Phnom Penh Lays the Groundwork for AI Governance as Readiness Gaps Come Into Focus
Cambodia is taking its first structured steps toward AI governance, assembling the building blocks of strategy, data protection law, and institutional capacity that more advanced ASEAN neighbours put in place years ago. The country completed a UNESCO-led AI Readiness Assessment in July 2025 and is now finalising a National AI Strategy with six priorities and 41 measures. The approach is deliberate: build foundations first, regulate later.
The pace reflects both ambition and constraint. Cambodia's Government AI Readiness ranking jumped 27 positions to 118th globally in 2025, the largest improvement among ASEAN members. But AI adoption remains at just 5.1%, infrastructure for advanced AI is limited, and the government's talent target is a modest 1,000 trained AI professionals by 2030. This is a country building from the ground up.
A Strategy Taking Shape Through International Partnership
The Ministry of Post and Telecommunications (MPTC) leads Cambodia's AI governance development, supported by UNESCO, UN-ESCAP, and the French Agency for Development (AFD). The Draft National AI Strategy 2025-2030 (Version 5) emerged from over a year of drafting, 12 internal meetings, two rounds of technical UN-ESCAP review, and a deep-dive workshop in Phnom Penh in April 2025.
The strategy's six priorities are human resource development, data and infrastructure, AI for digital government, sectoral adoption, ethical and responsible AI, and collaboration and innovation. These are underpinned by 41 concrete measures spanning skills training, open data platforms, digital government deployment, and governance framework development.
"Cambodia currently has limited capacity in AI, from a shortage of AI specialists and data scientists to absence of high-quality datasets and computing infrastructure." — Seng Sopheap, President, Cambodia Academy of Digital Technology (CADT)
The UNESCO AI Readiness Assessment, completed with engagement from over 300 stakeholders across 26 ministries, confirmed the scale of the challenge. Key findings included low AI literacy, fragmented governance, limited research capacity, and infrastructure constraints that make advanced AI training impossible domestically. Cambodia's response is to build systematically rather than rush to legislate.
By The Numbers
- 118th global Government AI Readiness ranking in 2025, up 27 positions from 145th in 2024 (Oxford Insights)
- 5.1% AI adoption rate among Cambodian businesses, compared to 27% in Malaysia (Netguru, 2026)
- $2.87 billion projected digital economy transaction value by 2027, up from $1.62 billion in 2023 (Cambodia Market Entry)
- 1,000 government target for trained AI and data science professionals by 2030 (Draft National AI Strategy)
- 60.7% internet penetration rate with 10.8 million users as of early 2025 (DataReportal)
Data Protection Law as the First Regulatory Building Block
Cambodia does not yet have a comprehensive AI law, but the Personal Data Protection Law is in final draft form and represents the most significant near-term regulatory development. Modelled on the EU's GDPR, the law establishes principles for transparent, responsible, and ethical personal data processing. Once passed, it will introduce consent requirements, purpose limitation, data subject rights, and mandatory data protection impact assessments.
A two-year implementation period is expected following promulgation, which could come in late 2025 or early 2026. Passage would make Cambodia the eighth ASEAN nation with comprehensive data privacy legislation. The law's relevance to AI governance is direct: any AI system processing personal data will need to comply with its requirements, creating a de facto regulatory floor for the most common AI applications.
A Cybersecurity Law remains stalled in draft form. International organisations including Access Now and the International Commission of Jurists have raised concerns about provisions that could undermine privacy rights and freedom of expression, and no definitive timeline for passage exists.
"Governance, in this sense, means overseeing everything from digital infrastructure and computational capabilities to model data and usage, as well as managing relationships between different actors in the AI market." — Khov Makara, Secretary of State, MPTC
The Philippines faces similar legislative consolidation challenges, though from a more advanced starting point with over 20 AI-related bills already filed in Congress. Cambodia's path is more sequential: data protection first, then AI-specific governance.
Unique Challenges in a Nascent AI Ecosystem
Cambodia's AI governance must contend with structural challenges that do not apply to wealthier ASEAN peers. The Khmer alphabet's 74 characters create barriers for natural language processing, and digital text datasets are limited compared to English or Chinese. Widespread use of voice messaging over written text further constrains the data available for training local-language AI models. At the agricultural level, many records are still kept manually, making AI-driven traceability and productivity gains difficult without fundamental digitisation.
Infrastructure is a binding constraint. Cambodia has no data centres capable of training advanced AI systems, and compute capacity is limited to a handful of commercial facilities. The planned National AI and Data Science Center, supported by AFD, will provide shared high-performance computing resources, but its timeline and capacity remain to be confirmed.
| Dimension | Status | Key Challenge |
|---|---|---|
| Workforce | Critical shortage | Only one-third of graduates pursue STEM; 1,000 AI talent target by 2030 |
| Infrastructure | Limited | No advanced data centres; compute capacity constrained |
| Data quality | Weak | Khmer language datasets scarce; manual record-keeping prevalent |
| Legal framework | Emerging | Data protection law in final draft; no AI-specific legislation |
| Governance | Developing | Strategy drafted; guidelines in preparation; portal launched |
ASEAN Alignment as a Governance Accelerator
Cambodia's participation in ASEAN AI governance forums is accelerating its domestic framework. MPTC represents Cambodia in the ASEAN Digital Ministers' Meeting, the Working Group on AI Governance, and has participated in the adoption of three key regional instruments: the ASEAN Guide on AI Governance and Ethics, the Expanded Guide for Generative AI, and the ASEAN Responsible AI Roadmap 2025-2030.
Secretary of State Keo Sothie has framed Cambodia's regulatory philosophy as "regulate, not strangulate," reflecting a pragmatic recognition that binding requirements imposed too early could hamper an AI ecosystem still in its formative stages. This aligns with ASEAN's broader preference for voluntary, principles-based governance, though some member states like Thailand and Vietnam are already moving toward binding legislation.
Key governance milestones ahead include:
- Passage of the Personal Data Protection Law (expected late 2025 or early 2026)
- Finalisation of the National AI Strategy 2025-2030 following public consultation
- Publication of the Cambodian Guidelines on AI Governance and Ethics
- Establishment of the National AI and Data Science Center with AFD
- Continued participation in ASEAN AI Safety Network capacity-building programmes
A Digital Economy Growing Faster Than Its Governance
Cambodia's digital economy is expanding rapidly. Transaction values reached $1.62 billion in 2023 and are projected to nearly double to $2.87 billion by 2027. The fintech sector has been particularly dynamic, with 19.5 million e-wallet users and over 1 billion digital transactions recorded. Internet penetration stands at 60.7%, with 10.8 million users connected.
This growth creates a governance urgency that the strategy aims to address. Without structured frameworks, AI adoption in financial services, e-commerce, and public administration will outpace the regulatory capacity to manage risks. The ASEAN-wide readiness gap is particularly acute in Cambodia, where the gap between digital economic activity and AI governance maturity is among the widest in the region.
When will Cambodia have a dedicated AI law?
Dedicated AI legislation is not expected for several years. Cambodia is following a sequential approach: data protection law first, national AI strategy and governance guidelines second, and AI-specific legislation only after these foundations are in place. A realistic timeline is 2028 or beyond.
What is the most important near-term regulatory change?
The Personal Data Protection Law, modelled on the GDPR and in final draft, will be Cambodia's first comprehensive data privacy legislation. Any organisation processing personal data through AI systems will need to comply once it takes effect, likely two years after promulgation.
How does Cambodia compare to Vietnam on AI governance?
Vietnam is significantly further advanced, having enacted Southeast Asia's first standalone AI law in 2026. Cambodia is still at the strategy and readiness assessment stage. However, Cambodia's 27-position improvement in global AI readiness rankings shows accelerating momentum.
What should foreign investors know?
Cambodia's regulatory environment remains permissive for now, but the direction is toward ASEAN-aligned governance. Companies establishing AI operations should plan for data protection compliance within two to three years and monitor the emerging AI governance framework for sector-specific requirements.
Cambodia's deliberate approach to AI governance offers a counterpoint to the rush-to-legislate trend seen elsewhere in ASEAN. As the country builds its foundations, the question is whether it can close the readiness gap fast enough to shape its AI future rather than simply react to it. What lessons can other emerging economies learn from Cambodia's approach? Drop your take in the comments below.