As the digital finance space can well attest, there’s a big difference between innovation, and implementation and adoption. Often enough, expanding open banking and open data regimes, or advertised SuperApp capabilities, were hampered by a bevy of technical or market shortcomings leaving a yawning gap between access and usage. In the nascent AI era, the challenge becomes a matter of learning from past mistakes and preparing the technical and regulatory terrain so AI’s potential can be fully realized. Achieving a smooth on-ramp to an AI-enabled economy and society will require a cohesive, strategic, all-hands-on-deck approach: aligning technical components and a well-calibrated regulatory regime in all facets to facilitate an exponential trajectory for AI capabilities and adoption.

Building On — And Beyond — DPI

Are there lessons for AI to take from the success and failures in preceding digital public infrastructure (DPI) projects? Some — though in critical aspects, AI possesses strikingly different dynamics.

Steve Haley is the Director of Marketing and Partnerships at the Mojaloop Foundation, whose project offers open-source software for interoperable and instant payment systems around the world. He recognizes that undergirding both DPI projects and AI is the critical aspect of data privacy, security and stewardship. Likewise, cloud capabilities serve as critical infrastructure for any country’s DPI or AI regime. The yearslong struggle among development-oriented digital service enterprises like Mojaloop have already done quite a bit of work in getting governments to coalesce their various ministries, regulations and infrastructures in a forward-thinking approach. Promoting open-source technologies has further helped in aspects of self-sufficiency.

“What was done before was the World Bank comes in and just says, ‘we'll give you a loan, but basically, trust us to procure a vendor for you. Trust us to build it for you. Trust us to do all this stuff. You guys just sit back and repay the loan and don't ask us any other questions. But the conversations that we're having with central banks and governments now are way more nuanced than we were four years ago.”
Steve Haley - Director of Marketing and Partnerships, Mojaloop Foundation

The earlier struggles of digital service providers to onboard and coalesce government ministries and legislative bodies have softened the terrain for AI’s own regulatory path, and AI already has comparative advantages in regulatory alignment than digital financial services did. In its quest to onboard an open-source inclusive payments platform, Mojaloop was tasked with managing relationships with a variety of regulators across the already well-established public financial system, each of which could torpedo initiatives — regulators for mobile money, microfinancing and banking, to name a few. And layers of newly created digital transformation offices, often enough, were stymied or slowed by a given country’s central bank, without whose support any initiative towards building out an instant and inclusive payment system would be near-impossible.

AI doesn’t have to contend with any of that. While AI builds on preexisting data governance structures meticulously built over the last 15 years, as an essentially novel technology with unprecedented capabilities, the regulatory and market landscape for AI is a blank slate, supported by preexisting structures, yet held back by none. Enabling public infrastructure for AI is subsequently far more straightforward, if still requiring considerable capital spanning compute, power, skills and technological prowess.

The Building Blocks

Carrying over the lessons of the preceding digital revolution, Miriam Stankovich, an AI and data governance expert who has advised a multitude of countries on their AI policy and implementation approach, preaches a simple formula: “people + processes + technology = successful digital transformation initiatives.”

Fundamentally, Stankovich considers a country’s AI readiness as comprising three components:

1. Minimum technical enablers such as reliable connectivity, cloud and compute access, secure and interoperable data infrastructure, and a skilled workforce
2. Fit-for-purpose governance combining safeguards such as data protection with AI-specific risk management and accountability mechanisms
3. Institutional capacity to implement, monitor and learn

These foundational layers provide the enabling environment for investment, innovation and application to turn initiatives into real world results. Stankovich offers as examples places like Pakistan, where a cabinet-approved National AI Policy gave way to an implementation council that funded workstreams across a dozen categories, or in Serbia, whose national data centers, high computing clusters, and AI factories have been paired with ethics guidance and a draft AI law.

Source: UNCTAD

Excelling in one area of AI’s readiness building blocks but lacking in others proves fatal in auguring true uptake — an “all of the above” requirement straddling both infrastructure and regulations that mirrors quite well the demands of instant payment schemes.

“Strong infrastructure without trust caps adoption. Strong governance without delivery undermines credibility. You can sequence, but you cannot substitute.”
Miriam Stankovich - AI in public service expert

But there isn’t just one way to do it. The regulatory approach to AI has already diverged quite a bit across geographic and political verticals, with regulation often trailing the private sector-driven push for generative AI models. This has manifested in places like the U.S. — lacking in any AI-specific regulations on the books so far — where the AI giants are now having to fend off lawsuits regarding the alleged improper use of data to fuel gen AI models, including over 50 in the U.S. and roughly 25 in other countries. Outside of the EU, whose combined GDPR and AI Act together provide a risk-based model prescribing “clarity of obligations and a compliance spine,” as Stankovich puts it, there is often little regulation on the books that directly addresses the unique dynamics and challenges of AI. From Stankovich’s vantage point, the U.S.’ sectoral and guidance-driven approach fosters rapid innovation, while ASEAN countries tend towards voluntary and principles-based methods prioritizing regional alignment.

While courts may fill in the gaps in the interim, such an approach alone risks “unevenness and regulatory surprises” that threaten to chill investment. Rather, judges need to get properly educated on the nuances of AI governance to update legal priors to match AI realities, says Stankovich. And in the meanwhile, government agencies must begin cultivating rules that are adaptive to changes happening faster than legislation alone can keep up with.

“Mitigation involves publishing technical guidance, running sandboxes, and issuing procurement standards, so that agencies and vendors are not waiting for a landmark case to learn the rules.”
Miriam Stankovich - AI in public service expert

While legislation alone may treat different AI engines similarly where key critical differences exist, a series of operational tools can better address the nuanced characteristics of various AI engines and capabilities, says Stankovich:

1. Algorithmic impact assessments (AIAs) to be utilized for medium-and high-risk AI systems before deployment. Such assessments should “document purposes, datasets, bias testing, human oversight mechanisms and mitigations measures,” says Stankovich, who cited Jordan’s e-audit system she helped create as an example of embedding both AIAs and data protection impact assessments (DPIAs) as part of the approval workflow.

2. Procurement standards: Another tool Stankovich is advising countries on adds ethical AI requirements directly into procurement templates, including evaluation protocols, red teaming, explainability obligations and incident reporting in statements of work. “In Moldova’s digital transformation efforts,” says Stankovich, “we have demonstrated how procurement can be the single strongest governance lever to ensure systems are thoroughly tested before rollout.”

3. Transparency tools: Stankovich has advised governments to mandate the use of model cards and data sheets in AI projects so that the intended use, limitations and provenance of data and models are made more explicit, offering a baseline for regulatory oversight and reducing black box deployment.

4. Internal oversight capacity, such as training inspectorates, audit offices, and ombudsman units to review AI deployments: Stankovich worked with Ukraine’s Pro-Integrity program to link risk controls to anti-corruption use cases while educating internal auditors on the right questions to ask about data sources, fairness and accountability.

Combining these agency tools with existing international resources, like UNESCO’s AI and Rule of Law Toolkit, gives countries the ability to adapt preexisting regulatory statues to the transient character of AI in its early going. And while there may be some partial convergence across jurisdictions on aspects such as risk, transparency and accountability, through adoption of standards such as ISO or the NIST AI RMF, local considerations spanning culture, capital and legacy systems still impact the specific system design. It is with this in mind that Stankovich believes in the different models straddling the U.S., the Europe and Asia, there is no real “winner” so far — “I see complementary toolkits”.

Malaysia’s Multi-Tiered Alignment

At once, these dynamics suggest a simultaneous need to build on preexisting infrastructure and systems, and an opportunity to leapfrog, but only with all the necessary components aligned. “Where countries skip data quality, procurement reform and change management, the cycle repeats,” said Stankovich. “Where they stage deployments and fund governance alongside pilots, the cycle bends toward real impact.”

A country that has transformed in recent decades into a robust manufacturing and service sector-based economy, Malaysia is now pushing towards high-income status, and a lot of this comes with smart strategic planning from the public sector. Years spent developing the digital sector is now carrying over to AI, where Oxford Insights ranked Malaysia 24th last year in the world when it comes to AI preparedness, scoring particularly high marks in aspects of government and data & infrastructure — or what government policy and public sector action can most directly influence.

Source: Oxford Insights

Malaysia’s initiatives to boost its AI readiness run the gamut of needs. Billions of dollars have been committed to upgrading the national grid. A quarter billion dollars is being spent to build homegrown GPU chips. And a national cloud policy have further added to a rush of investments by hyperscalers to build out AI-native data centers, including from the likes of Microsoft, Google, AWS and Oracle. Areas that remain perceived weak points, such as a relative lack of skills and R&D, are currently being addressed through the government’s strategic investment fund.

At the same time, Malaysia has taken a similar regulatory approach as many of its ASEAN counterparts by being among the first to release national guidelines on AI governance and ethics (AIGE) in 2024, setting seven core AI principles that are instructive, but non-binding. According to Shamsul Majid, the head of Malaysia’s National AI Office (NAIO), Malaysia is looking into the possibility of having an AI Act in the future — but, for the sake of innovation, not too soon.

“The use of voluntary guidelines by Malaysia and many other nations in the AI field is a strategic choice rooted in the need to balance innovation with ethical safety. AI is a diverse, rapidly evolving technology, and therefore mandatory, rigid regulations can quickly become obsolete, slowing down research and development by placing high compliance costs onto the industry.”
Shamsul Majid - Director, Malaysia’s National AI Office

Rather, Malaysia has legislatively focused on improving data protection laws to prepare for an AI-driven economy. Since 2024, Malaysia’s government has implemented amendments to its Personal Data Protection Act (PDPA) that, among other changes, impose higher penalties for non-compliance, implement new data breach requirements, expand data portability rights, broaden data categories and facilitate a risk-based cross-border data transfer framework. Such changes better align Malaysia with data protection standards abroad, such as GDPR, allowing Malaysia to combine domestic development with international partnerships to position the country as a regional leader.

Source: Malaysia AI Roadmap, The Lead

Most important in this focused effort to align all the levers of legislature, government agencies and the private sector towards AI transformation is the establishment of Malaysia’s National AI Office (NAIO) last year. The NAIO coordinates national policy, regulation and strategy, while also working with regional partners — such as hosting the recent ASEAN AI Summit in August — and domestic policy stakeholders, ministries, and the private sector across the spectrum of size and supply chain.

With SMEs driving 97% of Malaysia’s economy, Majid sees onboarding them as critical to NAIO’s mission to transform Malaysia’s economy into a truly AI-powered one.

“[Providing SMEs] access to AI via things like credits…simple AI templates and AI marketplace ensures that the secret sauce of our economy, which are SMEs, will be able to adopt and drive AI easier, and in turn drive economic returns over the next five years.”
Shamsul Majid - Director, Malaysia’s National AI Office

Majid notes examples in recent months like the world’s first Shariah-aligned LLM and a multimodal LLM as cases where Malaysia’s linguistic and religious diversity, coupled with the challenging geographic terrain, can — when solved for — be exported abroad as well.

The running theme in Malaysia’s success in these ventures is balance, and clarity: by executing multiple layers of infrastructural and regulatory needs at once, and in synchronization with each other, Majid believes NAIO is creating the proper environment for the flood of investment coming in and the flexibility for innovations to spring forth.

“Malaysia offers a stable policy environment alongside its skill talent pool and strong regional connectivity, all of which makes us an attractive hub for attracting investment from the hyperscalers. The government plays an active role with clear investment pipelines, fast tracking approvals and talent programs designed to meet industry demand. So, where we are today is to move from simply building capacity to putting it to work — through compute credits, sandboxes and flagship AI use cases to create real world demand.”
Shamsul Majid - Director, Malaysia’s National AI Office

Without legacy systems holding Malaysia back, Majid views AI as a “leapfrog” opportunity that at the same time is a “national extension” of Malaysia’s decade-long investments in digital infrastructure, governance and innovation. “The priority is to move forward with a clear strategy in which its outcomes are inclusive, ethical and measurable,” said the NAIO director.

Formula As A Baseline

Across AI verticals, Malaysia’s destiny may be that of an international partner, a domestic innovator, and a regional exporter on niche use cases pertaining to its strengths. Adapting that approach elsewhere requires clear strategic thinking, but it is doable nonetheless — even in lower-capacity environments.

Source: African Union’s Continental Artificial Intelligence Strategy

Building on her work doing so in places like the Balkans, Stankovich suggests lower-capacity countries to pick three high-value public sector use cases, right-sizing them to common machine learning operations and data environments and pairing them with a light-touch sandbox and guidelines that ties testing to real procurement.

The infrastructural requirements are a non-negotiable and maintaining such a strategic vision and accompanying administerial levers that are at once cohesive, stable and flexible is easier said than done. But as countries prioritize AI innovation and deployment, the formula becomes clearer as a baseline to maximize AI’s potential impact.

Image courtesy of Immo Wegmann
Click here to subscribe and receive a weekly Mondato Insight directly to your inbox.