Flint advises international businesses and investors on policy, politics, regulation and competition.
Flint advises international businesses and investors on policy, politics, regulation and competition.
Quick links
Sectors
Follow Us
AI-Pac is Flint’s digest providing our take on major AI policy and regulatory developments in Asia-Pacific. In a fast-moving environment, this newsletter is designed to help you stay on top of the regulatory agenda and consider what it means for your business. Please see here for our previous blogs, spanning 2024 and 2025. In each blog, we set out:
The first part of 2026 saw increased political focus on AI-enabled systemic risks. The launch of Anthropic’s Mythos model prompted APAC regulators to reassess how advanced models are accessed, tested, and audited. At the same time, public concern and regulatory scrutiny around the impact of AI deepfakes intensified. Emerging AI labelling regimes aimed at tackling deepfakes in India and Vietnam deepened regulatory fragmentation and operational complexity. Meanwhile, policymakers took action to address the impact of AI companions on the wellbeing of young people in Australia and China.
In this digest:
If you would like to discuss how AI policy and regulation in Asia-Pacific will impact on your business, please get in touch with the team here.
APAC policymakers have moved quickly to respond to the launch of Mythos, Anthropic’s latest AI model capable of autonomously finding and exploiting software vulnerabilities.
In Asia-Pacific, leading financial services regulators have been at the forefront of the initial regulatory response, stepping up supervisory engagement through issuing warnings, coordinating with cybersecurity authorities, and intensifying dialogue with regulated institutions. Activity has been most pronounced in Singapore, India, Japan, and Hong Kong - for example, the National Payments Corporation of India (NPCI) is seeking early testing of Mythos and the Reserve Bank of India (RBI) is engaging with the US Federal Reserve and the Bank of England. The Hong Kong Monetary Authority (HKMA) will launch a Cyber Resilience Testing Framework to augment banks’ response and recovery capabilities.
For businesses deploying AI in the financial services and adjacent sectors, supervisory expectations around cyber resilience are expected to harden. This could include more stringent requirements for continuous vulnerability discovery programmes and AI-specific cyber stress tests. The Monetary Authority of Singapore (MAS) is already working with the Cybersecurity Agency of Singapore (CSA) to strengthen defences at critical infrastructure operators, while the RBI is developing broader guidance for banks entering enterprise partnerships that involve advanced AI systems.
Looking further ahead, the episode will also lead to further questions about regulatory access and which regulators gain the ability to to audit the most advanced foundational models. Reportedly, Anthropic limited Mythos’ access to trusted entities in the US and UK, including a small group of “handpicked”, US-headquartered tech companies. Several APAC countries are developing their advanced AI research and audit capabilities by establishing AI safety institutes, with Korea, Japan, Singapore, and China in the lead, followed by Australia and India. In this context, Anthropic’s restricted pre-release access may prompt policymakers in markets such as Korea to review the question of mandating regulatory access before advanced foundation models are made available in their markets.
In February, India hosted the AI Impact Summit. Two months on, there are early signals around which areas of focus at the Summit are translating into concrete policy action.
The dominant theme across the Summit was the challenge of AI diffusion for the Global South. There is growing consensus that while frontier AI capabilities are advancing rapidly, the gap between what is technically possible and what is being deployed at scale is widening. The focus therefore remains accelerating diffusion. Even those building at the cutting edge acknowledged that socio-economic transformation requires deployment at population scale with impact that can be measured and replicated.
The most promising evidence of this shift in narrative from technical capabilities to measurable human impact was demonstrated in the Global AI Impact Commons launched at the summit – showcasing real solutions that are emerging in agriculture, healthcare, education and governance and being deployed at population scale. It is now incumbent upon private and public sector stakeholders across Asia-Pacific to work together to ensure rapidly advancing AI capabilities translate into real-world impact. This includes concerted work to identify and address the factors hindering AI adoption on the ground in specific markets and sectors, whether that be access to compute capacity, high-quality data, or a lack of regulatory clarity.
AI sovereignty was another recurring theme at the Summit. The US government used the summit as a platform to reframe sovereignty on its own terms, pitching sovereignty as “owning and using best-in-class technology” and the US as enabling countries’ sovereign AI ambitions. Yet every country at the summit signalled a desire to move up the AI value chain from consumer to producer. Indian AI company, Sarvam, stated explicitly that it intends to build frontier models to compete with global competitors, even as it develops small, contextual models to serve India’s needs. At the same time, India also became a signatory to the US’s Pax Silica signatory, in which it has since been joined by the Philippines. The tension between maintaining access to global technology and pursuing AI sovereignty will shape the operating environment for businesses across APAC in the years ahead.
Although AI safety was not the primary focus of the Summit, it did feature senior political focus on the issue of deepfake content and its potential impact on individuals as well as broader societal stability. Ahead of the Summit, the Indian government proposed amendments to the IT Rules to target deepfakes, including a three-hour takedown rule for designated Significant Social Media Intermediaries (SSMIs). On 21 April, the Ministry of Electronics and Information Technology (MeitY) proposed further changes to India’s IT Rules that would require continuous, clearly visible labelling on AI-generated visual content. This followed a law in Vietnam that took effect on 1 March and mandated that AI-generated content be “conspicuously marked or labeled in a machine-readable format”.
Regulatory approaches, however, tend to diverge on whether and how they prescribe a specific labelling method. The requirement of persistent on-screen labels in India’s latest proposal - embedded with permanent metadata or provenance markers - would drastically reshape user experience. Policymakers in other APAC countries are asking whether a more risk-based, targeted approach might be appropriate. In Vietnam, it remains possible that visible labelling requirements will be focused only where there are “deception risks”, such as deepfakes simulating real persons or events.
The practical impact of these regimes will depend on implementing decrees and enforcement practice. India’s consultation runs until 7 May; and sustained criticisms of earlier draft amendments, particularly around a provision mandating compliance with MeitY-issued advisories, may delay finalisation. In Vietnam, technical labeling standards that describe acceptable label structures are still under development.
For companies operating across APAC markets, fragmented labelling requirements will create direct operational implications, particularly around the scalability, cost and effectiveness of various labelling approaches (e.g., machine-readable metadata vs. visible watermarks). High penalties for non-compliance (e.g., potentially up to 5% of local revenue in Vietnam’s case) heighten the need for early coordination between legal and technical teams, alongside close tracking of forthcoming enforcement provisions. Providers should also consider how best to mobilise effective industry coalitions that can advocate for interoperable technical standards that enable effective AI content tagging across jurisdictions.
Across APAC, there is increased regulatory attention to the implications of AI companions for the wellbeing and safety of young people.
In Australia, under the Online Safety Act and the Age-Restricted Material Codes that took effect on 9 March, the eSafety Commission is now explicitly monitoring AI companions for compliance with requirements around safety-by-design, age assurance, moderation, and protections against age-inappropriate material.
In China, five agencies issued interim rules on 10 April targeting “anthropomorphic interactive AI”, defined as those engaging in “emotional interaction with humans”. Effective from 15 July, the framework is among the world’s first national regimes to specifically regulate anthropomorphic AI. It imposes heightened protections for minors: banning virtual relative or virtual companion services for under-18s, mandating age-gating, minors’ modes, and requirements to issue risk alerts to minors’ guardians.
These measures respond to mounting concerns about addiction and self-harm as the use of AI companions grows. eSafety’s transparency report claimed that several popular AI companions failed to appropriately refer users that engaged in chats related to suicide or self-harm to appropriate support services. But there remain important policy questions around how regulation can strengthen protections for younger users while still being workable in practice. In one example, compared to the earlier draft released in December 2025, China’s latest interim rules relax certain technical requirements, such as removing the obligation for risk alerts to guardians to be issued “in real time”.
APAC governments are likely to observe early outcomes from Australia and China’s regimes, as well as recent US state-level AI companion safety laws (e.g., in California and New York), to inform further policy choices. One key question includes whether to age-gate AI companion tools, and whether shutting off children’s access to these tools is a proportionate and necessary response. These debates intersect with social media restrictions under consideration or implementation in the region - from Indonesia to Malaysia, Singapore, and Japan. For AI companion developers and providers, this creates a critical window to engage regulators on the technical and behavioural implications of age-based regulatory approaches.
This blog was written by Ewan Lusty, Partner, Sarah Lim, Manager, and Abigail Chen. Ewan and Sarah are based in Singapore and Abigail is based in Hong Kong. Over six years of working for Flint in Europe and Asia, Ewan has advised leading developers and deployers of AI on how to engage impactfully with governments on AI policy and regulation. Prior to that, he worked for the UK government, advising ministers on the UK's approach to regulating emerging technology. Sarah recently joined Flint from a Manager role at Singapore’s Ministry of Digital Development and Information (MDDI), during which she coordinated whole-of-government policy positions on AI governance under Singapore’s National AI Strategy 2.0.
In Asia-Pacific, Flint Global is a strategic advisory firm helping businesses and investors navigate political, regulatory, and geopolitical complexity across the region. We combine on-the-ground knowledge, regional expertise, and global insight to help clients manage risk, engage effectively with governments, and make informed commercial decisions that create competitive advantage.