Two governments are sitting down to decide what chips the world gets to buy. Neither of them is ours. That is the uncomfortable truth behind the latest round of US-China talks on AI technology, and it is a truth that lands directly on Malaysia's doorstep.
Here is the practical bit for you, up front. The AI tools you use at work, the cloud credits your startup burns through, the GPU capacity your company rents in Johor or Cyberjaya: all of it sits downstream of decisions being made in Washington and Beijing. When those two negotiate a truce on AI chip exports, the terms do not just move markets. They quietly redraw what is available to you, at what price, and on what timeline.
What is actually being negotiated
The short version: the United States has spent several years tightening export controls on advanced AI chips, primarily the high-end accelerators that train and run frontier models. China has responded with its own controls, its own domestic chip push, and leverage over rare earth materials and manufacturing capacity. Both sides have now found reasons to talk.
Any settlement between them is likely to touch three things. First, which chips can be sold where, and at what performance ceiling. Second, which companies land on restricted lists, and how broadly those lists reach into third countries. Third, the rules on re-export, meaning the conditions attached to hardware that passes through another country before reaching its final destination.
That third one is the one ASEAN should be reading twice. Re-export provisions are how export controls stop being a bilateral matter and start being everybody's problem. If a deal says advanced chips may be sold to a data centre operator in Southeast Asia only under certain verification conditions, that is not a US-China issue anymore. That is a Malaysian compliance issue, a Singaporean compliance issue, an Indonesian and Vietnamese one too.
Why Malaysia is unusually exposed
Malaysia did not stumble into the AI infrastructure conversation. We walked in deliberately. Johor has become one of the fastest-growing data centre markets in the region, fed by land, power, water and proximity to Singapore's capacity constraints. Penang and Kulim continue to anchor a semiconductor assembly, test and packaging ecosystem that has been building for fifty years. Add the announced investments from global cloud providers and chip firms, and you get a country that is materially committed to being AI infrastructure for the region.
That commitment is an asset. It is also an exposure. A country that hosts a lot of AI hardware is a country that a lot of people want rules about.
We have already seen a preview. Export control frameworks in recent years have included tiered country classifications, verification requirements for large GPU shipments, and scrutiny of whether restricted hardware might be reaching restricted end users through intermediary jurisdictions. Malaysia has had to respond to that scrutiny with its own permit requirements for certain high-performance chip transfers. That is the machinery already in motion, before any grand bargain is struck.
Now imagine a US-China deal that resets the tiers. Or one that trades looser access for China in exchange for tighter verification everywhere else. The terms could land favourably. They could also land badly. The point is that nobody in Putrajaya, Jakarta, Bangkok or Hanoi will be in the room when they are written.
How a deal reaches your actual work
It is easy to treat geopolitics as background noise. Let us make it concrete instead.
- Compute availability. If chip supply into the region tightens, cloud GPU capacity gets scarcer and pricier. Your fine-tuning run that costs a certain amount today may cost considerably more, or sit in a queue.
- Model access. Some AI models are governed by where their weights may be deployed and which hardware may serve them. A deal that reshapes those rules can change which models your regional cloud region is permitted to host.
- Vendor risk. Restricted entity lists move. A hardware or software vendor that is fine to work with this quarter may require a compliance review next quarter.
- Project timelines. Data centre buildouts run on multi-year hardware procurement schedules. Uncertainty in export rules pushes delivery dates and makes financing more expensive.
- Talent and investment flows. Capital follows regulatory clarity. Ambiguity about whether Malaysia is a trusted node or a watched one affects where the next facility gets built.
None of that shows up in a headline. All of it shows up in a procurement spreadsheet.
The bystander problem
Here is the structural issue. ASEAN, as a bloc, has roughly 680 million people and a rapidly digitalising economy. Individually, each member state is a modest negotiating counterparty. Collectively, we would be one of the largest AI infrastructure markets outside the two superpowers themselves.
But we tend to negotiate individually. Singapore manages its own relationship. Malaysia manages ours. Vietnam, Indonesia, Thailand and the Philippines do the same. Each bilateral conversation is reasonable on its own terms. Added together, they produce a region that can be approached one country at a time, which is a weaker position than the numbers justify.
There is also a quiet competitive dynamic at play. If one ASEAN country secures preferential treatment on chip access, that is a genuine advantage for attracting data centre investment. The incentive to cut your own deal is real. It is also, in the medium term, a trap. A region where members undercut each other on compliance terms is a region that ends up with the least favourable common denominator.
What a coordinated position could look like
Nobody is suggesting ASEAN should form a chip cartel. That is neither realistic nor desirable. But there is a lot of useful ground between "unified bloc" and "every country for itself."
A shared technical baseline would be a sensible start. If ASEAN members converged on common standards for chip import verification, end-user due diligence, and data centre security auditing, the region becomes easier to trust as a whole. That is leverage. A supplier deciding where to place capacity prefers a predictable multi-country framework over six different permit regimes.
A joint position on re-export terms would help too. Southeast Asian countries have a legitimate shared interest in ensuring that controls aimed at one destination do not collaterally restrict ordinary commercial AI adoption across the region. That argument is much stronger made once by ten countries than ten times by one.
And there is the longer play: regional compute capacity that is not entirely dependent on a single supply chain. Not autarky, which is fantasy, but diversification. More domestic packaging and testing capability. More regionally hosted model serving. More open-weight model expertise so that capability does not vanish if a particular API gets geofenced. Boleh lah, if the planning starts now rather than after the next shock.
What Malaysian tech teams should do this quarter
You cannot influence the negotiation. You can absolutely reduce your exposure to its outcome.
Start with an honest inventory. Which of your AI capabilities depend on a specific vendor, a specific chip generation, or a specific cloud region? Write it down. Most teams discover the dependency map is more concentrated than they assumed.
Then build in some portability. Abstraction layers over model providers are not glamorous engineering, but they turn a potential migration crisis into a configuration change. Teams using tools like LiteLLM or provider-agnostic SDK wrappers found switching far less painful during past disruptions. The same logic applies to infrastructure: keep your deployment tooling from hardcoding assumptions about a single region.
Evaluate open-weight models seriously, not just as a cost play. Being able to run a capable model on hardware you control, or on a regional provider you trust, is a hedge with real option value. The gap between open and frontier models has narrowed enough that for many production use cases it is a genuine alternative, not a compromise.
If you are procuring GPU capacity, ask hard questions about contract terms. What happens to your reservation if export rules change? Who carries the risk? Data centre operators are having these conversations with their own suppliers already. Make sure the answers flow through to your contract.
And if you work anywhere near policy, whether in an industry association, a chamber, or a government-linked entity, push for the regional conversation. Malaysia chaired ASEAN this year and has been vocal on regional digital coordination. The institutional channel exists. The question is whether AI infrastructure gets treated as urgent enough to use it.
The bigger point
There is a comfortable story where AI is a purely technical field, and the only thing that matters is whether your model is good and your engineering is sound. That story was never quite true, and it is getting less true every quarter.
AI capability now runs on a physical supply chain of fabs, packaging plants, power grids and shipping routes, and that supply chain has become an instrument of state policy. Malaysia has chosen to be an important node in that chain. That was the right call. It brings investment, jobs, and a seat at a table we would otherwise not be near.
But being important is not the same as being safe. Being important means the rules other people write apply to you with more force, not less. The US and China will settle their differences on terms that serve their interests. That is what governments do. The question for ASEAN is whether we show up to that outcome having thought about it in advance, or whether we read about it in the news and start adjusting after the fact.
Worth talking about over teh tarik, at minimum. Worth a coordinated regional position, ideally. Because the chips are going to keep shipping either way, and someone is going to decide where they land.