Indonesia's AI rules are written. Nobody can switch a system off.

Aditya Vikram Kashyap, a visiting senior fellow at the ISEAS institute in Singapore, puts one plain question to every AI rulebook in the region: if a ministry or a company wants to switch on a system that could hurt people, who can say no? Writing for Fulcrum, he draws a line between two things. One is governance presence: principles, committees and approval forms. The other is governance effectiveness: a named body that can refuse, delay or set conditions before the harm happens. He applies three tests. Is there an office with that power? Does it report to someone other than the people whose project it would block? And can its staff test the system and defend the decision?

Indonesia fails mostly on the first test. An ethics circular appeared in 2023. Two draft presidential regulations, one on a national AI roadmap and one on AI ethics, finished talks between ministries in May 2026 and were still unsigned in August. Penalties are expected to lean on laws that already exist rather than on anything new. The data protection authority that a 2022 law requires still had not been set up as of July 2026. The communications minister has warned government bodies not to use AI before their internal rules are ready, though Kashyap asks who would enforce that. The power to halt a deployment is scattered across sector regulators of very uneven size, and the coordinating ministry can give advice but has no clear power to stop anything.

Vietnam shows the other end. Its AI law passed in December 2025 and took effect in March 2026, with a list of 46 high-risk systems, in force since 15 August, that must be certified before they go into service. Malaysia put an AI Governance Bill out for consultation in July 2026 and wants it finished this year. Singapore's own tools are mostly voluntary, except in banking, where the central bank can bind the firms it licenses. Looking across everything published up to September 2026, Kashyap found no case of a Southeast Asian regulator stopping an AI deployment over its sponsor's objections.

Why it matters

If a system scores your loan application, your benefit claim or your place in a queue for a public service, there is at present no Indonesian office with a clear mandate to review it and no independent authority to take a complaint about your data. Two things would change that: signing the presidential regulations, and finally setting up the data protection authority. Jakarta is chasing AI investment while the safety rules sit in a drawer, and the investors it is courting can read that gap as easily as anyone else.