Southeast Asian governments are adopting Chinese digital infrastructure at scale but are deliberately keeping Beijing's governance model at arm's length, according to an analysis published in The Diplomat by researcher Ilaria Carrozza. The findings challenge the assumption that hardware dependency translates into normative influence — a distinction with significant implications for the global contest over digital standards.

Technology Without the Rulebook

Countries including Indonesia, Malaysia, and the Philippines have accepted Chinese technology for building out their digital infrastructure while anchoring their regulatory frameworks in Western and international norms. The pattern, Carrozza argues, reflects deliberate agency rather than oversight.

In Indonesia, the national cyber agency BSSN grounds its guidance in ISO 27001, the internationally recognised standard for information security management. Banks operate under central bank regulations, fintech firms answer to the financial services authority, and the entire architecture, according to one member of Indonesia's cybersecurity community, 'aligns ultimately with international standards.' Indonesian officials frequently invoke digital sovereignty in public discourse, but the rules their institutions actually enforce were, the analysis notes, 'mostly written in Geneva and Washington.'

Malaysia and the Philippines Follow a Similar Pattern

Malaysia's cybersecurity governance evolved in direct response to UN processes, and Kuala Lumpur has formally endorsed UN norms of responsible state behaviour in cyberspace. Its capacity-building partners are Canadian firms and EU programmes — not Chinese ones.

The Philippines aligns even more explicitly with the West. Its Data Privacy Act was consciously modelled on the European GDPR, and officials describe international cybersecurity governance as a Western-dominated domain. Carrozza concludes that 'in cybersecurity, it seems that balance was struck long ago in favour of the incumbent powers rather than Beijing.'

Why Beijing's Standards Are Losing Ground

The analysis points to structural inertia as a key factor. Once a country's banks, telecoms, and certification regimes are built on ISO and Western frameworks, the cost of switching becomes prohibitive, with each new regulation layering on top of the existing architecture. 'Beijing arrived to the standards race decades late,' Carrozza observes.

Compounding this is widespread official mistrust of Chinese platforms — sentiments that, the research found, were voiced repeatedly in interviews, even by officials in governments that had willingly accepted Chinese infrastructure. Crucially, none of the governments studied appeared to be looking to Beijing for regulatory models, even in areas where Chinese technology is most deeply embedded.

Where the Real Contest Is Playing Out

Carrozza argues that the physical infrastructure debate misses the more consequential battleground: standard-setting bodies such as the ISO, the International Telecommunication Union (ITU), regional regulatory forums, and ASEAN's emerging AI governance track. It is in these venues that the rules attached to the hardware are actually written.

The West's primary advantage, she notes, is that its standards are already the region's default — but that lead is not self-sustaining. The analysis calls on Washington to resist demanding alignment from Southeast Asian states, arguing that ASEAN's hedging culture rejects such pressure. Instead, supporting regulatory capacity, legal reform, and training — without requiring political alignment — could reinforce the filtering mechanisms that have so far kept Beijing's governance model at bay.

On AI governance specifically, Carrozza flags the outcome as most uncertain, urging the US to fund Southeast Asian participation in international AI forums, engage ASEAN's governance process as a serious partner, and offer frameworks worth borrowing. Whether Washington shows up consistently for that contest may determine who ultimately writes the rules for the region's digital future.