This article first appeared in Digital Edge, The Edge Malaysia Weekly on December 29, 2025 - January 4, 2026

For firms exporting into the European Union, the expanding web of regulatory obligations under the Artificial Intelligence Act (EU AI Act) has introduced new layers of complexity in procurement, compliance and customer expectations.

While industry pressure has led to some timeline adjustments, full enforcement, set for 2027, remains firmly on track. Unlike the General Data Protection Regulation (GDPR), the AI Act carries even steeper penalties, with fines reaching up to 7% of global turnover for non-compliance.

While some companies may baulk at the scale of investment required, establishing an internal AI function and governance policy is no longer optional. It is the clearest path not only to legal compliance but also to long-term operational resilience and to trust, both internally and externally.

Policymakers in Brussels remain caught between two competing imperatives. One is a pro-competitiveness agenda focused on streamlining digital regulation and reducing compliance burdens, particularly for small and medium enterprises (SMEs). The other is the EU’s enduring ambition to serve as the world’s digital regulator, setting global benchmarks for AI ethics, safety and consumer protection.

These tensions came to a head this year, when more than 40 CEOs from major European firms called for a two-year “clock stop” on enforcement, warning that the Act’s speed and complexity risked stifling innovation.

The European Commission responded pragmatically: The timelines remain, but implementation support has increased through simplification measures, SME guidance, and the launch of the AI Act Service Desk and the EU AI Office.

The message is clear: simplification, not suspension. But within that clarity lies opportunity for businesses that act early, turning compliance into a competitive edge.

Firms must identify where AI is being used, whether in customer-facing tools, internal decision-making, HR processes, healthcare, credit scoring or autonomous operations. Without an inventory, there can be no strategy.

Crucially, firms need clarity on whether any of these systems fall under the EU’s “high-risk AI” categories, which will determine the level of regulatory scrutiny.

Across Asean, leading firms are already recognising this need. Singapore’s DBS has implemented a Responsible AI Framework for credit and customer-decision systems, while Indonesia’s Telkom has launched an AI Centre of Excellence.

Next, firms need an AI compliance lead. This dedicated role (or team) should be responsible for monitoring regulatory developments, managing AI platform usage, and serving as the internal knowledge hub for AI governance.

In larger organisations, this function should be supported by an AI ethics or oversight committee to embed accountability across design, procurement and deployment to give leadership visibility into emerging legal and reputational risks.

This is not only about legal alignment but also about internal capability. Penta’s research reveals a gap: While senior leaders often believe AI training is sufficient, employees report the opposite. This disconnect creates organisational risk.

A strong AI function can help diagnose these weaknesses and build tailored programmes to close them.

EU policymakers have made workforce readiness a central part of AI adoption. Asean firms must prioritise training on ethical use, bias mitigation and explainability, skills that are increasingly viewed as critical by European buyers, investors and regulators.

This mirrors an emerging trend in Malaysia, where leading exporters in sectors such as medical devices and electronics report rising EU requests for documentation on AI-assisted processes during environmental, social and governance (ESG) and supply-chain audits.

In parallel, firms should begin aligning with international AI management frameworks, such as ISO/IEC 42001 or the NIST AI Risk Management Framework. These provide structured approaches to system design, data integrity, risk classification and human oversight, making eventual EU compliance more efficient while also demonstrating credibility to European partners.

Finally, businesses must take control of how they are discovered and represented in the AI ecosystem. Increasingly, policymakers and regulators learn about companies not through traditional search engines but through generative AI systems.

Gartner projects that search engine traffic will drop by 25% by 2026, owing to GenAI-driven discovery. Tools such as ChatGPT now have more than 800 million weekly users, and Gen Z is trending very AI-first, especially in the US, where a quarter of Capitol Hill staffers are using GenAI.

In this environment, summaries and perceptions of your business, whether accurate or not, are generated rather than searched for. Firms must therefore move from passive monitoring to actively shaping the narrative: identifying how they appear in GenAI systems and curating the data that informs those summaries. In a world where AI influences opinion, discoverability is a strategy.

Encouragingly, Asean governments are already responding: Singapore’s AI Verify toolkit, Malaysia’s national AI road map, and Indonesia’s sandbox pilots all show growing institutional readiness.

Major Asean firms across banking, energy and telecommunications are also beginning to embed responsible AI principles, signalling that governance is already reaching the region’s most globally exposed sectors.

Yet, voluntary frameworks will not secure EU market access, and Asean firms cannot treat this as someone else’s regulation. Digital governance is clearly moving towards mandatory transparency and demonstrable oversight.

What is needed now is embedded capability: accountable-by-design systems, leadership that understands the regulatory terrain and teams able to turn governance into strategic value.

Ronald J L Chan is senior director of Penta Group, a stakeholder solutions firm

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.