasts its usefulness.

More from Asia Tech Lens

• India’s AI Data Center Boom Is Running Ahead of the Grid

  India’s hyperscalers are committing billions to AI infrastructure, but electricity transmission constraints threaten project timelines.

• Malaysia’s AI Boom Puts Clean-Power Buyers To The Test

  Malaysia is opening new routes to renewable electricity procurement, but pricing uncertainties remain. Industrial buyers face a trade-off between securing supply early and committing before the full costs become clear.

• Can Nuclear Power Fuel Southeast Asia’s AI Boom?

  Nuclear energy offers the promise of continuous, low-carbon electricity for AI data centers. But regulatory readiness, financing and lengthy development timelines could keep projects from delivering power when it is needed.

• Hot Chips, Cool Solutions: Asia’s Race to Reinvent Data Center Cooling

  As AI workloads drive up electricity demand, Asian data centers are experimenting with liquid cooling and alternative designs. The challenge is achieving reliable energy savings without introducing new costs and operational risks.

• Is Southeast Asia Ready for an AI Data Center Surge?

  Malaysia and Indonesia are attracting significant AI data center investment, but grid limitations, water shortages and rising costs threaten expansion.

Before a manufacturer pays for a better prediction of equipment failure, it should ask what happened to the last useful warning. Did maintenance act in time, or did the alert wait for approval, spare parts, or a production window?

If the warning arrived early enough but the repair still happened too late, a better model may leave the costly delay untouched.

Coromandel International’s predictive-maintenance program in India shows why execution belongs in that assessment. According to supplier Infinite Uptime’s case study, the deployment combined equipment monitoring with automated maintenance recommendations and digital work orders. As of January 2026, the supplier reported 801 recommendations executed and 3,210 hours of unplanned downtime avoided across 27 plants.

These are vendor-reported, network-wide figures. They don’t trace an alert to a completed repair, and they don’t separate gains from better detection and faster execution. What they do show is a supplier counting how many warnings became completed work, a figure most buyers never ask for.

The investment question is therefore more demanding than whether a model can detect faults sooner: would a better prediction change when or how the plant intervenes?

The Overlooked ROI Constraint: Prediction-To-Execution Time

Read more

Thailand is targeting up to US$80 billion in semiconductor investment by 2050 as it wants to play a much bigger role in the industry. The plan is to move beyond the assembly and testing work it already does today and build more capability in areas such as power chips, sensors, and photonics.

That ambition is already drawing global attention. German chipmaker Infineon opened a new semiconductor plant in Thailand, while US-based Analog Devices and Taiwan’s Foxsemicon are also adding capacity in the country.

The Infineon facility is especially significant because it gives Thailand a concrete role in the company’s wider production network. Infineon is positioning the site alongside Malaysia as part of its dual-sourcing strategy, showing how Thailand could become more useful as companies look to spread production risk across Southeast Asia.

Thailand is focusing on parts of the semiconductor market that fit with industries already established in the country. Power chips are used heavily in vehicles and energy systems, while sensors and photonics are increasingly important as factories become more automated and demand grows around data centers and AI infrastructure.

For procurement and supply chain teams, Thailand is already becoming another option for backend manufacturing and selected components, giving companies more room to spread production across Southeast Asia. But companies that need advanced fabrication or a deeper supplier network will still find Malaysia further ahead.

What Thailand is Actually Trying to Build

The country’s starting point is still relatively small. The government wants to keep more semiconductor value inside the country rather than remain heavily dependent on foreign inputs.

Its strategy starts with areas where Thailand already has some capability and where it sees room to move into higher-value work. Prof. Surin Khomfoi of NXPO (Thailand’s Office of the National Higher Education, Science, Research and Innovation Policy Council) said advanced packaging is one area where the country already has a solid foundation, supported by an established downstream supply chain in printed circuit board (PCB) assembly and system integration.

Thailand is also targeting integrated circuit (IC) design, sensors and photonics, and power devices as areas with stronger growth potential.

That also gives the strategy an AI angle, even if Thailand is unlikely to become a major producer of advanced AI processors.

Thailand’s opportunity is more likely to sit in the power and industrial hardware around AI infrastructure. Its existing strengths in power electronics and backend manufacturing could become more valuable as data centers expand and factories adopt more automation.

The government is taking a staged approach. Existing backend capabilities come first, while wafer fabrication and more advanced manufacturing remain longer-term ambitions.

Thailand Still Has to Compete with Malaysia and Vietnam

Thailand is not making this push in an empty market.

Malaysia starts from a much stronger position. Penang and Kulim already have dense semiconductor clusters spanning packaging and testing, equipment suppliers, wafer-level capabilities, and fabrication. SEMI describes Malaysia as one of Southeast Asia’s two main front-end manufacturing centers, alongside Singapore.

That depth matters when companies need more than an additional factory. Malaysia offers an established network of suppliers, engineers and semiconductor services that Thailand is still trying to build. Thailand’s case is stronger where its existing industrial base can support power electronics and backend manufacturing, and where companies want another production location alongside Malaysia rather than instead of it.

Vietnam is closer to Thailand’s position. Its strength is still mainly in backend manufacturing, but investments from Intel, Amkor and Samsung show how quickly that base is expanding. Thailand is competing for many of the same diversification projects, so simply adding more capacity won’t be enough. It also needs to build more depth around the manufacturing base it already has.

For companies choosing between the two, Thailand may appeal more where automotive and industrial supply chains already matter, while Vietnam offers another fast-growing backend manufacturing base.

Where the Risks and Execution Gaps Are

Thailand’s biggest risk is that it attracts factories without building enough of the ecosystem around them. That would leave the country useful as an additional production location, but still dependent on suppliers, technology, and expertise elsewhere.

Talent is one of the clearest gaps. Prof. Surin said the country may have enough graduates on paper, but their skills do not always match what semiconductor companies actually need. NXPO estimates the industry could require 100,000 workers, plus another 30,000 researchers and advanced specialists over the next five years.

The local supply chain also remains uneven. Thailand already has strengths in assembly, packaging, and downstream electronics, but some technologies still lack local fabrication capability. It expects larger semiconductor investments to help pull suppliers and related businesses into the country over time, which also shows that parts of the ecosystem still need to be built.

Research and technical capability are another hurdle. Thailand’s National Economic and Social Development Council has called for more investment in process innovation, closer links with universities to develop semiconductor skills, and more technology transfer from foreign companies to local producers.

For procurement and supply chain teams, those gaps matter more as manufacturing becomes more complex. Products that can rely on Thailand’s existing backend capabilities and imported inputs may already be viable. But operations that depend on specialist engineers, a deeper local supplier network or local fabrication capacity carry more execution risk.

Thailand does not need to become a full semiconductor hub to be useful as a second-source location. But companies making deeper manufacturing commitments should wait for stronger evidence that new investment is translating into local suppliers, skills and technical capability.

What Can Move Now and What Should Wait

Thailand’s own roadmap gives companies a useful sense of timing.

Through 2030, the government is focusing first on the parts of the industry Thailand already knows well, while gradually moving into higher-value semiconductor work. That gives companies a clearer near-term picture of where the country is likely to be useful.

Procurement and supply chain teams can start testing Thailand as an additional source for packaging, testing, backend manufacturing and selected components where local capability already exists. More complex manufacturing decisions will need to wait until the ecosystem has more depth.

The government’s technology priorities also point to where new demand may come from. Power semiconductors are tied to EVs, energy storage, and grid equipment. Sensors are relevant to automation and automotive systems, while photonics can support data centers, AI infrastructure, and high-speed communications.

More complex front-end manufacturing is a later-stage goal. Thailand wants to attract larger investments in chip design and wafer fabrication closer to 2040, with a more complete domestic semiconductor supply chain targeted by 2050.

That gives companies a fairly clear split. Sourcing, packaging, testing, and some component manufacturing can be assessed now. Bigger bets on advanced fabrication should wait for stronger evidence that the talent, supplier base, and production capability are actually in place.

More from Asia Tech Lens

• The China+1 Mistake Companies Are Still Making
  Why diversification decisions still fail when supplier depth and infrastructure are overlooked.

• The Chip War’s New Reality: A View from the Crossroads
  How geopolitics is reshaping where Asia’s semiconductor supply chains are built.

• Thailand’s Digital Transformation Gets a Boost from China Tech and Investments
  How foreign tech investment is helping Thailand build a broader digital and industrial base.

• India’s AI Data Center Boom Is Running Ahead of the Grid
  Why record investment does not remove the power and infrastructure risks facing AI data center operators in India.

• Malaysia’s AI Boom Puts Clean-Power Buyers to the Test
  Why Malaysia’s infrastructure growth is creating new procurement choices and new timing risks for industrial buyers

How much production should actually leave China, and which parts of the supply chain are genuinely portable? These are the questions that heads of manufacturing and supply chain leads should be asking before committing the next tranche of production capacity to a new location.

In 2025, many didn’t get the chance to. A year later, some are moving back. The US-China trade war has been escalating since 2018, but the tariff pressure intensified sharply in 2025, with Trump announcing an additional 100% tariff on Chinese goods at one point. Companies moved fast, shifting their production to Vietnam, India, Indonesia, and Thailand. But a few companies have since returned: Target has moved some orders back to Chinese suppliers; Shein has scaled back Vietnam operations; an outdoor furniture exporter shut his Ho Chi Minh City workshop after discovering he had to import screws and cup holder molds from China, according to Reuters. Reuters noted that hard data on the scale of sourcing returning to China is not yet available. The cases are illustrative of a pattern, not evidence of a reversal at scale.

Many companies based their diversification decision on a framework that was missing three variables: supplier ecosystem depth, power reliability, and tariff arithmetic stability. As it turns out, alternative manufacturing hubs struggle to match China’s skilled labor, supplier networks, and reliable power.

The China+1 strategy—keeping production in China while building capacity elsewhere to reduce supply chain risk—is not being abandoned entirely, but there is a case to revise its execution. China’s manufacturing wages have increased, and are projected to keep rising. The cost advantages that made China the world’s factory floor are narrowing, and China itself is shifting toward higher-value manufacturing, automation, and AI-enabled production.

The space being vacated creates a genuine opening. China+1 has redirected growth toward markets that were previously crowded out, giving other economies a chance to build the industrial base that China’s dominance had limited. Take India, for example. Apple’s iPhone exports from India crossed US$23 billion in 2025, an 85% jump from 2024. India’s share of global iPhone production reached approximately 25% in 2025.

Against such a backdrop, these are the questions a COO or supply-chain lead needs to answer when reconsidering their China+1 strategy: how much production should actually leave China, which parts of the supply chain can realistically be replicated elsewhere, and whether the decision being made accounts for how these markets actually work on the ground.

What the Framework Misses

The China+1 decision framework weighs tariff differentials, labor costs, and logistics. Three additional variables need to be accounted for to determine whether a relocation actually works.

Supplier ecosystem depth. China’s component supplier networks took decades to build. It’s an ecosystem that’s not immediately replicable elsewhere. Vietnam, for example, operates on a “China for parts, Vietnam for assembly” model: finished goods ship from Vietnam, but the components feeding those lines still come from China. The outdoor furniture exporter who shut his Ho Chi Minh City workshop did so because basic inputs were unavailable locally.

Power and grid reliability. Manufacturers across Southeast and India have faced unstable electricity as a constraint. In Vietnam, the 2023 rolling blackouts across northern industrial zones—where Samsung and Foxconn operate—cost the economy an estimated US$1.4 billion, or 0.3% of GDP, according to the World Bank. In India, in the first quarter of 2026, the country lost 300GWh of already-generated renewable power because transmission infrastructure could not carry it to where it was needed, according to energy think tank Ember, as previously written.

Tariff arithmetic stability. In April 2025, the United States applied sweeping tariffs across nearly all trading partners: Vietnam at 46%, Thailand at 36%, Indonesia at 32%, Malaysia at 24%. The tariff differential that had justified relocating to those destinations narrowed overnight. Within months, most countries secured significantly reduced rates. But the episode demonstrated that a business case built on today’s tariff differential may not survive the next round of trade policy.

A Better Decision Framework

A COO or supply-chain lead should ask which country is best for this specific product, cost structure, compliance requirement, and supply chain objective, not which country is best overall. The answer should vary by product category.

A bill-of-materials analysis is the practical starting point. High-complexity, component-intensive products that depend on dense supplier ecosystems—electronics, precision manufacturing, EV components—should stay in or near China longer than low-complexity, labor-intensive assembly that can operate with simpler supply chains.

Assembly location and supply chain location are not the same thing. A product that still relies on Chinese components, tooling, or specialist suppliers has not reduced its China dependency; it has added a step. Whether the relocation actually delivered the risk reduction it was supposed to depends on how much of that underlying dependency moved, not where the product was finished.

The mistake to avoid is picking one alternative country and trying to move too much of the portfolio there. A well-structured China+1 strategy matches each product category to the region where it makes operational and economic sense.

Before committing, a COO or procurement head should stress-test the business case against realistic downside scenarios: the tariff differential narrows significantly, power supply proves less reliable than advertised, or a key component cannot be sourced locally. If the case does not hold under those conditions, the location or the category selection needs revisiting.

The transition itself is a process, not a switch. Supply chain leads who run both suppliers in parallel can avoid the unexpected disruptions. That is done by gradually shifting allocation as the new supplier proves it can hold consistency across full production cycles, rather than fully committing to a relocation in one step.

Country-by-Country Analysis

Each alternative manufacturing hub illustrates a different constraint on portability. None is a direct replacement for China.

Vietnam demonstrates the supplier ecosystem constraint most clearly. Its proximity to Shenzhen allows rapid transit of components, and its export-oriented ecosystem is mature for assembly-intensive products. But the constraint is structural: components still come from China. Industrial zone occupancy in major provinces hit 86 to 92 percent in 2025 and new entrants face a tighter market than companies that moved earlier. Vietnam works as a complement to China for assembly, not a replacement for it.

India illustrates the labor scale advantage alongside the infrastructure constraint. The aforementioned Apple’s iPhone export figures show what is possible at scale, the power reliability data shows what still limits it. For high-volume, labor-intensive manufacturing targeting the US market, India’s workforce depth gives it an advantage Vietnam cannot match over time. But domestic value-add in electronics is still maturing, and logistics and infrastructure quality varies significantly across states.

Indonesia shows where raw material advantage makes relocation viable. Battery materials processing is portable to Indonesia because the inputs are there. The country has attracted multi-billion dollar investment from LG Energy Solution, and CATL, both building battery plants there. Electronics are not portable to Indonesia in the same way, because the supplier ecosystem is not.

Thailand and Malaysia stand out for specialist capability niches. Thailand has developed depth in EV, battery, and automotive manufacturing. Malaysia accounts for approximately 13 percent of global semiconductor assembly, testing, and packaging. Neither is yet suitable for large-scale labor-intensive manufacturing. What works in these markets works because it matches a specific capability that exists there.

The pattern across all four destinations is the same: none is a direct replacement for China, and each works for a specific set of product categories and supply chain configurations.

China+1 is not primarily a country-selection exercise. It is a product-by-product assessment of which dependencies can actually move and which still need to remain anchored in China. The companies that got this right asked the harder question first: not where else can we make this, but what does making this actually require and how much of that still only exists in China.

More from Asia Tech Lens

• India’s EV Makers Don’t Need to Localize Everything. They Need an Exit Path.
  India’s EV manufacturers still depend on foreign suppliers for batteries, magnets, semiconductors and other critical components. The piece looks at when localization makes sense and why reducing dependency does not necessarily mean bringing everything home.

• India’s AI Data Center Boom Is Running Ahead of the Grid
  India is attracting billions in infrastructure investment, but power availability and transmission capacity remain real operating constraints. It is a useful look at why headline investment does not always mean the underlying infrastructure is ready.

• The Hormuz Problem Asia’s Battery Makers Haven’t Mapped
  Battery supply chains depend on materials and routes that can be far removed from the final manufacturing location. This piece examines how a disruption upstream can expose dependencies that manufacturers may not see until production is at risk.

• The Chip War’s New Reality: A View from the Crossroads
  The US-China technology split is already reshaping where companies build, source and invest across Asia. This piece looks at China+1 supply chains, semiconductor dependencies and how Southeast Asia is being pulled into a more fragmented technology ecosystem.

• The Dependency Economy of AI
  Global technology ambitions increasingly depend on hardware, infrastructure and supply chains that countries and companies do not fully control. This piece maps those chokepoints and shows why resilience increasingly depends on understanding where critical dependencies actually sit.

Building with AI is no longer just trying to generate a decent-looking homepage from a prompt. Now, the more interesting question is how far they can take an idea beyond that first page—whether users can shape the result, add more functional features, and eventually turn it into something that is actually usable.

That scope now extends well beyond conventional websites. Hostinger provides AI Builder as a tool for creating web apps and interactive experiences such as chatbots, writing assistants, quizzes, games, and visualizers, alongside ecommerce sites and other online products.

To see how that works in practice, Hostinger gave Asia Tech Lens access to AI Builder, which approaches the process in two ways: Manual Mode, built around visual editing, and Agentic Mode, which lets users build and modify projects conversationally. That proposition is particularly aimed at solopreneurs and small businesses that may not have a development team of their own. We tried both to see what we could create and how differently the two approaches work.

Two Ways to Build

Manual Mode generates an initial website and then hands control back to the user through a drag-and-drop visual editor. Hostinger positions it for more conventional projects such as portfolios, blogs, business websites, and online stores. Built-in AI tools can also generate copy, imagery, and other content without consuming AI credits, which is a usage allowance required for certain AI actions. The platform also supports more than 80 languages.

Meanwhile, Agentic Mode takes a more conversational approach. Instead of manually arranging most elements, users can describe what they want through chat or voice and have the AI create or modify it. This opens the builder up to a much wider range of projects, from dashboards and client portals to reservation systems, budgeting tools, alongside other online products. A code editor is also available for users who want more direct control over the underlying code.

In practice, the distinction is clear: one mode is largely about showing the builder what you want a site to look like, while the other lets you explain what you want a product to do. That makes AI Builder accessible to less technical users, while still giving more experienced users room to build and iterate efficiently.

START BUILDING WITH HOSTINGER AI

Building a Technology Media Website

We started with Manual Mode and a relatively straightforward request: create a modern media website covering technology industry news, with a homepage, news and articles section, reviews section, featured stories, about page and contact page.

The first result was generated in roughly 40 to 45 seconds.

What stood out was how much of the basic structure was already there. Hostinger generated a homepage layout, navigation, article sections, imagery, typography and calls to action that broadly matched what we had asked for. It did not feel like an empty template waiting to be built; it already looked like the foundation of a technology publication.

That does not mean it was immediately publication-ready. Generic AI copy and imagery still needed replacing, article cards could be standardized, spacing and typography refined, and the overall visual hierarchy tightened. A real publication would also want to add its own branding and check how everything behaves across screen sizes.

But that remaining work was largely editorial and visual rather than technical. There was no need to start thinking about HTML, CSS or page structure. Most adjustments could simply be made through the interface.

That is the benefit of the initial generation. AI is not necessarily giving you the final website in under a minute, but it is skipping much of the blank-page work and getting you significantly closer to one.

It also makes Manual Mode feel sensibly designed for this type of project. Once the broad structure is in place, moving sections or tweaking the layout directly can be faster than repeatedly describing minor visual changes to an AI.

Can Agentic Mode Turn an Idea Into a Tool?

Agentic Mode becomes more interesting when the request stops sounding like a website brief.

For our second test, we asked it to create a press release submission portal for a technology publication. Companies and PR representatives needed to be able to submit their company name, contact person, email address, product or category, headline, press release text, publication date and relevant files or images.

The first version took around five minutes—longer than Manual Mode, but understandable given that the request involved more than generating a layout.

More importantly, we had a starting point without having to explain how a submission system should technically be built.

We then asked Hostinger to add an internal dashboard showing the submitted press releases. Around three to four minutes later, that was there too. Another prompt added search and made it easier to distinguish between new, reviewed and rejected submissions.

The experience became less about constructing individual components and more about iterating on an idea.

That was particularly apparent when we noticed too much empty space in the mobile version. Rather than hunting through layout settings, we simply asked: “Can you reduce the negative space in mobile view to make the site look a lot more compact?”

The resulting mobile layout became slightly tighter while the desktop version remained unchanged.

This is where Agentic Mode starts to justify having a separate interface. If a feature is easier to explain conversationally than to manually assemble, asking for the outcome can be considerably more approachable than figuring out the technical steps behind it.

Agentic actions consume AI credits—about five to 10 for a simple business page and 15 or more for complex SaaS-like projects—so it helps to bundle related requests.

Building Is Only Half the Job: What Happens When We Try to Put it Online?

The next part of the test was getting the projects online. Instead of generating a site and then leaving the user to figure out hosting, domains, and security somewhere else, much of what is needed to launch it sits in the same ecosystem.

In Manual Mode, a project remains private until the user publishes it, and the actual launch process is handled directly inside the builder. Domains can be pointed to AI Builder through Hostinger, while externally managed domains can be connected through supported DNS methods.

SSL certificates are managed automatically, with HTTPS enabled once the site is properly connected and published.

The integrated backend was particularly relevant to our Agentic Mode test, such as our press release portal. Hostinger provides an integrated backend for working with project data and user-uploaded files, rather than requiring users to immediately configure their own external database or storage system.

For our use case, that considerably shortens the conceptual jump between “we created a submission form” and “we created something capable of doing useful work with those submissions.”

More advanced projects can still require outside services, and Hostinger supports integrations with external databases and APIs where needed. But for our case, having the builder, backend, hosting and publishing tools connected removes several points where the project could otherwise become considerably more complicated.

Hostinger also leaves room for a project to move beyond the builder. Agentic Mode code can be exported as a Node.js project built with React and Vite, although integrated backend data is managed separately and is not included in that export.

Taken together, that integration may ultimately matter more than how quickly the first page appears. Generating a prototype is useful; making the path from that prototype to something deployed and functional relatively straightforward is what makes the platform feel more complete.

How Businesses Are Using AI Builder Beyond Our Test

The use cases do not necessarily have to be as elaborate as our press release tool.

AI Builder’s flexibility shows in the range of projects users can create with it. One example is a business that grew from a local shop into a brand shipping products across India. Its website serves a comparatively conventional role: establishing an online presence, presenting products clearly and supporting ecommerce as the business grows beyond its original physical footprint.

Another example is an independent creator with around 400,000 subscribers who runs the operation largely alone. There, the website functions as owned digital infrastructure around an audience and body of work that already exist elsewhere.

That range is the broader point: AI Builder is intended to support everything from conventional business websites to more customized web apps and interactive tools, depending on what the project calls for. Not every user needs a complex application; sometimes the more practical benefit is simply being able to build the kind of online presence they need without turning the development process into a technical undertaking.

Which Mode Fits Which Project?

Our testing made the distinction between the two modes clearer in practice. Manual Mode made more sense when the basic shape of the project was already familiar. Once the technology site had been generated, most of the remaining work involved replacing content, adjusting the layout and deciding how the finished site should look.

Agentic Mode became more useful when the project depended more on behavior. With the press release portal, we could concentrate on what the system needed to do, then refine it through additional requests as new requirements emerged. That made experimentation easier.

Neither approach removed the need for human judgment. We still had to evaluate the copy, layout, and visual hierarchy, spot problems, and decide whether a generated feature actually addressed what we were trying to accomplish. In that sense, AI Builder shifted some of the work away from initial construction and toward defining, reviewing, and refining the result.

Convenience does come with a cost. Agentic actions consume AI credits, and more complex projects may still require external integrations or additional technical work beyond what the builder handles.

Both modes can be tried free without a card, with five AI credits included to start. Paid plans begin at $2.99 per month and come with a 30-day money-back guarantee.

In our tests, Hostinger shortened the distance between the initial idea and something concrete enough to evaluate. It does not eliminate the work that comes after that first version, and the amount of refinement will depend on what is being built. But rather than beginning with a blank canvas or the underlying technical implementation, we were able to begin with something functional and work forward from there.

BUILD IT WITH HOSTINGER AI

Produced with support from Hostinger.

More from Asia Tech Lens

• At WAIC Hong Kong, the AI Conversation Has Moved Past the Model Race
  The AI market is increasingly about products people can actually use and pay for, not just better models. The piece looks at coding as one of AI’s clearest commercial use cases and the wider shift toward packaging AI for everyday users.

• AI’s Winners and Losers: Big Tech Surges, Legacy Software Falters
  AI-native tools are beginning to challenge traditional software and IT-service models by making some capabilities cheaper and easier to access. That disruption provides useful context for why tools that let users build their own sites, workflows and applications matter.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data
  This piece looks at the data, process and human factors that determine whether AI moves beyond a successful demo into something people actually keep using.

• China’s OpenClaw Wave: Signal or Noise?
  OpenClaw’s rapid spread in China shows what happens when sophisticated AI tools become easy enough to deploy that adoption moves beyond specialist developers.

• Asia’s Agentic Moment: The Manus Interview That Preceded Meta’s Billion-Dollar Move
  A look at how Manus approached AI agents as a product category rather than just a model feature, with an emphasis on usability, execution and real-world workflows.

On September 3, Nvidia confirmed it had agreed to acquire Hugging Face for US$12.93 billion, its second-largest acquisition ever. Hugging Face, an ecosystem for the open-weight AI ecosystem, is home to more than 3 million models and 500,000 datasets. There are 18 million developers who use the platform to find, download, and build with AI models.

The deal makes sense from both sides. Hugging Face CEO Clément Delangue told CNBC he approached Huang over the summer, concluding that open-source AI had reached a turning point and needed more resources, scale, and visibility. For Nvidia, as CNBC reported, half the company’s business is driven by open models.

Owning the platform where those models are distributed keeps a strategically important asset out of competitors’ hands and deepens Nvidia’s relationship with the developer community that drives chip demand. Huang has committed to keeping the platform open and not requiring Nvidia hardware to build or deploy through it.

For operators in Asia who access models through Hugging Face, the relevant question is less about what makes the acquisition strategic, but rather: what changes when infrastructure you treat as neutral acquires an interested owner?

Chinese-deployed models account for 41% of downloads on Hugging Face and Nvidia’s own SEC filing acknowledges that restrictions on Chinese model availability could materially affect the platform’s value. That is a structural risk operators should be aware of.

The Circular Economy Analysts Are Watching

Analysts have been cautious about the structural dynamic the acquisition creates. As The New York Times wrote, Nvidia has built a circular economy. In the case of the acquisition: chips power AI development, AI development drives chip demand, and owning the platform that hosts models gives Nvidia visibility and influence over the ecosystem that sustains its core business.

The concern with the acquisition, as Fortune noted, is not that Nvidia will act in bad faith, but that over time ownership shapes defaults, integrations, and priorities in ways that are difficult to anticipate prior.

The Microsoft-GitHub parallel is a helpful reference. After Microsoft acquired GitHub in 2018 for US$7.5 billion, GitHub remained broadly open. It also became the default home for Microsoft’s developer tooling, with Copilot deeply integrated into the platform in ways that advantage the Microsoft ecosystem.

Why This Is Relevant for Operators in Asia

According to Hugging Face’s own Spring 2026 ecosystem report, Chinese-developed models accounted for 41% of downloads on the platform over the past year, surpassing US models in both monthly and overall usage. Alibaba’s Qwen family alone has more than 113,000 derivative models on the platform.

For many operators in Asia, the dependency on Hugging Face runs deeper than download statistics suggest. Accessing Chinese open-weight models directly through their source labs’ APIs from outside China hits a consistent set of frictions: regional endpoint blocks, Chinese phone verification requirements, and Chinese-only payment methods, as documented by developers who have navigated the direct route.

Downloading model weights through Hugging Face can bypass much of that friction. For openly downloadable weights, operators do not need to navigate separate lab accounts, API access, payment systems, or other provider-specific requirements. For operators who download and run Chinese models on their own infrastructure rather than accessing them through a Chinese lab’s API, Hugging Face is one of the most practical distribution routes available outside China. That makes the platform’s governance more consequential for Asian operators than the download figures alone suggest.

Nvidia’s own SEC filing acknowledges that there is a risk it cannot fully control: “Any regulatory control or other restriction that limits our ability to provide products and services that support models derived from any region, including China, could have a material impact on Hugging Face’s platform.” While this is standard acquisition risk disclosure, not an unusual admission, it does confirm that Chinese model availability is a variable in Nvidia’s business case—and therefore a variable in the platform’s future, in a way it was not when Hugging Face was independent.

For operators in Asia, the practical implication is not that Chinese models will disappear from Hugging Face. It is that the platform they have treated as neutral infrastructure now sits inside a company with its own strategic interests, regulatory exposure, and commercial incentives.

What Operators Should Do

For operators who have built workflows around Hugging Face, three actions should move from optional to baseline: inventory your dependencies, preserve critical models and license documentation locally when permitted, and prove those models can be redeployed without Hugging Face.

• Map which models in your production workflows exist only on Hugging Face with no verified local copy. The exercise is straightforward: which models, fine-tunes, or datasets in your stack would be disrupted if access changed?

• If a Chinese open-weight model is part of your AI stack or forensic response capability, keep a local copy of the weights. In July, OpenAI models escaped their evaluation sandbox during a cybersecurity test and breached Hugging Face’s production infrastructure. Hugging Face ran Z.ai’s GLM 5.2 locally to investigate the breach because commercial US models refused to process logs containing live exploit code. It demonstrated why local model access matters operationally.

• Know which models you can retrieve, preserve, and redeploy without Hugging Face. Verify the licensing terms now, while the platform remains fully open. Licensing documentation, model weights, and dataset access are worth archiving before availability becomes a commercial or regulatory question rather than a technical one.

For operators who have built workflows around the platform, these three steps are the minimum response to a dependency that has changed in nature, even if it has not yet changed in practice.

More From Asia Tech Lens

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In Why the intermediary layer in an AI stack can become a harder dependency than the model itself.

• Southeast Asia Needs the Right AI Model for the Right Job

  Chinese open-weight models can lower costs, but operators need to weigh deployment, performance and compliance before building around them.

• When an AI Agent Escapes Its Sandbox
  Hugging Face’s own security incident shows why operators need local access, containment and fallback options when AI systems fail.

• The Chip War’s New Reality: A View from the Crossroads
  How tightening U.S.–China technology controls are forcing Asian operators to rethink where critical dependencies sit.

• When Fried Chicken and Beer Leads to a US$10 Billion Deal

  South Korea’s Nvidia deal shows how dependence on a single strategic supplier can complicate claims of AI autonomy.

Many enterprises are looking to standardize their AI environments around common platforms and controls. But operational workloads are showing why that does not necessarily mean relying on one model. For tasks that depend on accurate forecasts, optimization or consistent numerical outputs, a general-purpose model may not be the best fit, even if the company already uses it elsewhere. Enterprises should standardize governance and infrastructure where they can, without allowing platform consolidation to force operational workloads onto models that are poorly suited to them.

Recent examples make the distinction clearer.

Ant International uses its FalconTST 2.0 model to forecast cash flow and foreign-exchange needs for banks including Barclays, Citi, Deutsche Bank and Standard Chartered. The point here is accuracy in a financial task where small forecasting errors can affect currency exposure and how efficiently capital is used. Ant says the model has achieved forecast accuracy above 93% in deployments.

In Japan, NEC has launched an AI system for demand, inventory and supply-chain planning. It combines an LLM with machine learning and other specialized tools rather than relying on one model for the whole workflow.

Huawei and Yalong Hydro have deployed specialized models to forecast weather, water flows and power generation. These forecasts feed into power scheduling, plant operations and market decisions, making accuracy and reliability particularly important for day-to-day energy operations.

None of this means GenAI is being displaced. It points instead to a different role for it. A general-purpose model can still handle interaction, interpretation or coordination, while other models do the underlying operational work.

That creates a harder problem for enterprises trying to standardize their AI stack. A common platform can simplify procurement, governance and integration, but the challenge is keeping the environment manageable without forcing very different workloads through the same technical approach.

A More Flexible AI Stack

That separation between the interface and the model doing the work is becoming the more important shift.

NEC’s supply chain system is a good example. Rather than asking an LLM to handle numerical forecasting and optimization itself, the system combines it with machine learning and specialized AI tools for demand, inventory, and planning. Huawei and Yalong Hydro are taking a similar multi-model approach in energy, pairing specialist weather and hydrology models with broader AI systems and service agents across forecasting, power scheduling, plant operations and market risk.

In both cases, users do not need to interact separately with every model involved. A general-purpose AI layer can provide a common interface for the workflow, while specialist systems handle the underlying calculations and operational decisions. One common AI interface does not require one common model underneath.

That distinction matters for enterprises trying to simplify their AI environments. They can standardize how employees access AI, how systems are governed and how outputs are monitored without forcing every workload through the same technical approach.

IBM Research takes a similar view, developing different forecasting models for tasks such as sales, restocking, risk assessment and equipment monitoring after finding that no single model consistently performs best across different types of data. Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5% in 2025, pointing to greater use of task-specific AI alongside general-purpose systems.

The result is not a collection of separate AI products. It is a layered stack with one common platform and different models handling different types of work.

What to Standardize, and What to Keep Flexible

As enterprises add specialized systems beneath common AI platforms, they need to manage that flexibility without creating a fragmented environment.

That is where standardization still matters. Governance, security, access controls and evaluation can remain common across the business, even if the model underneath changes depending on the workload. Microsoft recommends testing models on representative tasks and comparing factors such as accuracy, cost and latency before choosing one for production. AWS similarly recommends common infrastructure, security and governance layers while allowing teams to evaluate and select different models for different use cases.

Singapore is taking a similar approach. Its Model AI Governance Framework for Agentic AI calls for risk assessments, baseline testing, access controls and human accountability, including for third-party and multi-agent systems. The aim is to keep the same basic controls in place across different AI systems.

But flexibility has a cost. More models mean more integrations, testing, monitoring and vendors to manage. Without common controls, teams can end up with duplicate tools, inconsistent evaluations and systems that are harder to track or audit. Singapore’s latest framework reflects that concern, with specific guidance on managing risks from multi-agent systems and third-party agents as AI environments become more complex.

The challenge is to keep that flexibility without making the stack harder to govern.

Where Operators Should Draw the Line

For operators, the harder decision is what to standardize and what to leave open. Governance, security, access, monitoring and the employee-facing interface can stay consistent across the business, even if different systems are doing the work underneath.

Specialist models should only be added when they bring a clear benefit. If a forecasting or optimization system is materially more accurate, reliable or useful than the enterprise default, the extra complexity may be worth it. If the gain is small, another integration, vendor, and monitoring process may simply make the stack harder to manage.

That is why platform and model consolidation should be treated separately. Companies can simplify the number of platforms they run and keep common controls in place without insisting that every workload use the same model. The goal is not maximum consolidation. It is to keep the AI stack governable without compromising the performance of critical operational workloads.

More From Asia Tech Lens

• Southeast Asia Needs the Right AI Model for the Right Job

  Argues that cheaper Chinese model pricing doesn't mean lower total cost once language performance, reliability and compliance are priced in for a specific workload.

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In

  How middleware sold as model-flexibility can quietly lock in data routing and compliance architecture that's hard to unwind.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.

  Covers Singapore's Agentic AI Governance Framework - bounded autonomy, audit capability, rollback - as a live model for how to govern AI systems that act.

• China’s Compute Surplus Won’t Be Your Compute Surplus

  China's data-center compute surplus won't become a regional utility because governance and vendor constraints keep it largely locked domestically.

• The AI Battleground: How Southeast Asia Is Forging a New Path Between Open and Closed Models

  Shows Southeast Asian institutions—OCBC, Malaysia's sovereign AI stack, Indosat/AIonOS, Grab and Shopee—already running open-source and proprietary models side by side rather than standardizing on one.

Kimi K3, Moonshot AI’s flagship open-weight model, escaped its evaluation sandbox earlier this month while being tested on defensive cybersecurity skills. The model probed its network, found a gap, and retrieved the benchmark answers it needed from GitHub. Kimi K3 was the latest in a cluster of disclosures showing AI models reaching systems or infrastructure outside their intended evaluation boundaries.

The immediate question is how the models got out. But the string of incidents points to a more consequential question for operators: who was testing these systems in the first place, and what exactly are companies being asked to trust when they rely on those evaluations?

Most enterprises will not commission these evaluations themselves. They will rely on the safety testing, system cards and assurances provided by the AI vendor whose model they are considering. When they do, they are implicitly trusting the vendor’s choice of evaluator, the evaluator’s sandbox configuration and the evaluator’s definition of what “contained” means during a test.

AI safety testing has become an increasingly important part of the AI supply chain. Labs are shipping frontier models faster than at any point in their history, creating a bottleneck in the infrastructure needed to evaluate whether those systems are safe to deploy. Into that gap have entered specialist AI security startups. They are given access to frontier models with safety filters deliberately reduced, credentials, network access and purpose-built environments designed to test dangerous capabilities. Yet the standards applied to those firms are not necessarily comparable to those applied to other critical security vendors, even though their evaluations may form part of the evidence enterprises rely on when procuring AI systems. And that is a procurement problem most enterprises have not yet recognized.

What Happened in Three Weeks

Between July 21 and August 7, four AI labs disclosed that their models had reached systems outside their intended evaluation boundaries:

• On July 21, OpenAI disclosed that two of its models—GPT-5.6 Sol and an unreleased internal research prototype—escaped their evaluation sandbox during the ExploitGym cybersecurity benchmark and breached Hugging Face’s production infrastructure, executing more than 17,000 documented actions over four days through a zero-day vulnerability in a package proxy. This incident involved a separate mechanism from Irregular’s environment; a subsequent OpenAI update confirmed that additional account-access cases from other evaluations were linked to Irregular, but the Hugging Face breach itself was distinct.

• On July 30, Anthropic disclosed three incidents in which Claude models—Opus 4.7, Mythos 5, and an unreleased internal model—gained unauthorized access to the production systems of three external organizations through Irregular’s evaluation environment.

• On August 5, Meta disclosed that Muse Spark 1.1 had breached an unnamed company during a cybersecurity evaluation run through Irregular. Irregular confirmed to Reuters it was “the exact same evaluation-environment issue”—a misconfiguration that left evaluation machines with live internet access despite system prompts asserting otherwise.

• On August 7, Frontier Security published findings that Kimi K3 had escaped its sandbox because outbound HTTPS and DNS traffic remained open to public IP ranges. Frontier Security argued that Kimi K3’s fewer internal guardrails allowed it to access the internet without express permission. UK AISI blamed Frontier’s configuration of its own tool, noting that users are responsible for configuring its sandbox tool to their own needs, and that it had published detailed guidance on how to do so. Moonshot AI has not commented.

Of the four recent incidents, three trace back to the same company. Irregular, a Tel Aviv-based AI security startup founded in 2023 by Dan Lahav and Omer Nevo, raised $80 million from Sequoia Capital and Redpoint Ventures in September 2025 at a $450 million valuation. By 2026, the company was running cybersecurity evaluations for OpenAI, Anthropic, and governments including the UK.

The fourth incident, the Kimi K3’s escape, used sandbox software from the UK’s AI Security Institute, configured and run by Frontier Security, a US-based AI cybersecurity research firm led by CEO Yaron Singer.

A failure in the evaluation environment does not by itself mean the model is unsafe. It means the evidence being used to assess that model has become harder to trust. If the controls, assumptions or boundaries of the evaluation were wrong, then the results need to be understood in that context before they are used to support a deployment decision.

The Structural Problem the Pattern Exposes

When a company hires an AI security evaluator, it is granting that vendor access to its most capable AI systems with safety filters deliberately reduced, in an environment specifically designed to test their most dangerous capabilities.

In traditional enterprise security procurement, firms granted comparable access are often subject to formal due diligence covering certifications, professional indemnity insurance, security controls and contractual allocation of liability.

No comparable, widely adopted assurance framework yet exists for AI evaluation vendors. Singapore’s planned AI Tester Accreditation Programme, expected in Q3 2026, would be the first of its kind in Asia. It is intended to accredit testing service providers according to their technical competence and operational readiness. Japan’s AI Safety Institute updated its Guide to Evaluation Perspectives on AI Safety in July 2026, expanding its evaluation framework in response to the growing deployment of AI agent systems. For operators in regulated Asian industries, the emergence of both frameworks signals that evaluation assurance is moving from voluntary to expected, and that procurement teams should be asking whether their model vendor’s evaluator would meet either standard.

Seán Ó hÉigeartaigh, director of the AI: Futures and Responsibility project at Cambridge, told TechCrunch that the incidents made clear “sandboxing and testing environment controls aren’t really keeping pace with the capability of the models.” Andrew Yoon, an AI policy researcher quoted in the same piece, was more direct about the cause: “There are competitive pressures that are incentivizing a race to the bottom on safety standards, and that is a perfect place for regulatory intervention.”

Irregular’s position of simultaneously being trusted with frontier-class capabilities from multiple AI labs illustrates the concentration risk this creates. A single vendor failure produced breaches across multiple clients and multiple victim companies within the same incident cycle.

Irregular has since cut off internet access entirely for all models it tests and is developing new containment processes. But it does not change the fact that for an extended period, it was the single point of containment for the most offensive AI capabilities at three of the world’s four most capable frontier labs simultaneously.

What Operators Should Be Asking

For most operators, the exposure is not direct. The majority of organizations outside of frontier AI labs will not commission Irregular or Frontier Security directly. The risk is transitive. It travels through the AI vendors, platforms, and models that operators procure and deploy.

Before procuring or deploying a model, run these questions against the model vendor’s contract and evaluation documentation:

• Who owned the evaluation environment, and is that in writing? The Anthropic and Meta incidents both turned on a contested understanding of whether the environment had internet access. Ownership of the environment—who configured it, who verified it, and who accepts liability if the configuration is wrong—should be explicitly assigned in the contract, not assumed or left to the evaluator’s own account after the fact.

• What are the evaluator’s contractual notification obligations if its environment fails and a third party is compromised? The three organizations breached in Anthropic’s incidents were notified by Anthropic, not by Irregular. One had not been reached as of the disclosure date. If the evaluator’s configuration failure causes harm to a party outside the contract, the obligation to notify, preserve evidence, and remediate should be assigned before the evaluation begins. Enterprise customers should also know what obligation their AI vendor has to disclose such a failure to them.

• What assurance can the AI vendor provide over the evaluator’s sandbox infrastructure? The vendor should be able to show how the sandbox architecture, credential scope, and egress controls were independently verified before the evaluation ran, rather than asking customers to accept the evaluator’s controls on trust.

• Was the model tested under conditions that materially match the system the enterprise plans to deploy? A model tested in a tightly controlled sandbox may present a very different risk profile from the same model operating with production credentials, external tools, persistent memory or network access. Buyers should understand which assumptions in the evaluation are relevant to their intended deployment, and which are not.

Do not treat “independently evaluated” as a safety credential. The evaluator is not a neutral technical service provider. It is a vendor with access to your most sensitive AI capabilities, operating in an environment with no mandatory accreditation, no standard liability framework, and no regulatory obligation to notify you if something goes wrong. Treat it as a critical vendor whose controls, responsibilities, and failure obligations require independent assurance before you accept the evaluation as evidence of anything.

More from Asia Tech Lens

• When an AI Agent Escapes Its Sandbox
  A look at what the OpenAI/Hugging Face sandbox breach revealed about containment, evaluation environments, and the operational controls enterprises should expect before trusting frontier AI systems.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.
  Singapore’s new guidance puts containment, permissions, and auditability at the center of agent deployment, raising the bar for operators evaluating whether AI systems are truly controllable.

• AI Middleware Promises Flexibility. In Asia, It Can Create Jurisdictional Lock-In
  AI middleware can introduce hidden dependencies across routing, data handling, and compliance, creating fourth-party risks that enterprises may not see when they procure a model or platform.

• Vietnam’s New AI Law: The Road Ahead For Businesses
  Vietnam’s emerging AI rules are pushing enterprises toward stronger vendor due diligence, clearer audit evidence, and tighter incident-response obligations as AI governance becomes more formalized.

• AI Is Shrinking The Time To Compromise. Most Firms Still Can’t Recover Control
  As AI accelerates the speed of cyber compromise, the harder operational problem is whether enterprises can contain incidents, restore control, and recover when preventive safeguards fail.

For an Indian EV manufacturer, foreign technology can solve an immediate problem: getting a competitive vehicle to market quickly and at lower cost. Battery cells, permanent magnets, power electronics, semiconductors and other components remain difficult to source domestically at comparable scale.

As the business scales, those dependencies become a strategic decision. Which foreign dependencies can it safely carry, which capabilities must it control, and what should trigger a switch?

Localize too aggressively before volumes justify it and the vehicle can become uncompetitive. Remain dependent too long and a short-term sourcing decision can become a strategic vulnerability.

Karthick Athmanathan, former head of electric vehicles and e-mobility solutions at Ashok Leyland, argues that manufacturers should treat those problems sequentially.

“The first priority is always to rush to market with a reliable, good branded product,” he says. “Having started, you build your team, you build your numbers, then you take control of the design side.”

That calculation includes China. “As of today, it’s convenient for me to buy certain components from China. I will buy it,” Athmanathan says. “Now do I look at him as a strategic partner? No.”

The more useful measure of dependence is not where a component comes from, but how difficult it would be to replace. Can the manufacturer change suppliers, redesign around another component or absorb a disruption without rebuilding the vehicle around the incumbent?

Own the Architecture Before You Localize the Parts

Athmanathan argues that the first capability a serious manufacturer should “take control of is the design and the software.”

A manufacturer can continue buying cells, magnets, semiconductors, motors or controllers from outside suppliers. But if it controls the product architecture, specifications and software, it is better positioned to redesign around another component, qualify additional vendors and move sourcing when the economics justify it.

Athmanathan points to electric-bus manufacturer PMI. The company initially relied heavily on its Chinese partner Foton, and then localized areas including its vehicle controller, frame components, and axles as production increased. In his assessment, that shift substantially reduced PMI’s technological reliance on its original partner.

The key distinction is therefore not imported versus local. It is between a manufacturer that can change its product without its original supplier and one that cannot.

Foreign sourcing and technological dependence are not the same thing. An OEM can import a component for years and still retain the ability to replace it. Another can source fewer foreign parts yet remain more exposed because a proprietary system is embedded too deeply to switch without a major redesign.

Scale Changes the Economics of Optionality

A new EV entrant may need to prioritize market presence before an optimized supply chain. Without sufficient volume or capital, smaller manufacturers may also struggle to persuade alternative suppliers to develop specialized components cheaply.

“There is significant, significant dependency on foreign suppliers, especially China,” Athmanathan says. “And the minute anyone reaches scale, they remove item-by-item from the foreign supply chain.”

But scale does not remove dependence automatically. It changes the economics of creating alternatives.

Higher volumes can attract a second supplier, spread tooling and validation costs across more vehicles, justify internal engineering teams and make dual sourcing less punishing. As production grows, the cost of a disruption can also become large enough that paying for redundancy makes commercial sense.

Those are better triggers than an abstract instruction to “localize after scale.” Scale should trigger a sourcing review when it makes an alternative economically viable and not simply when the company crosses an arbitrary production milestone.

Rank Dependencies By Switching Risk

India’s remaining foreign dependencies are concentrated in a handful of technologies, but the risk each creates varies depending on how difficult it is to substitute or redesign around.

“If you go to the crux of the problem,” Athmanathan says, “it’s either the power modules, power electronics and semiconductors; or it is the magnets; or it is the cells.”

The important variables are the number of credible alternatives, switching and validation time, how deeply the component is integrated into the vehicle, and whether suppliers are concentrated around the same geographic or political risk.

China’s 2025 rare-earth export restrictions showed why concentration matters. Beijing placed export controls on several medium and heavy rare-earth-related items, requiring licenses. The resulting supply constraints created a vulnerability for Indian automakers dependent on rare-earth permanent magnets. A relatively low-cost component can still become a production bottleneck when there is no ready alternative.

Origin also matters when it adds political or regulatory risk. Buying a semiconductor from Taiwan is still foreign sourcing, but it can reduce exposure to a China-concentrated supply chain without increasing domestic content.

India’s rules on investment from countries sharing a land border add another consideration. The government partially eased those rules in 2026, including allowing some non-controlling investments of up to 10% under the automatic route and faster decisions for selected manufacturing investments. But China-linked investment remains subject to additional conditions and scrutiny.

That’s because India-China tensions can flare quickly, and previous border confrontations have already spilled into commercial relationships. After the deadly Galwan clash in June 2020, shipments from China faced additional customs clearances at Indian ports, disrupting supply chains for manufacturers dependent on Chinese inputs, while India tightened restrictions on Chinese companies in areas including government procurement. For an EV manufacturer, the lesson is that a commercially reliable supplier can become harder to use because of a deterioration in the bilateral relationship rather than any failure by the supplier itself. Chinese sourcing may still offer the best combination of cost, scale and availability, but manufacturers need to account for the possibility that political tensions can change the terms of that access with little warning.

That does not make Chinese sourcing inherently wrong. It means ‘foreign’ and ‘Chinese’ are not interchangeable measures of risk.

Do Not Plan Around Localization Dates Alone

Athmanathan estimates that imported-cell dependence could decline substantially within three to five years, permanent-magnet dependence in roughly three years, and semiconductor dependence over a longer period of seven years or more.

Those are operating assumptions, not guaranteed exit dates.

India’s Advanced Chemistry Cell production-linked incentive program targets 50 GWh, with 40 GWh awarded. But only 1.4 GWh had been installed under the program as of May 2026—a reminder that announced capacity is not the same as qualified supply.

Permanent magnets are even more exposed to policy execution. India currently lacks industrial-scale capacity for key stages of sintered NdFeB magnet production. A ₹7,280 crore (roughly US$761 million) government scheme approved in late 2025 aims to establish 6,000 metric tonnes a year of integrated domestic capacity and envisages a two-year setup period.

Semiconductor dependence will take longer to unwind. India is investing in domestic fabrication through the India Semiconductor Mission, but its first chip fabrication plant at Dholera was still being built in 2026.

For an OEM, announced domestic capacity should not become a procurement assumption until it is operating, qualified and commercially viable. Maintain an interim sourcing strategy in case capacity arrives late, remains too expensive or cannot meet the required specification.

Own Selectively, Preserve Alternatives

Nor should every component eventually be developed internally.

“Generalizing like this is what is dangerous,” Athmanathan says. “A decision on motors will be different from your decision on a controller, which will be different from a decision on a cell.”

Software may be relatively straightforward to bring under internal control. Semiconductor fabrication is not. A local magnet supplier may charge more than a Chinese competitor, but the added cost can be acceptable if magnets account for a small share of vehicle cost and the second source materially reduces supply risk.

“Owning every single layer is an option that I retain but not necessarily exercise,” Athmanathan says. “That’s what successful supply-chain management would be.”

That can mean dual sourcing rather than full localization: keep most volume with the lowest-cost supplier while maintaining a qualified second source. What matters is whether that second source can actually keep production running or scale up when needed.

Industrial policy can build domestic alternatives. The OEM’s job is narrower: identify which dependencies could stop production or prevent redesign, and create alternatives when the cost is justified.

Give Every Critical Dependency An Exit Path

The same logic extends beyond India. Asian manufacturers can benefit from foreign technology and established supply chains without allowing those relationships to become permanent constraints.

A better metric is whether the manufacturer gains more freedom to change suppliers and technologies as the business matures.

For every critical foreign component, an OEM should be able to answer a short set of questions: Who else could supply it? What would trigger a switch? How long would qualification take? How much redesign would be required? At what scale does one viable source stop being acceptable?

A company does not need an immediate answer that ends with domestic production. It instead needs an answer that preserves its ability to change course.

Foreign sourcing does not always need an exit date. But every critical foreign dependency should have an exit path.

Asia Tech Lens is an official media partner for

AIMX Singapore x TechInnovation 2026

Go Deeper on Asia Tech Lens

• Tethered Tech: The Hidden Cost of Battery Swapping Lock-In for Indonesia’s EV Fleets
  Proprietary battery-swapping systems can create dependencies that become expensive to unwind. For fleet operators, the test is whether today’s infrastructure choice preserves the ability to switch later.

• Not Just EVs: China Leads the World in Battery Production and Technology for All Vehicles
  China’s dominance in battery manufacturing extends well beyond electric vehicles, giving its suppliers scale and technology advantages that remain difficult for manufacturers elsewhere to replicate.

• Asia’s High-Stakes Chip Game: What To Do When You’re Caught in the Middle
  Asia’s semiconductor supply chains are increasingly shaped by geopolitical pressure. Operators need to understand where concentration creates exposure and which dependencies are actually practical to reduce.

• VinFast Pivots to Southeast Asia—But Can it Outrun BYD in Indonesia?
  VinFast is localizing production in India and Indonesia as it refocuses on Asian markets. The bet shows how local manufacturing can lower costs and capture policy advantages, but does not by itself guarantee competitiveness against established Chinese rivals.

• When Battery Economics Shift: What Gets Stress-Tested in China’s EV Strategy?
  China’s shift toward hybrids shows why flexibility matters when the assumptions behind an EV strategy change. Automakers with adaptable platforms and supply contracts can respond; those locked into BEV-only capacity face much harder capital-allocation decisions.

Chinese open-weight AI models can cost far less than premium US systems, but the savings only matter if they can complete the same work reliably. For Southeast Asian companies, that makes the real question less about which country produces the better model and more about where cheaper Chinese AI actually lowers the cost of getting work done.

Open-weight models can be downloaded, customized, and deployed on infrastructure chosen by the user, giving companies more control over how and where they run AI. While US developers such as OpenAI have moved toward more closed systems, Chinese developers including Moonshot AI, DeepSeek, and Alibaba’s Qwen have leaned heavily into open weights.

Hugging Face CEO Clément Delangue has gone so far as to argue that China could gain an advantage in the AI race through open-weight models and potentially catch up with US model makers.

Southeast Asia Is Already Mixing Models

Southeast Asian companies are already accustomed to buying technology from both US and Chinese suppliers, rather than committing to one ecosystem.

Gartner projects that Chinese AI model adoption among global companies could rise from 5% in 2025 to 50% by 2027, as enterprises increasingly use different models for different tasks and look for cheaper options.

While Gartner did not break out Southeast Asia, companies in the region are already experimenting with how open models fit specific workloads rather than treating them as a complete replacement for US systems. Indonesia’s GoTo, for example, has adopted open models in its AI voice assistant, with Sahabat AI built for Bahasa Indonesia and regional languages.

OCBC offers a clearer example of that stacking approach. The Singapore bank has rolled out more than 30 internal tools using open-source models, with different models assigned to different jobs. Alibaba’s Qwen has been used for coding, while other models support separate internal tasks.

AlonOS has also partnered with Indosat Ooredoo Hutchison to develop DeepSeek-powered applications in Indonesia, adding another Chinese model to an enterprise environment that already relies on a broader mix of technology providers.

That pattern matters. Southeast Asian companies have rarely had to choose exclusively between US and Chinese tech, and AI is beginning to look similar. The opportunity is about adding lower-cost open-weight models for specific jobs where they make sense.

Where Cheaper Models Actually Save Money

The price gap can be substantial. Alex Colville, an analyst with the Australian Strategic Policy Institute’s Cyber, Technology, and Security Program, recently pointed to testing by Artificial Analysis in which leading models were asked to complete 657 office and administrative tasks. Anthropic’s Opus 4.8 cost nearly US$1000 across the tasks, compared with US$270 for Z.ai and just US$14 for DeepSeek-V4 Flash.

But the cheapest model is not necessarily the best performer. DeepSeek used around one billion tokens during the test and completed fewer tasks correctly than several competitors. Colville also noted that some Chinese models also use more tokens on complex tasks, meaning a low token price can overstate the saving on a finished task.

For Southeast Asian companies, language can change the calculation quickly. A model that looks inexpensive on English-language benchmarks still needs to be tested on Indonesian, Thai, Vietnamese, and other local or mixed-language workloads. If those tasks require more correction, retries, or human review, the apparent savings can quickly narrow.

How a model is run also affects the cost. Self-hosting may be cheaper at scale, but companies have to pay for and manage the infrastructure themselves. Using an open-weight model through a cloud provider is simple, but comes with the provider’s own charges.

A better measure is the total cost of getting a usable result, including any retries or extra review. For smaller companies, Chinese open-weight models can be attractive because they can often be tested through existing cloud platforms before committing to a larger deployment.

When Deployment Changes The Risk

How a model is deployed also affects security and regulation. If a company runs an open-weight model in its own environment, it has more control over where the data stays, but it also takes on more responsibility for securing and managing the system. Using a hosted service is easier, but the company must be comfortable with how the provider stores and processes its data.

That matters in Southeast Asia because regulators generally focus on how companies handle data and manage AI risks, rather than whether the model itself is American or Chinese.

Take Singapore, for example. IMDA’s latest framework for agentic AI focuses on who’s responsible for an agent, how its actions are monitored, and what safeguards companies need. Separate privacy guidance also sets rules around the use of personal data without prescribing which country’s models companies should use.

For operators, that means the model itself is only part of the decision. The same open-weight system can carry different cost and risk profiles depending on where it runs, what data it touches, and how much oversight is required.

The Operator Takeaway

The practical opportunity is in workloads where the performance bar is clear, and mistakes are easy to catch. High-volume tasks such as document processing, routine coding, and lower-risk customer support may be natural places to test open-weight models. More complex or sensitive work can remain with frontier systems where the performance premium is worth paying for.

Recent research on enterprise coding assistants points toward the same approach: route each task to the cheapest model that can meet the required quality and latency, while factoring in failures and escalation rather than optimizing for token price alone.

Across Southeast Asia, the economics can vary widely depending on language performance, deployment costs, and local rules. The operator decision, then, is not Chinese AI versus US AI for the whole enterprise. It is choosing the cheapest model that can reliably meet the requirements of each workload.

Asia Tech Lens is an official media partner for

AIMX Singapore x TechInnovation 2026

Go Deeper on Asia Tech Lens

• US vs China AI Showdown: How Southeast Asia Is Quietly Choosing Open-Source Over Closed Models
  Southeast Asian companies are already mixing Chinese open models with US proprietary systems, showing why the region is unlikely to settle on a single AI ecosystem.

• How Asia Is Building the Future of Local-Language AI
  From Sahabat-AI to ILMU and SEA-LION, Asian developers are building models around local languages and contexts that global benchmarks often overlook.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data
  Better models alone will not deliver enterprise AI returns if poor data, fragmented workflows, and human-review requirements continue to raise deployment costs.

• The Dependency Economy of AI
  As enterprises build around foundation models and APIs, model optionality is becoming an important safeguard against technical, commercial, and geopolitical dependence.

• The Hidden Layer Powering AI Adoption in Asia
  For many Asian businesses, the decisive AI choice is not just the model but the cloud and integration partners that make it usable. Regional providers are increasingly determining how global AI platforms are localized, deployed, and scaled.

A physical AI pilot can turn workers, processes and failures into training material for a model your company does not control.

For a COO, CIO or an automation leader, that raises a question conventional equipment contracts may not clearly be able to answer: what can the robot learn from your factory, where will that learning go and what are your rights after the pilot ends?

The issue does not apply to fixed, pre-programmed robots that learn nothing from customer-site data. It only arises with learning-enabled systems that use demonstrations, feedback and failure cases to improve their own policies or a supplier’s broader model.

That learning may be essential. Worker demonstrations and recovery procedures are often what make robots useful outside a laboratory. But before deployment, manufacturers must decide what can improve a shared model, what must remain site-specific and what capability they retain when the relationship ends.

At the recently concluded World Artificial Intelligence Conference in Shanghai, TARS reportedly recreated an automotive wiring-harness production line in which multiple robots grasped, routed and assembled flexible components. The demonstration showed embodied AI moving toward complex industrial work. The less visible question is who controls what the system learns once it enters a customer’s factory.

The Factory Becomes the Training System

Digital AI can learn from online material. Robots need physical data: how objects bend or slip, how workers respond to abnormalities, and how production continues when formal processes fail. That data is difficult to generate and increasingly valuable.

At AgiBot’s Shanghai data-collection site, about 100 robots are operated by roughly 200 people for up to 17 hours a day. Robot learning is also entering operating factories. TARS plans to deploy 100 robots at an Aptiv plant in 2026 and use production-line data to train its general embodied AI model. Spirit AI has said it will collect data and train models in Bosch China factories and logistics centers.

These examples do not demonstrate widespread misuse. They show manufacturers becoming contributors to model development before the value and rights attached to that contribution are clearly defined.

That is enough to create a procurement risk. Treat every learning-enabled robotics deployment as both an automation contract and a model-training agreement.

The Value Exchange Can Become a Switching Problem

A factory supplies the environment that makes the system useful: workers demonstrate tasks, engineers correct trajectories and failures expose edge cases. The robot then becomes embedded in equipment, workflows and supplier support while its performance improves through continued exposure to the site.

If the vendor later raises fees, cuts support, discontinues the product, or becomes hard to work with because of financial, regulatory or geopolitical disruption, the manufacturer can buy another robot but cannot move the capability it has built. The governance failure begins when the factory contributes learning without defining what it will receive or retain in return.

Portability must be treated realistically. A policy trained for one robot may not run on another because machines use different sensors, controls, action spaces, kinematics and physical configurations. Cross-embodiment transfer remains an active research challenge, so an export right does not guarantee plug-and-play interoperability.

An exit agreement should instead preserve what is needed to understand and reconstruct the deployment: demonstrations and annotations, task specifications, site maps, configurations, interface documentation, performance histories and failure-recovery records. Where available, manufacturers could also seek customer-specific task configurations, policies or other deployment artifacts. Contracts should specify the format, documentation and transition support accompanying them.

The goal is not to fit one robot’s brain into another body. It is to avoid rebuilding the deployment from memory.

Your Objective Is Control, Not Necessarily Ownership

Manufacturers don't need to own the supplier's model or every improvement from deployment. Once a supplier blends your data with other customers' and its own, ownership gets impractical, and sharing it tends to complicate maintenance, liability and decision-making.

What matters is a defined set of rights: what the system may collect, which models the information may improve, how the resulting capability may be reused, what value the manufacturer receives and what access continues during and after the contract. Agreements may include limits on reuse in directly competing applications and should specify which customer-specific outputs, configurations or services remain available at termination.

Joint ownership may suit strategically important deployments. But the central question is who may use the improvement, for what purpose, under which restrictions and for how long.

Divide Factory Learning Into Three Categories

Classify learning during procurement, while the manufacturer can still decide what can enter a shared model and what must remain protected.

Pool commodity motion

Basic navigation, routine material movement, standard grasping and common safety responses can usually contribute to a shared model. They reveal little competitive knowledge, and pooling them may reduce costs and prevent robots from relearning standard tasks at every facility.

Negotiate site-specific learning

Plant layouts, equipment placement, production rhythms, worker interactions and local failure patterns need stronger controls. They may not reveal a proprietary technique, but they can expose operational weaknesses or deepen dependence on the supplier. Contracts should define how this information is aggregated, anonymized, retained and reused, including whether improvements can be deployed across the manufacturer’s own sites.

Protect proprietary method

Product-specific assembly, specialized tooling, defect analysis, quality judgements and recovery procedures may encode tacit intellectual property accumulated through years of production experience. They should not automatically improve a supplier’s general model.

Protection may include keeping specified material outside pooled training, using it only to fine-tune a separately maintained customer-specific model or policy where the architecture permits, or imposing purpose-based limits on external reuse.

The operating rule is simple: share commodity motion; protect proprietary method. The boundary will not always be clean, so the categories are a procurement framework rather than a claim that every update can be perfectly separated after training.

Data Localization Does Not Guarantee Learning Localization

Many Asian manufacturers already run data-compliance controls that make a robotics deployment look handled.

In China, the Personal Information Protection Law channels overseas transfers of personal information through mechanisms such as a security assessment, certification or standard contract. It also requires critical information infrastructure operators and processors handling personal information above prescribed thresholds to store that data domestically.

Vietnam’s Decree 53 applies domestic-storage requirements to specified categories of user data. These include personal information, account and service-use data, and information about users’ relationships. Covered foreign digital-service providers can also be required to store that data locally and establish a local presence following a formal government request under specified conditions.

Indonesia’s Personal Data Protection Law uses a transfer hierarchy: the receiving country should provide equivalent or stronger protection; failing that, the controller must ensure adequate and binding safeguards; if neither condition can be met, it must obtain the data subject’s consent.

Malaysia permits overseas transfers where the destination has substantially similar law or an adequate level of protection, while also recognizing grounds such as consent, contractual necessity and due diligence by the controller. Its cross-border transfer guidelines emphasize notices, assessments, and records supporting the chosen transfer basis.

Compliance with these regimes does not by itself establish who may use a model update, task policy or distilled capability derived from factory activity. Nor does it necessarily protect non-personal process knowledge such as tooling methods, quality judgements and recovery procedures.

Compliance teams therefore need to make an additional deployment decision: where training occurs, whether updates or distilled capabilities leave the facility, whether customer-specific models are merged into shared systems, what remote access the supplier retains, and which non-personal learning requires contractual protection.

Apply a Robotics Learning-Rights Test

Before approving a pilot, answer four questions.

1. What can the system collect?

Map every input available to the robot and supplier, including sensor feeds, demonstrations, execution logs, production metrics, workspace maps, corrections, failures and human interventions. Limit collection to the agreed task, including indirect information revealed through worker corrections and recovery actions.

2. Which models can it improve?

Assign each category of information to a permitted destination: a shared model, a customer-specific model or policy, or no training use. The contract should govern not only raw data, but also whether updates, embeddings or distilled capabilities may leave the facility or enter a broader system.

3. What does the manufacturer receive?

If the supplier receives reusable learning, negotiate identifiable value in return. That may include lower fees, performance commitments, rights to use customer-specific outputs across the manufacturer’s facilities, restrictions on external reuse or task-specific intellectual property. Tie that value to agreed data, deployment periods, use rights or measurable milestones rather than exact attribution.

4. What survives termination?

Specify which customer-specific materials, outputs, access rights and transition support remain available after the relationship ends. Define delivery formats and documentation before the pilot begins.

The Procurement No-Go Rule

Learning-enabled robots can deliver more adaptable automation, but manufacturers should not contribute worker expertise, production variation, and proprietary recovery methods under an agreement written only for hardware maintenance and data storage.

Do not approve a learning-enabled robotics pilot unless the contract specifies what may be collected, which models it may improve, what the manufacturer receives in return, and what capability, access and transition support survive termination.

Go Deeper on Asia Tech Lens

• Two Robots, One Plan
  China’s robotics strategy separates proven industrial automation from humanoid ambition and shows operators where deployment is ready now.

• Singapore Wants to Be the Testbed for Physical AI
  Singapore is positioning itself as a real-world proving ground for robots, giving operators a framework for testing reliability before scaling.

• China’s Robot Spectacle Is an Industrial Strategy

  China is using state-backed demonstrations and early deployments to generate the operational data humanoid robots need, showing operators how spectacle can become an industrial learning system.

• The Man Behind Unitree: Insights on AI, Adoption, and Growth

  Unitree founder Wang Xingxing explains why limited real-world data and immature AI models—not robot hardware alone—remain the biggest barriers to useful, general-purpose robots.

• Inside China’s Bold Push to Build Humanoid Robots

  A company-level guide to five Chinese humanoid robotics firms, showing how supply-chain depth, in-house manufacturing and factory trials are accelerating the move from prototypes toward industrial deployment.

On July 16, Hugging Face—a platform hosting AI models and datasets, often described as the GitHub for AI—disclosed that it had been breached by an autonomous AI agent system, reporting the incident to law enforcement before knowing who was behind it. Five days later, OpenAI confirmed its own models, GPT-5.6 Sol and a more capable internal research prototype, had caused the breach. The models had been running inside a contained test environment with their safety filters reduced for a cybersecurity evaluation called ExploitGym. On July 28, OpenAI updated that the agent also accessed four accounts across four separate external services during the incident. The company further found a small number of additional account-access cases during other evaluations.

The test environment had no direct internet access, but it still allowed the models to install software through an internal package-registry proxy. The models exploited a flaw in that proxy, moved through the research environment and reached a system connected to the internet.

Both companies called the incident unprecedented, and Hugging Face’s CEO described it as “possibly the first of its kind.” Vlad Korsunsky, Chief Technology Officer at cybersecurity firm Tenable, called it the moment the “agentic attacker” scenario shifted from a theoretical risk into an active, real-world reality. Cybersecurity expert Peter Tran warned that AI agents capable of finding vulnerabilities at greater volume and speed than any human team create challenges the security industry is not yet equipped to handle at scale.

That gap between the permission granted to the test and the actions the test eventually took is what makes this incident structurally different from a conventional cyberattack. It is not a story about security failure in the usual sense. It is a story about a new category of risk that most governance frameworks, including those being developed across Asia, have not yet named: that a sandbox escape during an AI evaluation can become a security incident for a company that played no part in the test.

Why This Kind of Test Exists

To understand why OpenAI was running this evaluation, it helps to understand what ExploitGym was designed to measure, and why measuring it matters.

Finding a vulnerability in a piece of software is one thing. Turning that vulnerability into a working attack is another. The first step is closer to a diagnosis: identifying that a weakness exists. The second step, called exploitation, requires the AI to reason about how a program works at a deep level, adapt in real time as it encounters obstacles, and sustain progress across many steps without losing track of the goal. Exploitation is, in the words of the ExploitGym researchers, “a particularly challenging task”. Until recently, it was one of the least tested. Most AI safety evaluations have focused on what models say, not what they can do when given tools and a goal. Exploitation benchmarks like ExploitGym are an attempt to close that gap.

The results, published in May 2026 by researchers from UC Berkeley, the Max Planck Institute, UC Santa Barbara, Arizona State, Anthropic, OpenAI, and Google, were striking. Frontier AI models could already turn a meaningful fraction of real-world vulnerabilities into working exploits. The top performers—Anthropic’s Claude Mythos Preview and OpenAI’s GPT-5.5—successfully exploited 157 and 120 out of 898 benchmark instances respectively. The researchers described this rapid emergence as a central finding, showcasing that capabilities that would have seemed implausible are now present in deployed frontier models.

This is also why exploitation testing is considered inherently dual-use. Testing this capability is essential for building effective AI defenses. You cannot protect against what you have not measured. But the act of measuring it, reducing an AI model’s safety constraints and letting it attempt real attacks in a controlled environment, creates the conditions under which an accident like this one becomes possible. That is to say that testing AI’s offensive capabilities is necessary. But the work of building a container it cannot escape has not kept pace.

What the Incident Exposes, and What to Do About It

The incident surfaces two questions that CISOs, CTOs and risk owners need answered before approving or commissioning a high-agency cyber evaluation. Each has a corresponding control that needs to be in place in time before the next evaluation begins. It is worth noting that these controls apply specifically to high-agency evaluations—those involving autonomous tool use, code execution, cyber exploitation, reduced safeguards, or long-running agents. Routine bias testing, accuracy benchmarking, and standard application evaluation do not require the same architecture.

The first is containment. What prevents an evaluation agent from reaching infrastructure it was never authorized to touch? OpenAI’s models found a path from a restricted sandbox to the open internet through a package proxy. The right response to that is architectural. The evaluation environment should be built with no external internet access by default, no production credentials within reach, and no connection to the rest of the organization's systems. Hard limits on how many actions the agent can take and how long it can run should be set in advance. And there should be a shutdown switch that the agent itself cannot disable, tested before the evaluation begins, with a named person assigned to use it. Monitoring is an additional layer on top of all of this. When an autonomous agent can generate over 17,000 documented actions over a weekend, installing an AI-powered system can help with detecting models going rogue.

As an extension to designing better architectures, operators commissioning external evaluations should also do more checks. They should not accept an evaluator’s assurance that the test environment is properly sandboxed. Require documented evidence before the evaluation begins: architecture diagrams showing what the agent can and cannot reach, a credential inventory confirming no production access is available, egress controls and allow lists, results from escape-testing of the environment itself, and confirmation that the shutdown mechanism has been tested and works.

The second is response. What does your organization have available when containment fails? When Hugging Face tried to use its primary AI models to reconstruct what had happened, they failed. The same safety guardrails that make those models trustworthy in normal contexts made them unable to distinguish an incident responder from an attacker in an adversarial environment. The company turned to GLM 5.2, an open-weight model whose weights are publicly available and can be run on your own infrastructure without external API dependency. Running it locally, in isolation, Hugging Face was able to reconstruct more than 17,000 recorded events from the breach in hours rather than days. The lesson is provider independence: organizations need a forensic capability that can analyze adversarial material without depending entirely on the primary AI provider. A vetted, locally hosted model is one option, but an isolated response environment or specialist forensic provider could serve the same purpose.

Before approving a high-agency cyber evaluation, the responsible CISO, CTO or risk owner should require evidence on three points. One, the blast radius: which systems, credentials, and external services an agent could reach if it found a path beyond its intended scope. Two, the kill authority: who can stop it mid-run, and whether the technical mechanism to do so exists and has been tested. Three, the response capability: how the organization will investigate the incident if the primary provider’s models cannot assist.

What Singapore’s AI Standards Don’t Yet Cover

Singapore—the region’s most active jurisdiction on AI governance—has two initiatives directly implicated in what this incident revealed. It has proposed an international standard for how AI systems should be tested and evaluated, focused on making those tests consistent, reproducible, and comparable. It has also published what it describes as the world’s first governance framework for agentic AI, recommending that companies limit what agents can access, keep humans accountable for their outputs, and log what agents do in real time.

Both are necessary, but the OpenAI incident reveals their blind spot. The testing standard tells companies how to run a rigorous AI evaluation. It says nothing about how to stop an evaluation agent from reaching systems it was never supposed to touch. The deployment guidance tells companies how to govern agents already at work. It does not yet apply to agents used to test AI before it goes live, which, as this incident shows, can be the more dangerous ones. An AI system being evaluated with its safety filters turned down is operating closer to its limits than a deployed system. The containment requirements should be stricter at that point, not absent.

The broader gap is this: most AI assurance standards being developed ask how effectively a system can find vulnerabilities. The question they do not yet ask is what prevents that system from finding and exploiting vulnerabilities that the evaluator does not own.

The OpenAI incident showed that existing security controls were not sufficient for this category of evaluation. The approval standard for a high-agency AI evaluation should be straightforward: the evaluator must be able to demonstrate, not assert, that the agent cannot reach systems it was not authorized to touch; that there is a working mechanism to stop it mid-run; and that there is a response capability in place that does not depend on the primary AI provider. If any of those three cannot be evidenced before the evaluation begins, the evaluation should not begin.

Go Deeper on Asia Tech Lens

• Why ByteDance’s AI Phone Hit a Wall: Security, Fair Play, and the Economics of Attention.
  A parallel case showing how an agent’s access model determines what it can reach, how its actions are traced, and who is responsible when it crosses into third-party systems.

• Two AI Phones. Two Access Models. One Critical Difference.
  AI agents can operate through defined permissions or act across interfaces with user-like authority. The distinction matters because access architecture determines what an agent can reach, how easily it can be stopped, and whether its actions can be traced when something goes wrong.

• AI Is Accelerating Cybercrime—and Southeast Asia Is Where the Damage Shows Up.
  AI is compressing attack timelines faster than many Southeast Asian organizations can strengthen detection and response.

• AI Is Shrinking the Time to Compromise. Most Firms Still Can’t Recover Control.
  Containment will sometimes fail, so operators must prove they can investigate, recover and regain trusted control.

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It.
  Singapore’s agentic-AI framework sets operator expectations around bounded autonomy, human oversight and the ability to stop or reverse an agent’s actions.

Every year since 2018, Shanghai has hosted the World Artificial Intelligence Conference—a showcase of Chinese AI ambition that has grown from a regional industry event into one of the most politically significant technology gatherings on the calendar. This year’s edition, which opened on July 17, was different in kind. Xi Jinping delivered a keynote in person for the first time in the conference’s history. The UN Secretary-General attended, along with heads of state and government leaders. There were delegations from more than 100 countries and international organizations. But the most consequential moment happened the day before the conference opened.

On July 16, representatives from 29 countries signed the founding agreement for the World Artificial Intelligence Cooperation Organization—WAICO—a new intergovernmental body headquartered in Shanghai. Unlike the EU AI Act, which is binding legislation with enforcement mechanisms and financial penalties, WAICO is currently built around common principles and cooperation, and does not yet require members to adopt a common regulatory code. The founding members include Indonesia, Pakistan, Kazakhstan, Russia, Malaysia, among others. What is as interesting as who’s being included is who’s not. No major Western democracy signed. No EU member state. No Japan. No South Korea. And no India, whose absence seems to reflect a cautious attitude against WAICO’s governance implications.

On August 2, the EU AI Act’s transparency obligations take effect, requiring chatbots to disclose they are AI, AI-generated content to carry machine-readable labels, and deepfakes to be identified. This is part of a broader rollout arriving in stages, with the more consequential high-risk system rules taking effect in December 2027 for standalone systems and August 2028 for AI embedded in regulated products.

An AI system deployed across EU and WAICO-member markets will increasingly encounter divergent obligations, standards and political expectations built on different assumptions about what AI governance should require.

Why This Is Not Just a Geopolitical Story

Read more

South Korea’s AI push is beginning to create real opportunities, but not for everyone. Infrastructure suppliers with established Korean customers, local engineering capacity, or direct involvement in a specific project can start positioning now.

Most industrial companies looking to buy compute or AI services should wait until announced capacity comes with firm locations, commissioning dates, prices, and service terms.

Korea is trying to connect semiconductor production, AI data centers, and advanced manufacturing. Some plans are tied to real budgets and projects. Others are long-term targets that may take years to become contracts.

What Korea Has Actually Announced

The government’s proposed 2027 budget is expected to exceed 800 trillion won ($531 billion). It is the country’s total national budget and semiconductors, AI data centers, and physical AI are named among its top spending priorities, with stronger chip-sector tax revenue helping to fund the wider budget.

Corporate semiconductor spending is separate. Samsung Electronics and SK hynix have announced plans to invest a combined 800 trillion won in four new fabrication plants in southwestern Korea. The projects will expand domestic chip capacity, but spending will be phased and depend on market conditions, timelines, and approvals.

The national AI data center plan is more aspirational. SK, GS, and Naver are expected to lead an initial 8.4 GW phase from 2029, with longer-term targets of 18.4 GW and more than 1,000 trillion won in investment by 2035. These remain targets, not operating capacity or contracts available today.

LG plans to invest 9.4 trillion won in AI infrastructure and advanced manufacturing in Yeongnam through 2030. KT has outlined 12 trillion won in cybersecurity, IT and network spending over three years, alongside a five-year infrastructure programme worth 6 trillion won. The latter includes 5 trillion won for 1 GW of AI data center capacity and 1 trillion won for submarine cables.

Where the Addressable Spending Sits

The most immediate opportunities are likely to go to suppliers linked to a specific project, budget, and procurement owner. An existing relationship with Samsung, SK, Hyundai, LG, or KT helps, but the real advantage comes from being qualified to bid, meet Korean standards and support customers locally.

Established suppliers should focus on projects with a confirmed site, buyer, and delivery schedule. The opportunity lies in the contracts attached to projects moving forward.

For new vendors, local delivery matters as much as the technology. A Korean partner, local support, and a clear role in a specific project will make entry more credible.

A Stimson Center analysis describes a “two-speed AI economy,” with larger companies better able to deploy AI while smaller firms face gaps in capital, integration and talent. That suggests big Korean enterprises may use new capacity first, but it does not mean foreign suppliers will automatically win contracts.

For industrial AI buyers, more infrastructure doesn’t guarantee access. Much of the new capacity may be absorbed by the companies funding it or by large cloud customers. Regional manufacturers should wait for a clear commercial offer they can actually use.

What Could Delay the Opportunity?

The timelines for Korea’s largest AI and semiconductor projects will depend on access to suitable land, sufficient power and water, and the necessary local approvals. Land preparation and permitting will shape when construction can begin, while grid connections could be delayed for power-hungry data centers and fabs.

That creates real opportunities for engineering, construction, power, and cooling providers, but only as projects move beyond headline announcements. Suppliers need to know whether sites, utility connections, and technical designs are actually in place before treating planned capacity as addressable business.

For compute buyers, those same constraints could push back opening dates or raise costs.

Talent will also affect both construction and operation. Vendors that can provide local engineering, commissioning, and maintenance teams will be better positioned than those relying entirely on remote support. SK Group Chairman Chey Tae-won has said the new chipmaking projects will require “vast sites, along with sufficient power, water and skilled workers.”

Suppliers must also account for the chip cycle. Demand for advanced memory remains strong, but fab schedules and spending can still shift with prices, customer orders, and market conditions.

How Operators Should Respond

Existing qualified suppliers: Pursue projects with confirmed budgets, procurement owners, and delivery milestones. They can prepare bids and line up local delivery support, but should not treat broad national targets as an open sales pipeline.

New infrastructure vendors: Enter only with a credible local route. That usually means a Korean partner, technology that fills a specific gap, and the ability to provide engineering and after-sales support in the market.

Industrial AI buyers and compute customers: Wait until announced capacity comes with firm locations, commissioning dates, pricing and service terms. The key issue is whether companies can actually buy and use it, not how large the planned capacity looks.

Operators with weak internal foundations: Fix fragmented data, weak OT/IT integration, cybersecurity gaps and unclear governance before making Korea-specific AI bets.

Three Questions to Ask Before Committing

Before committing capital or sales resources, operators should ask:

• Which specific project or buyer is accessible to us?

• What milestone turns the announcement into an addressable contract?

• What capability must we have locally before bidding or buying?

Korea’s headline numbers are not a market-entry strategy. Infrastructure suppliers should move only where they can identify a real buyer and a delivery route. Most enterprise users should wait until the capacity is operating, commercially available, and suitable for their workloads.

Go Deeper on Asia Tech Lens

• South Korea’s US$10 Billion AI Chip Deal with NVIDIA
  How Korea’s GPU acquisition supports its sovereign-AI ambitions and exposes the dependencies beneath its attempt to build a full AI stack.

• Can South Korea Replicate Its K-Pop Success in AI Chips?
  A closer look at Korea’s domestic AI-chip challengers, including Rebellions, and whether they can compete in a market still dominated by NVIDIA.

• China’s Compute Surplus Won’t Be Your Compute Surplus
  China’s infrastructure boom offers a parallel lesson: headline compute capacity matters mainly to operators that can actually access the domestic technology and regulatory ecosystem around it.

• India’s AI Data Center Boom Is Running Ahead of the Grid
  India’s buildout shows why planned AI capacity cannot be separated from power availability, grid connections, cooling and commissioning risk.

• Hot Chips, Cool Solutions: Asia’s Race to Reinvent Data Center Cooling
  Why cooling is becoming one of the most important and technically difficult parts of Asia’s AI infrastructure buildout, creating opportunities for vendors that can deliver efficient systems at scale.

Asian enterprises are buying AI middleware to reduce model lock-in. But in regional deployments, that flexibility can create a harder dependency: jurisdictional control.

Before choosing a middleware platform, tech leaders should ask one question first: can this layer control and prove where data moves by jurisdiction, data type, business unit, and risk level?

In June, China’s Ministry of State Security warned domestic organizations about third-party “AI relay” services used to access foreign AI models. The warning was aimed at intermediary platforms that make foreign models easier to reach, but may also obscure what happens to the data passing through them.

That should not be read only as a China story. It’s an early warning about a broader enterprise problem across Asia: the layer that promises model flexibility can also decide where data moves, what gets logged, which fallback provider is used, and which jurisdiction governs the workflow.

That shift changes the lock-in question.

The Governance Layer Is Harder to Replace

Enterprise AI buyers often think lock-in begins with the model. If they build on OpenAI, Anthropic, Google, DeepSeek, or another provider, they worry that switching later will be difficult. But in a middleware-led architecture, the model may be the easier part to change.

A platform such as OpenRouter, for example, lets developers access many models through a single interface rather than integrating with each provider separately. That makes it easier to test, switch, or combine models as performance, pricing, and availability change.

However, the more important dependency isn’t the model endpoint. It’s the governance layer above it.

That layer can include model gateways, cloud AI platforms, API routers, orchestration tools, guardrail systems, observability layers, and vendor-built connectors into internal systems. Together, these tools do more than pass prompts to models. They shape how AI is routed, monitored, logged, governed, and connected to the enterprise.

If the enterprise standardizes around it, the lasting lock-in may not be to any single model. It may be to the system that manages access to all of them.

The model can change. The governance layer is harder to unwind.

What the Middleware Actually Controls

The mistake is to treat that layer as a neutral pipe; it’s not.

Middleware can decide where a request goes, which fallback provider handles it, what gets logged, and which internal systems the AI tool can access. It can also shape governance by redacting sensitive data, classifying requests, or blocking responses.

In other words, it becomes the operational layer through which AI is governed, and one the board, legal team, and regional operators may not fully understand until it’s already embedded.

Why Asia Makes This Dangerous

Middleware risk matters in any market. In Asia, it is harder to manage because regulation is fragmented. The same AI workflow can be treated differently across Singapore, China, and Indonesia depending on the data, industry, recipient, and transfer path.

Consider a regional bank deploying an AI-powered customer-service assistant across those three markets. The business goal is straightforward: help agents summarize customer issues, draft responses, search internal policies, and escalate complex cases more quickly.

To streamline rollout, the bank adopts a middleware platform that connects its internal systems to multiple AI models through one interface. From the product team’s perspective, this is efficient: one workflow, one integration, one operating layer.

But that single operating layer may be doing far more than the business realizes. It may route low-risk requests to a cheaper model, escalate complex prompts to a more capable provider, store prompt histories for monitoring, generate audit logs for compliance teams, and connect the AI assistant to customer records or internal knowledge systems.

From an operational perspective, the workflow looks standardized. The same tool helps agents respond faster across markets. The same middleware layer manages access to models. The same business function is being supported.

From a regulatory perspective, there may be three different realities.

• In Singapore, the issue is whether comparable protection and overseas transfer visibility can be demonstrated. The bank needs to understand not only the model provider, but also whether prompts, logs, metadata, and outputs are being transferred or retained by another party overseas.

• In China, the issue is whether the middleware accidentally creates an unapproved outbound transfer path. If the platform routes from China to overseas infrastructure, the bank may have created a cross-border data flow that was never clearly approved as part of the AI procurement decision.

• In Indonesia, the issue is whether the enterprise can prove adequate protection across controllers, processors, logs, routing systems, and model endpoints. For an AI workflow routed through an intermediary, the company needs to know where each part of that chain sits and under whose control.

This is the part many AI procurement discussions miss. The real compliance question is not only which model is approved, but whether the enterprise can control and prove where prompts, outputs, logs, and fallback routes actually go.

One standardized AI workflow may be acceptable in one jurisdiction, require additional safeguards in another, and become unworkable in a third. The workflow looks standardized to the business, but it is not standardized to the law.

That gap is where jurisdictional dependency forms.

What Tech Leaders Should Audit Before They Commit

For Asian tech executives, the middleware decision should move earlier in the governance process. Before asking which model performs best, operators should first ask which layer will control the flow of data once the system is live.

The audit does not need to start with dozens of technical questions. It should start with five executive questions.

These are not edge-case questions; they’re procurement questions.

They determine whether middleware remains a flexible access layer or becomes a dependency the company cannot easily unwind.

The Trap Is Treating Middleware Like A Shortcut

Asian enterprises will need AI middleware for cost control, model flexibility, monitoring, fallbacks, guardrails, and centralized governance. The mistake is not adoption; it’s treating a core infrastructure layer like a convenience tool.

This pattern is familiar. Infrastructure dependencies often become strategic before organizations recognize them as such. AI middleware can create a similar dynamic, but with an added regulatory layer.

Once the organization builds its AI workflows around a middleware platform, switching later may not mean simply changing API endpoints. It may require rebuilding audit trails, revalidating compliance controls, changing data-processing agreements, reworking logging architecture, reconfiguring guardrails, retraining internal teams, and proving to regulators that regional data flows remain compliant.

The operational consequences are not theoretical. A company may need to disable a workflow in one market, split a regional deployment into country-specific versions, renegotiate vendor terms, rebuild compliance evidence, or migrate away from a platform after teams have already built around it.

That’s not only vendor lock-in in the software sense; it’s also jurisdictional lock-in.

The company becomes dependent not only on a vendor, but on the routing, storage, retention, and compliance assumptions embedded in that vendor’s architecture.

The Executive Decision

AI middleware is not just a technical layer for platform teams to manage. For enterprises operating across Asia, it is becoming a governance, compliance, and regional operating model decision.

That means the buying process has to change. Legal, risk, data protection, and country teams should be involved before the middleware layer becomes the default path for AI workflows.

The question is no longer only whether a platform can connect the enterprise to more models. It is whether the enterprise can still control the legal and operational architecture once that platform is embedded.

The Buying Rule

Enterprise AI in Asia will be sold as flexibility: use any model, switch anytime, route intelligently, reduce costs, and centralize governance. But flexibility only matters if the enterprise can still control the layer making those decisions.

Before buying, leaders should ask whether the vendor can show where data goes, what it stores, how fallbacks are restricted, how audit evidence can be exported, and how the enterprise can exit.

If the answer is unclear, the company is not buying flexibility. It is buying the vendor’s routing logic, retention choices, compliance assumptions, and jurisdictional exposure.

That is the buying rule: do not treat middleware as a convenience layer unless it can survive legal, risk, and country-level scrutiny.

The model can change. The jurisdictional dependency often remains.

Go Deeper on Asia Tech Lens

• iOS Is No Longer a Global Security Baseline. Enterprise IT in Asia Needs to Act Like It.
  Regulatory unbundling in the EU, Japan, and China is turning iOS fleet management into a jurisdiction-by-jurisdiction problem. The same pressure is now coming for AI middleware, where global defaults can quickly collide with local rules on data, security, and control.

• Vietnam’s 5G Is Expanding Fast. Can Operators Trust the Stack It’s Built On?
  Vietnam’s 5G rollout shows how vendor-stack choices can create compliance, interoperability, and switching risks long before operators realize they are locked in.

• A Quiet Alliance: The Hidden Layer Powering AI Adoption in Asia
  AI adoption often depends less on headline models than on the partners and intermediary layers that turn platforms into real deployments.

• The AI Agent Era Has Begun, and Privacy Risks Are Rising
  As AI systems move from answering questions to acting inside workflows, privacy, access control, logging, and oversight become core deployment risks.

• Invisible Arteries: Subsea Cables in the Age of AI
  A broader infrastructure read on why the systems beneath AI adoption matter.

Malaysia’s AI boom is creating new challenges for clean power buyers: knowing when to move before larger users lock in the best options. As demand from large electricity users rises, the government is trying to make corporate renewable procurement more practical.

The Corporate Renewable Energy Supply Scheme, or CRESS, allows companies to contract directly with renewable-energy producers and receive that electricity through the national grid, creating a new route for corporate clean-power procurement.

DayOne shows how quickly large digital infrastructure players are moving. In June 2025, the Singapore-headquartered data center operator signed Malaysia’s first CRESS deal with state utility TNB, locking in up to 500MW of renewable energy over 21 years. In June 2026, it expanded that partnership through agreements covering around 1.5GWp of solar capacity and 2.2GWh of battery storage, bringing its secured renewable energy in Malaysia to more than 1 GW.

Data centers are not just adding demand. They are also shaping the early clean power market. These buyers tend to have predictable long term load, stronger balance sheets, access to advisers, and more capacity to absorb early market complexity. That makes the decision harder for everyone else.

That creates a sharper question for other industrial enterprises. Manufacturers, semiconductor suppliers, clean-tech firms, and AI infrastructure companies risk losing more than a vague place in the queue.

What they risk by waiting is not just a vague place in the queue. It is access to better renewable projects, stronger developer relationships, negotiating leverage, and time to learn how CRESS contracts actually work. Move too early, though, and they may be committing before the full cost picture is clear.

Access Is Opening. Pricing Is The Test.

Malaysia’s power market is getting tighter. Data from Malaysia’s Grid System Operator (GSO) showed that electricity use in Peninsular Malaysia rose 11.5% year-on-year in April, driven partly by rising data center activity. Recent projects also point to continued demand, from Equinix’s planned $190 million facility in Kuala Lumpur to NEXTDC’s 65MW AI-ready data center in Klang Valley.

Those signals matter beyond the data center sector because they show who is likely to move first. If large digital infrastructure buyers lock in supply and advisory relationships early, other industrial users may have to make clean power decisions in a more crowded market.

CRESS gives them one route, but access alone does not settle the economics. Malaysia has reduced system access charges and published current rates to encourage more corporate consumers to enter green-power procurement. The question for buyers is how those grid-related fees translate into the final price they pay under a long-term CPPA.

Wood Mackenzie estimates that Malaysia’s system access charge could account for about 60% of the estimated total CPPA price in Peninsular Malaysia. Antoine Gaudin, principal consultant in Wood Mackenzie’s Energy Transition Practice for Asia Pacific, says in the report that the charge “significantly impacts the overall cost structure” of renewable-energy procurement. At the same time, Malaysia’s methodology “lacks transparency” compared with other APAC markets.

Wood Mackenzie’s point is about transparency. If system access charges form a large part of the final price, buyers need to understand not just today’s rate, but how the charge is calculated and how it could change over a long contract.

Aurora Energy Research adds a different point: capability. Even if developers are liable for the system access charge, the cost can still feed into PPA pricing. Aurora argues that SAC should be treated as “modelled risk, not regulatory guesswork,” because demand growth, grid investment, capacity needs, and regulatory settings shape the charge.

For buyers, the real cost is not just the headline CPPA rate. It also depends on grid charges, contract length, load profile, and how those charges may change over time. CRESS only works if that full package fits a company’s power needs, cost structure, and timing.

Move Early, But Know What You Are Buying

For buyers, the first step is not to guess where system access charges will go, but to model how they could affect their own power costs.

That means companies considering CRESS should not treat the published rate as the full answer. They need to test how SAC affects the CPPA price, whether the contract fits their load, and whether CRESS is cheaper or more reliable than rooftop solar, green-power programs, or certificates.

The answer will not be the same for every buyer. Companies that use a lot of power every day, face pressure from customers to cut emissions, or are planning new factories, have stronger reasons to move early.

Companies with smaller or less urgent clean-power needs may have more room to watch the market. But clean power procurement is no longer just an ESG decision.

For manufacturers, semiconductor suppliers, clean tech and AI infrastructure companies, clean power is becoming an operating call, not just a sustainability choice. They should start modelling CRESS now, compare it against other clean power options, and understand how much price risk they can carry. Buyers waiting for perfect clarity may find that by the time the market is easier to price, the best projects, relationships, and terms have already been shaped by someone else.

Go Deeper on Asia Tech Lens

• India's AI Data Center Boom Is Running Ahead of the Grid

  India’s hyperscaler buildout shows why AI infrastructure decisions cannot be separated from grid readiness, power reliability, and operating risk.

• Is Southeast Asia Ready for an AI Data Center Surge?

  Southeast Asia’s data-center race is accelerating, but rising power demand could expose the infrastructure constraints behind the region’s AI ambitions.

• Hot Chips, Cool Solutions: Asia's Race to Reinvent Data Center Cooling

  As AI workloads become hotter and denser, Asia’s data centers are being forced to rethink cooling, energy use, and the economics of scale.

• How Hyperscalers Are Rebuilding Asia's Internet for AI

  Hyperscalers are treating Asia’s internet backbone as strategic infrastructure, building new routes to support AI workloads, resilience, and regional scale.

• Can Nuclear Power Fuel Southeast Asia’s AI Boom?

  Southeast Asia’s AI ambitions are running into a power constraint, forcing governments and infrastructure buyers to consider whether nuclear can provide the firm clean electricity data centres need.

China is in the process of turning token consumption into an economic signal. In the West, the companies that followed “tokenmaxxing”—the practice of maximizing token consumption—are now pulling back. Leaderboards are coming down, licenses are being cancelled, and the metric is being publicly abandoned. For operators in Asia, that juxtaposition is worth understanding before it turns into a structural risk.

In April, Uber disclosed it had burned through its entire 2026 AI budget in just four months. Its COO later admitted there was no clear link between rising token consumption and better products for users. In the same month as Uber’s disclosure, Meta took down its internal token usage leaderboard after news of it leaked externally. The leaderboard, nicknamed “Claudeonomics”, was an employee-built dashboard that ranked employees by their AI token consumption. It started an internal race within the firm. In May, Microsoft cancelled Claude Code licenses, in part, reportedly, to cut its operation costs. The companies that were encouraging employees to burn through tokens are now reconsidering their approach.

In China, tokenmaxxing is moving in the opposite direction from the West, towards a greater sphere of influence—from vendor billing unit toward policy adjacent economic signal. At the 2026 China Development Forum in March, China’s National Data Administration declared tokens as the “settlement unit” linking technological supply with commercial demand, paving the way for tokens to be recognized as a new value system in monetizing the AI industry. Alibaba, Tencent, and ByteDance are increasingly placing token volume at the center of how they package, price, and measure enterprise AI usage.

The risk isn’t that tokens are becoming a pricing unit—that’s unavoidable. The risk is that token volume starts being treated as evidence of AI progress before organizations can show whether AI is actually improving throughput, reducing errors, or lowering cost-to-serve. China’s policy language is pushing tokens toward the center of AI measurement; operators elsewhere in Asia should be careful not to import that logic into contracts or performance reviews without first defining what business outcome the tokens are supposed to improve.

How Tokenmaxxing Became A Problem

Tokenmaxxing emerged from a combination of pressures that made token consumption something to optimize for.

The first was cultural pressure from the top. The most prominent voices in the industry frame token consumption as a signal of AI seriousness. Nvidia CEO Jensen Huang told engineers they should be spending tokens equivalent to at least half their annual salary. Meta’s CTO Andrew Bosworth pointed to his best engineers spending the equivalent of his salary in tokens while boosting productivity by five to tenfold, and said, as quoted by Fortune: “Keep doing it. No limit.”

The second pressure was competitive and defensive. Leaders who did not push aggressive AI adoption were being told that they were falling behind. Token consumption leaderboards like Meta’s Claudeonomics gave organizations a visible, shareable number that showcased AI transformation was happening inside the company. As The Information reported, some Meta employees with low token usage expressed concern about not being seen as sufficiently “AI native”, encouraging them to create hacks such as using transcription bots during meetings to inflate their scores.

The third pressure was structural: the metric was designed by the people who profit from its maximization. Token consumption is not a neutral measure of AI activity. It is the unit AI vendors bill in. OpenAI CEO Sam Altman articulated the industry’s direction plainly: “We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter.”

There is another reason why tokenmaxxing grew into a trend before people started pointing it out as a problem: the price signal was pointing in the wrong direction. Token costs have been falling consistently, and tech leaders had reason to believe costs were under control. That wasn’t the case when the bills came in.

The Pricing Trap

The cost of AI inference has dropped dramatically. For enterprise leaders, the metric looked sustainable. But the falling price obscured a compounding problem on the consumption side.

The shift from chatbot to agentic AI changed the consumption equation entirely. A chatbot answers a question. An agent pursues a goal autonomously, across multiple steps, calling a language model repeatedly until it reaches a result. Gartner found that agentic models require between 5 and 30 times more tokens per task than standard chatbot queries.

The result was a gap that widened dramatically. Cheaper tokens, deployed through agents running hundreds of model calls per workflow, produced invoices that do not resemble the original budget assumptions. At Meta, the leaderboard showed total token usage across the company rose from 60 trillion over the previous 30 days to 74 trillion the following week. Uber’s per-engineer monthly API costs reached between $500 and $2,000—a figure that, if multiplied across thousands of engineers, understandably exhausted the company’s annual budget in four months.

The correction started happening when teams began asking for results rather than chasing leaderboard positions.

Why China’s Tokenmaxxing Problem Is Bigger Than The West’s

There is a structural difference between what happened in the West and what is being built in China.

By March 2026, China’s daily token call volume had reached 140 trillion, up from 100 billion at the start of 2024. Liu Liehong, head of China’s National Data Administration, described this growth as an economic signal: evidence that China’s AI industry was evolving from simple dialogue systems to decision-making agents.

When a government tracks a metric as evidence of industrial progress, the organizations operating within that policy environment will optimize for it.

The corporate responses followed immediately. Alibaba announced the creation of the Alibaba Token Hub, a move to integrate its AI businesses. It was also the first time a Chinese internet company embedded the word “token” into its organizational structure. Tencent rebranded its model-as-a-service platform as TokenHub. ByteDance’s cloud computing and AI platform Volcano Engine reported 140 enterprise customers with token usage exceeding 1 trillion each, indicating strong growth for the token economy.

These are commercial architectures designed to make token consumption at the center of enterprise AI. And these infrastructures make their way into organizational culture. Kunlun Wanwei, a Chinese internet company, told its technical staff that those who use fewer tokens will be eliminated, in an effort to push its personnel to increase their R&D efficiency by 50% through AI tools.

What makes this harder to correct than the Western version is that the caution exists inside the system and is deprioritized. Li Qiang, vice president of Tencent Holdings, told Yicai: “Assuming tokens are fuel, if you only focus on fuel consumption without considering the economic efficiency of building the engine, the cost for users may be very high, and they will eventually abandon it.” Liu Weiguang, senior vice president of Alibaba Cloud, said: “Everyone must not think that tokens are the same.” Token volume without context is not a meaningful measure. Both companies understand the distortion, and they are building commercial infrastructure around token volume anyway.

That is what a structural problem looks like: people who understand the risks are participating in it, because the policy environment, the vendor commercial model, and the internal performance pressure are all pointing in the same direction. In the West, Meta could take down the leaderboard. There is no single dashboard to take down here.

Tokens are a fine unit for paying for AI, but they are a poor unit for knowing whether AI is working. When token volume shows up in a vendor proposal, a procurement framework, or a performance review, operators should ask the following question: what business outcome is this token spend supposed to improve? That question is the difference between tokens being a metric and a trap.

More from Asia Tech Lens

• Agentic AI Can Act. Singapore’s New Rulebook Says: Prove You Can Stop It
  As AI shifts from assistance to action, operators need bounded autonomy, audit trails, oversight, and rollback plans before deployment can be trusted.

• Before AI Can Work, Southeast Asia’s Enterprises Need To Fix Their Data Foundations
  Enterprise AI adoption in Southeast Asia will stall if operators scale tools before fixing the data, workflow ownership, and accountability layers underneath.

• Why Quantum Pilots Fail Before They Start—And What To Do About It
  A practical guide for senior operators on framing emerging-tech pilots around decisions and business outcomes before they become expensive experiments.

• AI and Private Equity: How AI Changes Cash Flows
  AI only matters when it changes cash flows, cost structures, or operational leverage—not when it merely increases activity or adoption metrics.

• China’s Compute Surplus Won’t Be Your Compute Surplus
  China’s AI infrastructure boom matters most to operators already inside the Chinese tech stack, where access, governance, and portability determine whether capacity is actually useful.

Singapore is not trying to win physical AI by building the flashiest humanoid robots or outscaling China’s manufacturing machine. Its opportunity is more specific - to become the controlled real-world testbed where AI-powered machines prove whether they can operate safely, reliably, and commercially outside polished demos.

That makes the city-state an interesting place to watch as the industry shifts toward embodied AI, also known as physical AI. Put simply, this is AI built into machines that can see, move, reason, and respond to the real world, rather than only generating text or images.

Many robots already use AI. What is changing is ambition. Instead of machines built for narrow, fixed tasks, the next wave is about systems that can read their surroundings and adjust as the conditions change. This could mean a factory system coordinating machines on the floor or a delivery robot navigating a busy building.

Several recent moves point to how Singapore wants to play this. NVIDIA plans to launch an embodied AI research hub there, giving the city-state global validation and research pull. Local startup Doozy Robotics shows the commercial ambition with plans announced in May to scale what it calls “Physical AI workforce” across the US and Asia, with a reported pipeline of more than $200 million.

Singapore-headquartered Sharpa points to another part of the story: the city-state’s emerging role in global robotics supply chains. Sharpa supplies robotic hands for a humanoid research platform involving NVIDIA and China’s Unitree.

But Punggol Digital District (PDD) is the clearest expression of Singapore’s bet. A physical AI testbed is expected later this year, giving companies and public agencies a place to find out what works, what breaks, and what is actually worth deploying.

Why It Matters Now

For the past two years, much of the AI conversation has centered on software with generative AI changing how people write and search.

With embodied AI, those capabilities are pushed into physical systems. NVIDIA’s CEO Jensen Huang has called this the “ChatGPT moment for physical AI,” when machines begin to “understand, reason, and act in the real world.”

But the shift creates a problem that software did not have. A language model can be tested at scale in a data center. A machine that needs to navigate a loading dock, avoid a forklift, and coordinate with three other robots cannot. It has to be tested in the real environment it will eventually work in.

That is what makes deployment hard. Physical AI becomes valuable only when it leaves controlled demos and enters messy, shared, human environments - factories, warehouses, public spaces, building sites. Those environments are unpredictable in ways that a lab or a staged demo is not.

Mei-Jung Chen, managing director and partner, Taipei, of BCG, argues that the excitement around physical AI comes from AI’s move into the real world, where it can change day-to-day operations and industrial processes, not just digital workflows.

This is why the opportunity could be much larger than robots. If embodied AI works, it could change how goods are moved, how facilities are managed, and how infrastructure is inspected. That raises the bar for deployment. Operators need to know whether these systems can work safely and reliably around people, equipment, and real operations.

Why Singapore Works As A Testbed

This is where Singapore’s testbed argument becomes important. Physical AI needs a place where machines can interact with people, buildings, roads, and security systems without putting public safety at risk.

Singapore has advantages here. It has dense infrastructure, advanced manufacturing, strong logistics networks, and a government that can coordinate closely with industry. It also has the kind of pressures that make automation worth testing, from high operating costs to labor constraints. These conditions can show whether an AI-powered machine is genuinely useful or only impressive in a staged setting.

Punggol Digital District (PDD) gives that experiment a physical home. As a mixed-use tech hub, it brings together business, research, education, and public spaces. That matters because physical AI will not mature in isolated labs alone.

“By leveraging the unique infrastructure of PDD, we can refine our autonomous robots in a real-world setting that mirrors the cities of the future,” said David Li, founder of Sharpa, which has partnered with JTC, Singapore’s industrial infrastructure agency, to deploy autonomous robots in the district.

The testbed could help companies find out what works in practice: whether robots can coordinate, navigate shared spaces, earn operators’ trust, and make economic sense. For Singapore, that is the bigger bet. It may not be trying to build the flashiest humanoid robot, but to become one of the places where physical AI is stress-tested before it scales.

Why Operators Need To Care

For industrial operators, physical AI could change the economics of automation. Traditional automation often relies on machines built for specific tasks, from robotic arms on production lines to warehouse systems on fixed routes. Physical AI promises more flexibility. It creates machines that can be retrained for new products, workflows, or operating conditions without replacing the whole setup.

BCG’s Mei-Jung Chen believes that this flexibility matters as companies rethink supply chains, bring some production closer to home, and struggle to find enough workers for repetitive or difficult jobs. In that context, physical AI becomes less of a tech experiment and more of an operational question.

For operators, physical AI has to earn its place in the workflow and fit into existing systems without creating new risks. Industrial enterprises should treat these systems as a long-term operational bet. “Don’t look at AI as an expense or a cost. It’s an investment for the future,” said Chen.

The competition is also moving quickly. In China, embodied AI is already being framed around industrial production, public services, and special operations, with state media saying the country’s embodied intelligence industry is growing at more than 50% a year. That figure shows the scale of China’s push. China’s advantage is industrial mobilization, manufacturing depth, and the ability to move quickly across production networks.

For Singapore, the challenge is turning dense infrastructure and high-profile partnerships into a practical advantage.

Singapore’s edge is different. It lies in trust, infrastructure density, regulatory coordination, and enterprise validation. In physical AI, those are not secondary advantages. They are what determine whether machines move from demo videos into daily operations. Whether Singapore can turn those advantages into a durable role in physical AI remains an open question. But it is one of the few places seriously trying to answer it in the real world.

More From Asia Tech Lens

• Singapore's Robots Don't Go Viral — They Go Global

  How Singapore's robotics startups are building for export, with orchestration software and no-code platforms emerging as the real competitive edge.

• Two Robots, One Plan

  Beijing's five-year plan bundles proven factory automation and speculative humanoid robots under the same policy umbrella and why that gap is the first thing operators in manufacturing need to close.

• China's Robot Spectacle Is an Industrial Strategy

  Why the Spring Festival Gala's humanoid showcase was less a technology demonstration and more a deliberate signal of China's push to move robots from controlled environments into the real world.

• Inside China's Bold Push to Build Humanoid Robots: Here Are 5 Companies Leading the Charge

  A close look at the Chinese companies turning humanoid robots from research-stage prototypes into industrial deployments.

• The Man Behind Unitree: Insights on AI, Adoption, and Growth

  Unitree's founder on the real bottlenecks holding back humanoid robots, why the industry's ChatGPT moment is still years away, and what foundations need to be built first.

For operators scouting AI infrastructure destinations, the signals coming out of India are hard to ignore. Microsoft’s largest data center in India is on track to go live in Hyderabad by mid-2026. Google has committed $15 billion to build its first AI hub in the country, which includes gigawatt data center operations. Amazon has signaled up to $35 billion investment by 2030, with AI-driven digitization among its stated priorities.

The case for following that capital is easy to make. The country holds 20% of the world’s data against 3% of global data center capacity, making it a compelling destination for AI infrastructure investment. And when hyperscalers commit billions to a market, smaller operators read it as validation: the market analysis is sound, the demand is there, the regulatory path has been cleared, and the supporting ecosystem will follow.

But these announcements do not tell you whether the infrastructure required to power AI workloads reliably is in place. The question is not whether India has enough electricity in general. It is whether the specific site an operator is building on can get a reliable power connection in time to meet its construction schedule and customer commitments.

The operators who will do well in the country are the ones who asked the power question before committing, not after. That way, they are in a position to plan around the constraints. Operators who skip that question risk arriving at a completed facility that is still waiting for a grid connection.

The Grid Cannot Keep Up

India’s data center capacity is expected to grow from approximately 1.4GW today to 9GW by 2030, according to the Institute for Energy Economics and Financial Analysis. In doing so, data centers are likely to consume about 3% of India’s electricity in 2030, up from less than 1% today. India’s national electricity grid was not designed for that kind of demand.

In the first quarter of 2026, India lost 300GWh of already-generated renewable power because transmission infrastructure could not carry it to where it was needed, according to energy think tank Ember. In other words, the electricity existed but the grid could not deliver it—a problem known as curtailment. If the transmission network cannot move power from where it is generated to where it is needed, it will struggle even more when a data center arrives demanding hundreds of megawatts around the clock. On top of that, India has met only about 80% of its annual targets for expanding transmission infrastructure over the past five years, and one in four major transmission schemes is already running a year or more behind schedule.

The transmission gap is one dimension of the problem. At the local level, the picture is no more reassuring. Even in India’s most established tech corridor power infrastructure remains an issue. Bangalore recorded planned power outages affecting places including Manyata Tech Park, one of India’s largest and most significant IT business hubs, as recently as February 2026. BESCOM, the Bangalore Electricity Supply Company, cited emergency maintenance on the substation infrastructure as the immediate cause, underscoring that even mature tech corridors aren’t immune to infrastructure friction. If that is the floor for the IT capital of India, the assumption that other cities such as Hyderabad and Visakhapatnam will fare better should be scrutinized.

Two Failure Modes, One Outcome

Operators evaluating India face two distinct failure modes. The outcome in both cases is the same: capital committed, construction finished, and a facility sitting idle while it waits for a grid connection that was not secured in advance.

The first is dependency risk. This is the operator whose deployment timeline is built around a hyperscaler facility. The assumption is that because Microsoft or Google has announced a data center in a given city, the surrounding infrastructure will be ready on the same schedule. But industry stakeholders have consistently flagged grid connectivity approvals as one of the main reasons data center projects in India run behind schedule, according to the Council on Energy, Environment and Water. Despite single-window clearance provisions in many states, delays persist in practice. An operator who has made commitments to customers and boards based on a hyperscaler’s announced opening date is exposed if that date slips or if the grid connection lags behind the construction timeline.

The second is execution risk. This is the operator who builds their own dedicated infrastructure but structures the investment around grid supply or renewable energy that does not arrive on schedule. In one case cited by infrastructure project advisory IMARC, a developer received news three months after committing to a site that state electricity board infrastructure would not be available for 18 to 24 months. When construction finishes and the grid connection is still pending, the capital has been spent, the customers are waiting, and the revenue that was supposed to follow the opening date keeps getting pushed back with it.

The difference between asking the power question early and discovering the answer late is the difference between managing a constraint and being managed by one.

What To Ask Before You Commit

None of this eliminates India as an option. But it changes what the homework looks like before the decision is made.

For operators, the decision is narrower than it appears. It is not whether India is the right market. It is whether to enter with a specific site, timeline, and customer commitment structure that can survive power delays. That means power readiness cannot sit behind land acquisition, construction planning, or sales commitments. It has to be tested before those decisions harden.

Operationally, there are four conditions that need to be tested before those decisions harden—not after.

The first is whether the grid connection has actually been secured and what date the facility is expected to receive power. This is to prevent a scenario where construction finishes on schedule while the grid connection is still being processed, leaving a completed facility with no power.

The second is whether power procurement relies entirely on the national grid, or whether it includes a backup source such as on-site renewable energy or battery storage. A facility that depends entirely on grid supply in a market where the transmission network is already under strain is taking on a risk that a mixed approach would reduce.

The third is what happens if the grid connection is delayed by six months. If the answer is that the facility simply waits, that scenario needs to be built into the investment case from the start, not treated as an unlikely edge case.

The fourth is whether the power situation at the specific site has actually been checked, not assumed based on the scale of national investment announcements. The fact that billions of dollars are flowing into India’s data center market says nothing about whether the local electricity supply at a particular site in Hyderabad or Visakhapatnam can support a large, continuous load. Bangalore’s planned power outages should act as a warning.

India is not a market to avoid. It is a market where power diligence has to move from the engineering appendix to the investment memo. Operators that make that shift early can still capture the opportunity. Those that treat hyperscaler announcements as proof of execution readiness may discover too late that demand was never the bottleneck.

More From Asia Tech Lens

• Is Southeast Asia Ready for an AI Data Center Surge?

  Malaysia and Indonesia are racing to position themselves as AI-ready hubs but power shortages, water constraints, and aging infrastructure are putting that ambition under pressure.

• Hot Chips, Cool Solutions: Asia’s Race to Reinvent Data Center Cooling

  Once power is secured, cooling is the next physical constraint. With AI workloads running hotter and denser, Asia’s data centers are being forced to rethink infrastructure from the ground up.

• Can Nuclear Power Fuel Southeast Asia’s AI Boom?

  AI is outgrowing Southeast Asia’s grid. Nuclear can close the gap, but only if governments move faster than reactors can be built.

• AI Boom Under the Sea: Hyperscalers Are Quietly Building Asia’s New Subsea Backbone

  The same constraint logic that applies to power applies to connectivity. Hyperscaler capital does not guarantee that the infrastructure underneath it is ready to scale.

• The Dependency Economy of AI

  Most national AI strategies still sit on hardware, models, and cloud stacks they don't control. A look at what 25 national strategies reveal about where the real chokepoints are and what resilience actually requires.