ASEAN Guide on AI Governance and Ethics

Provide disclosure on when an AI system is used and the involvement of AI, and communicate the reasoning behind AI decisions in an understandable way.

• Policy requiring disclosure of AI use
• Explainability approach/documentation for model decisions
• User-facing notices of AI involvement

• AI use not disclosed to affected users
• No explainability method for high-impact decisions
• Disclosure inconsistent across products

Ensure AI systems do not produce unjust bias or discriminatory outcomes and that similar individuals are treated similarly across the AI lifecycle.

• Fairness/bias assessment results
• Definition of fairness metrics for the use case
• Remediation records for identified bias

• Fairness not defined or measured
• Bias testing absent
• No remediation when bias found

Ensure the safety of developers, deployers and users by conducting impact and risk assessments, applying technical security measures, and minimising harm.

• Safety/security risk assessments
• Security testing (e.g. vulnerability assessment) records
• Fail-safe / harm-minimisation measures

• No security testing of AI systems
• Safety risks unassessed before deployment
• No fallback when the AI fails

Design, develop and deploy AI to benefit humans and respect human values throughout the AI system lifecycle, prioritising human well-being and safety.

• Evidence human well-being is a design objective
• User testing with varied/representative groups
• Decision to withhold or modify AI where not beneficial

• Human impact not considered in design
• No mechanism to halt harmful AI
• Vulnerable users not considered

Respect and uphold data privacy and protection during design, development and deployment, including privacy-by-design and adherence to applicable data protection laws.

• Data protection/governance framework for AI
• Privacy-by-design evidence
• Compliance with applicable data protection law (e.g. PDPA)

• Privacy not embedded in design
• No lawful basis for training data
• Data protection obligations unmet

Establish clear accountability for AI outcomes with appropriate oversight, integrity of data and systems, and mechanisms to take responsibility for decisions.

• Accountability framework assigning responsibility for AI decisions
• Oversight and audit records
• Integrity controls over data and models

• No one accountable for AI outcomes
• Oversight informal or absent
• Integrity of data/models unverified

Ensure AI systems function reliably and as intended, including in unexpected conditions, with access control and protection of critical or sensitive systems.

• Robustness/reliability testing
• Access control over critical AI systems
• Performance monitoring evidence

• Robustness untested against edge cases
• No protection of critical AI systems
• Reliability not monitored in production

During design, establish the intended commercial objectives of the AI system, ensure compatibility with the guiding principles, and weigh objectives against the risks of using AI, guided by corporate values.

• Documented AI objectives per system
• Assessment of objectives against principles and risks
• Documented rationale for deviations from corporate values

• Objectives undefined
• No assessment against the guiding principles
• Deviations from values undocumented

Evaluate AI solutions along the probability and severity of harm to users and individuals, considering nature, reversibility and durability of harm and impact on vulnerable groups.

• Risk matrix scoring probability and severity of harm
• Factors considered (nature/reversibility/vulnerable groups)
• Risk tier assigned per AI system

• Harm not assessed on probability and severity
• Vulnerable populations not considered
• Reversibility/durability of harm ignored

Based on the risk assessment, determine the category of human involvement, human-in-the-loop, human-over-the-loop, or human-out-of-the-loop, commensurate with the assessed risk.

• Documented human-involvement category per AI system
• Mapping of risk tier to oversight level
• Evidence the chosen oversight is operating

• Oversight level not tied to risk
• High-risk AI run autonomously
• Human involvement only nominal

Keep proper documentation of AI risk impact assessments (per the Annex A template) for audit purposes, and continually review and update them as systems and risks change.

• Completed AI risk impact assessments (Annex A style)
• Audit trail of assessments
• Update records as systems/risks change

• Risk assessments undocumented
• Assessments not updated as models iterate
• No audit trail for challenges

Guard against automation bias (rubber-stamping) where humans defer to AI outputs, and give special consideration to impacts on vulnerable or marginalised populations.

• Controls/checks to counter automation bias
• Evidence humans meaningfully assess AI outputs
• Special consideration of vulnerable groups

• Humans approve AI outputs without scrutiny
• No measure of override/disagreement rates
• Vulnerable groups not specifically protected

Put in place internal governance structures (e.g. an AI Ethics Board or Committee, multi-disciplinary) for oversight of how AI is designed, developed and deployed, with escalation of higher-risk use cases.

• Terms of reference for an AI oversight body
• Escalation procedure for higher-risk AI
• Records of governance body decisions

• No oversight body or designated function
• No escalation path for high-risk AI
• Governance structure not suited to org culture/size

Establish clear roles, terms of reference and responsibilities for personnel involved in responsible design, development and deployment of AI, including risk assessment and documentation duties.

• RACI / role definitions for AI governance
• Terms of reference for oversight roles
• Evidence responsibilities are exercised

• Roles undefined or unassigned
• Oversight composition not representative of functions
• Responsibilities documented but not performed

Develop AI governance policies, standards and a code of conduct for the ethical use of data and AI, with oversight mechanisms to ensure they are followed.

• AI ethics policy / code of conduct
• AI design principles and standards
• Oversight/compliance monitoring of policy

• No AI-specific policy or code of conduct
• Policies not enforced
• AI design principles undocumented

Provide guidance and training to personnel in the governance process and raise organisation-wide awareness of AI ethics, risks, benefits and limitations.

• AI ethics/governance training records
• Awareness materials and reach
• Capability-building / certification of key personnel

• No AI ethics training
• Awareness limited to a small team
• Personnel cannot interpret AI outputs or detect harm

Periodically review and assess the sufficiency and effectiveness of the governance model and controls across the AI lifecycle, updating to keep pace with AI developments.

• Periodic governance review records
• Assessment of control effectiveness across the lifecycle
• Updates resulting from reviews

• Governance model never reviewed
• No assessment of control effectiveness
• Reviews not acted upon

Take account of organisation size and capabilities, applying a risk-based approach where a full multi-disciplinary body is too onerous, focusing on the risks the structure addresses.

• Rationale for the chosen governance scale
• Risk-based prioritisation of governance effort
• Evidence key risks are still addressed

• One-size-fits-all governance regardless of risk
• Small org abandons governance entirely
• Key risks left unaddressed when scaling down

Governments should nurture AI talent and upskill the workforce to support AI adoption and governance.

• National AI talent / upskilling programmes
• Workforce development initiatives

• No national AI skills strategy
• Workforce upskilling not funded

Governments should invest in AI research and development, build talent pools and digital infrastructure, and foster research partnerships.

• National AI R&D investment
• Digital infrastructure for AI
• Triple-helix (research/private/government) partnerships

• No national AI R&D investment
• Inadequate digital infrastructure
• No research partnerships

Governments should foster the AI innovation ecosystem, promote investment in AI start-ups, and enable cross-border data flows with appropriate data protection.

• Measures supporting AI start-ups and investment
• Cross-border data flow facilitation with safeguards
• Enabling policy environment

• No support for AI start-ups
• Cross-border data flows blocked or unsafe
• Policy environment hostile to AI investment

Define the problem statement, conduct risk-based assessments before data collection or modelling, assign roles and accountability, and consider third-party and environmental impacts.

• Documented problem statement and objectives
• Pre-development risk assessment
• Defined roles/accountability and third-party considerations

• Development begins without risk assessment
• Roles/accountability undefined
• Third-party/environmental impact ignored

Where AI or components are sourced from third-party developers or vendors, define responsibilities, due diligence and governance over the third-party AI and foundation models.

• Third-party/vendor AI due diligence
• Contractual responsibilities for AI governance
• Ongoing oversight of third-party AI components

• Third-party AI used without due diligence
• Responsibilities with vendor undefined
• No oversight of foundation-model suppliers

Ensure data used for training, testing and validation is sufficiently representative and of adequate quality, monitored across target populations to mitigate bias.

• Data quality and representativeness checks
• Performance evaluation across population segments
• Separate training/testing/validation datasets

• Training data not representative
• Quality of data unassessed
• Single dataset reused for train/test/validate

Identify and mitigate types of bias (representation, societal, labelling, measurement, activity, proxy) through dataset design, labelling quality assurance, and regular bias evaluation.

• Bias type analysis across the pipeline
• Labelling quality assurance and labeller training
• Regular bias evaluation and mitigation records

• Bias types not analysed
• Labelling bias uncontrolled
• Bias evaluated once, not regularly

Track data provenance and lineage, apply data minimisation and protection, and conduct a data protection impact assessment when sourcing and processing data for AI.

• Data provenance/lineage records
• Data protection impact assessment for AI data
• Minimisation and security controls over AI data

• Provenance of training data unknown
• No DPIA for AI data processing
• Excessive data retained without basis

Adopt explainability practices so the functioning of the model and how it arrives at decisions can be communicated to relevant stakeholders.

• Explainability techniques applied and documented
• Explanations suited to the audience
• Evidence explanations are available for review

• Black-box models with no explanation
• Explanations not meaningful to users
• Explainability not documented

Ensure the AI system can consistently obtain the same results given the same scenario (repeatability) and that results can be reproduced, supporting reliability and trust.

• Repeatability/reproducibility test results
• Recorded scenarios and outcomes
• Configuration captured to reproduce results

• Results not reproducible
• No repeatability testing
• Model/config not version-captured

Test the robustness and security of AI systems, including against adversarial inputs, especially for public-facing systems (e.g. robustness tests, red teaming).

• Robustness/adversarial test results
• Red-teaming or bug-bounty records
• Mitigations for identified weaknesses

• No adversarial/robustness testing
• Public-facing AI not hardened
• Weaknesses found but not mitigated

Maintain traceability and audit trails of AI system and user behaviour to support periodic risk assessment, accountability and review.

• Logging of system and user behaviour
• Audit trail enabling traceability
• Retention sufficient for review/challenge

• No logging of AI decisions
• Audit trail incomplete
• Logs not retained long enough

Validate before deployment and continue to monitor and review deployed AI systems for performance and drift, with regular tuning to ensure they perform as intended.

• Pre-deployment validation records
• Production monitoring incl. drift detection
• Tuning/retraining and review records

• No pre-deployment validation
• No monitoring for drift
• Models not re-tuned as performance degrades

Set up an ASEAN Working Group on AI Governance to drive and oversee the technical and operational implementation of AI governance action plans in the region.

• Established ASEAN Working Group on AI Governance
• Defined responsibilities and action plans
• Member State representation

• No regional coordinating body
• Action plans undefined
• Uneven Member State participation

Promote regional alignment of AI frameworks, international cooperation on AI governance, and interoperability across jurisdictions.

• Initiatives aligning AI frameworks across ASEAN
• International cooperation activities
• Interoperability/compendium efforts

• Fragmented national approaches
• No international cooperation
• Frameworks not interoperable

Develop a stakeholder communication policy identifying audience, purpose and context, and disclose to users when AI is used and how it affects them.

• Stakeholder communication policy
• User disclosure that AI is in use
• Tailoring of communication to audience

• No communication policy
• AI use not disclosed
• Communication not suited to the audience

Provide feedback channels and mechanisms for users to raise issues and, where relevant, correct their data, and manage that feedback.

• Operational feedback channel
• Process for managing and actioning feedback
• Mechanism for users to correct their data

• No feedback channel
• Feedback received but not actioned
• No way for users to correct data

Where reasonable, provide channels for AI-influenced decisions to be reviewed by a human and for users to seek recourse.

• Decision review channel with human review
• Recourse/appeal process
• Records of reviewed decisions and outcomes

• No human review of contested decisions
• No recourse mechanism
• Review channel exists but unused/unstaffed

Set up acceptable use policies that outline the boundaries for interacting with AI systems.

• Acceptable use policy for AI systems
• Communication of usage boundaries to users
• Enforcement of acceptable use

• No acceptable use policy
• Boundaries not communicated
• Policy not enforced