Brunei: Small State, Strategic Standards

Bandar Seri Begawan Builds AI Governance Ahead of the Curve

Brunei Darussalam has done something few expected from ASEAN's smallest economy: established credible AI governance foundations before most of its larger neighbours. Within the first four months of 2025, the country gazetted a comprehensive Personal Data Protection Order with real enforcement teeth and published a voluntary AI Governance and Ethics Guide aligned with ASEAN's regional framework. For a nation of 450,000 people, that is a notable pace.

The moves are strategic. Brunei's Wawasan 2035 vision requires economic diversification away from hydrocarbons, which still account for roughly half of GDP. AI governance is not an academic exercise here; it is infrastructure for the post-oil economy the country needs to build.

Data Protection with Enforcement Power

The Personal Data Protection Order 2025 (PDPO), gazetted on 8 January 2025, gives Brunei its first comprehensive data protection law. Unlike the voluntary AI guide that followed, the PDPO is binding with a tiered penalty structure that escalates from $10,000 to 10% of organisational turnover for companies exceeding $10 million in revenue, with criminal prosecution provisions for intentional data misuse.

The law applies to all private sector organisations and NGOs processing personal data in Brunei. It establishes individual rights over data collection, use, and disclosure, mandates data protection impact assessments, and restricts cross-border data transfers to jurisdictions with equivalent protections. AITI serves as the enforcement authority, with a one-year phased implementation period from January 2025.

"The Guide aims to harness accountable practices for AI systems, ensuring responsible interoperability regionally." — AITI, Authority for Info-Communications Technology Industry, Brunei Darussalam

The PDPO's cross-border transfer restrictions are particularly significant for a small economy integrated into regional supply chains. Companies relying on cloud services hosted outside Brunei will need to verify equivalent data protection standards in the receiving jurisdiction, or implement alternative safeguards.

Seven Principles, One Regional Framework

The Guide on AI Governance and Ethics, published by AITI in April 2025, establishes seven principles: transparency and explainability, data protection and governance, security and safety, robustness and reliability, fairness and equity, human centricity, and accountability and integrity. The guide is voluntary, technology and sector-neutral, and explicitly designed to evolve as AI capabilities change.

AITI convened a 25-member working group spanning government, industry, academia, and technology communities to develop the guide, with a public consultation period beginning in July 2024. Brunei has explicitly cited the ASEAN Guide on AI Governance and Ethics as a key reference in forming its own framework, ensuring regional interoperability whilst reflecting local values and priorities.

The principles-based approach is a conscious choice for a country where the AI ecosystem is still nascent. Prescriptive rules would risk being either too restrictive for the adoption Brunei needs or too specific for a technology landscape that shifts rapidly. The coherence between the voluntary AI guide and the binding PDPO creates a layered governance structure: hard law for data protection, soft law for broader AI ethics.

Infrastructure Advantage, Adoption Challenge

Brunei's paradox is that it has some of the best digital infrastructure in ASEAN but ranks 74th globally on AI readiness. Internet penetration of 98-99%, nationwide 5G coverage, 92% household fibre penetration, and a modern data centre at UNN's Kampong Tungku facility provide a strong physical foundation. The disconnect is in adoption, skills, and ecosystem scale.

The government is addressing this through multiple channels. The National AI Application Platform, launched in December 2025 through a UNN and EVYD Technology partnership, provides the first domestic AI infrastructure, initially supporting the Ministry of Health and BruHealth app. The AI Ready ASEAN Programme targets 20,000 Brunei citizens for foundational AI literacy. The BruneiID digital identification system and FormBN platform represent e-government initiatives that normalise digital service delivery.

Key digital transformation priorities include:

• Economic diversification from oil and gas dependence through AI-enabled sectors
• Sovereign cloud development to reduce reliance on foreign data infrastructure
• Workforce reskilling through the Brunei ICT Competency Framework (BIICF)
• Multi-ministry AI implementation coordination under a whole-of-nation approach
• Alignment with Singapore's governance model whilst maintaining local flexibility

Regional Voice Beyond Its Size

Brunei's governance positioning gives it a voice in ASEAN digital forums that exceeds its economic weight. The country will host the seventh ASEAN Digital Ministers' Meeting in Bandar Seri Begawan in January 2027, providing a platform to shape regional AI governance discussions. Its active participation in the ASEAN Working Group on AI Governance and the broader ASEAN-Business Advisory Council on digital growth strategy demonstrates sustained engagement.

The PDPO 2025 and AI Governance Guide together give Brunei concrete credentials when contributing to regional standards. Unlike some ASEAN members still operating without formal AI or data governance instruments, Brunei can point to published, operational frameworks, an advantage in consensus-based regional discussions where demonstrated commitment carries weight. This regional positioning complements the domestic diversification agenda under ASEAN's broader governance coordination.

"AI will be central to the next digital master plan." — Ministry of Transport and Infocommunications (MTIC), Brunei Darussalam

Does Brunei have a dedicated AI law?

No. Brunei has a voluntary AI Governance and Ethics Guide and a binding Personal Data Protection Order, but no dedicated AI legislation. The next Digital Master Plan (post-2025) is expected to include a more comprehensive AI governance framework, but binding AI-specific law is not yet on the immediate horizon.

How does the PDPO 2025 affect AI companies?

Any organisation processing personal data through AI systems must comply with the PDPO's consent, transparency, impact assessment, and cross-border transfer requirements. The one-year grace period from January 2025 gives companies time to prepare, with AITI enforcement beginning in 2026.

Why does Brunei rank 74th on AI readiness despite strong infrastructure?

AI readiness measures more than connectivity. Brunei's ranking reflects a small AI ecosystem, limited research capacity, narrow talent pipeline, and early-stage adoption. The infrastructure is a foundation, but translating it into a productive AI economy requires the workforce, investment, and governance frameworks now being built.

What should foreign companies know about data transfer rules?

The PDPO restricts cross-border data transfers to jurisdictions with equivalent data protection standards. Companies using overseas cloud services or processing Brunei citizen data offshore need to verify compliance or implement alternative safeguards before the grace period ends.

Brunei's combination of strong governance foundations, excellent infrastructure, and a clear economic diversification imperative creates an unusual profile in ASEAN's AI landscape. The question is whether the frameworks will attract the ecosystem they are designed to govern. What do you think Brunei's governance-first approach means for other small economies? Drop your take in the comments below.