Seven in ten ASEAN boards either have no formal oversight of artificial intelligence or discuss it only informally. Just 7% have a formal framework that sets out who is accountable, how it reports and when issues escalate. That is the sharpest number in the Institute of Corporate Directors Malaysia (ICDM) report, ASEAN Board Trends 2026/27: Future-Ready or Falling Behind? The New Test for ASEAN Boards. It is also the one that matters most for the next board cycle.
This review sets out what the study found, where the evidence is strongest, and how I would read it from the boardrooms I know in Malaysia and Indonesia.
What ICDM asked, and whom
The third edition of the study ran in March and April 2026. It drew 334 usable responses: 62% from directors and 38% from senior managers who work closely with boards. ICDM led it with eight regional partners under the ASEAN Institutes of Directors Network, including the Singapore Institute of Directors, the Institute of Directors Thailand and the Indonesian Institute for Corporate Directorship.
Three features of the sample shape how the findings should be read. Malaysia accounts for 38% of respondents. About 79% belong to the institute of directors in their own country. And 60% of the companies described earn under USD200 million a year. This is a view from engaged, mid-sized boards, not a census of listed giants.
Five signals ICDM draws, in my words
- Boards are reinventing, not retrenching: recent actions lean towards strategy and operating change.
- Technology is moving faster than board capability: concern is high, formal structure is thin.
- Directors and management share priorities but score the board’s performance differently.
- Sustainability ambition runs ahead of how far it is built into decisions.
- The board’s own composition is now part of the agenda: selection, succession and skills must track strategy.
AI: the widest distance between concern and construction
The concern is widespread. 73% of respondents worry about AI risk, ethics and regulation. 72% cite unclear governance or strategy alignment. 70% are concerned that the board lacks the knowledge to oversee it (p.35).
The construction is thin. 59% place their board’s grasp of AI at basic or very limited, and under one in ten rate it well informed or highly knowledgeable (p.35). The learning response is mostly improvised:
| AI governance maturity (p.34) | Share of respondents |
|---|---|
| Informal discussion only | 36% |
| No formal oversight | 35% |
| Partial oversight, roles not formalised | 22% |
| Formal framework: accountability, reporting, escalation | 7% |
| AI capability building (p.36) | All | Directors | Management |
|---|---|---|---|
| No formal initiatives | 31% | 36% | 22% |
| Informal development | 33% | 30% | 37% |
| Periodic, unstructured learning | 29% | 29% | 28% |
| Structured capability building | 8% | 5% | 12% |
Directors and management agree on the gap. ICDM’s own verdict is blunt: “a readiness problem, not a perception problem.” One further detail: management is the more positive party on capability building. 12% report a structured programme, against 5% of directors.
The same room, seen from two seats
Directors rate their own contribution more kindly than management does. On the report’s weighted agreement measure, directors score the statement that board deliberations improve management’s decisions at 81%, management at 74%. On whether the board has the people and skills for what lies ahead, the scores are 75% and 66% (p.22). On boardroom dynamics, 64% of directors describe healthy, balanced participation. 54% of management do (p.23).
The sharper difference is in what each side wants fixed. 66% of management respondents prioritise leadership, culture and dynamics. 49% of directors do (p.24). Only 54% have an external board evaluation as often as every three years (p.11). Confidence needs an outside test.
Renewal: more than half expect a change
56% of respondents say at least one director should be replaced within two years. 44% say none. Of the composition changes respondents named, selection and renewal ranks first (71%), then digital, technology and AI skills (65%) and diversity (59%) (p.26).
Read beside the AI figures, the arithmetic is uncomfortable. Boards want AI capability, yet 44% say no director should be replaced. Capability will have to arrive by another route. I made a related argument in my review of the PwC directors’ survey, where 55% of US directors wanted a colleague replaced.
Sustainability: ambition ahead of execution
Only 15% describe their organisation’s sustainability governance as mature. 55% call it developing (p.28). The telling pairing is on risk: 26% of directors see sustainability as closely connected to enterprise risk management. Only 9% of management do (p.29). Half tie sustainability metrics to management KPIs. A third tie them to board KPIs (p.31).
Sustainability and stakeholder trust also rank last among forward priorities, at 27% (p.16), while stakeholder engagement and reputation draw 81% on the board-attention index (p.20). Stakeholders are visible to boards. They are not yet written into strategy.
Where the global mandate breaks, and where local adaptation wins
The global answer to AI governance is familiar: a technology committee, an AI-literate director, a standing risk framework. It assumes a deep bench. In this sample, a third of respondents describe a board of five directors or fewer (22% of directors, 53% of management respondents; p.44). 44% say no director should be replaced within two years. A dedicated committee is a stretch for most.
Local adaptation wins by working with the rhythm the board already keeps. Boards already meet on a fixed cycle. Papers already circulate. Risk is already a standing item. The register below needs no new structure. It needs one disciplined page.
There is also local scaffolding. 85% of respondents want their institute of directors to offer more director programmes and dialogue on governance (p.49). Malaysia’s National AI Office, AI Malaysia, published a voluntary Boardroom Primer to AI Adoption & Governance in July 2026. The Securities Commission Malaysia consulted in July on board oversight of technology and AI, with disclosure. I have not yet seen the outcome of that consultation.
Four first moves
- Ask management for a one-page register of every material AI use case: owner, value delivered, controls, incidents. ICDM’s own key actions ask management for exactly this view (p.7).
- Minute an AI risk appetite and name the committee that owns it. One owner beats a shared interest.
- Set a literacy floor. Two structured director sessions a year replace the occasional briefing.
- Review value delivered, not tools adopted. Ask where AI is creating measurable value, and what it would take to stop a deployment.
Beyond the post: what a board AI register looks like in practice
The LinkedIn post asks for one page. Here is what that page should hold. It is my own working framework, not an ICDM template, and it is built to fit a board that meets six to eight times a year and has no technology committee.
- Use case and business owner: one named executive, not a function.
- Purpose and value: the decision or cost it changes, with a figure management will stand behind.
- Data and model source: in-house, vendor or open tool; what data it touches, including personal data.
- Control owner and controls: who tests it, how often, and what happens when it fails.
- Incidents and near-misses since the last meeting: including errors caught by staff.
- Regulatory touchpoints: personal data, sector rules, cross-border data transfer.
- Board decision needed: approve, monitor or stop.
The register works because it converts a diffuse topic into a standing agenda item with a name beside every line. It also surfaces what boards most often lack: the shadow use that never went through procurement. In my experience, the first register is shorter than expected and the second is longer. The difference is disclosure, not adoption.
A twelve-month sequence for a board of five
- Meeting one: receive the first register. Do not debate the technology. Ask only who owns each line.
- Meeting two: minute a risk appetite. Decide which uses the board will not accept and which need prior approval.
- Meeting three: first literacy session, led by an outside practitioner rather than a vendor. Record attendance in the minutes.
- Meeting four: review incidents and value together. Retire one use case or add one control.
- Annual cycle: fold the register into the risk report and the board evaluation, so AI oversight outlasts the enthusiasm that started it.
The sequence assumes no new committee. If AI exposure grows, the audit and risk committee can carry it first. A dedicated committee becomes justified when the register shows that a material share of revenue, customer decisions or regulated processes depends on AI.
How the lens shifts by type of board
- Private equity and portfolio boards: ask each portfolio company for the same one-page register, and compare. The value is in the pattern across companies, and in tying AI claims in an investment case to a measurable line.
- Family-controlled companies: the chair and the founding generation often decide technology spending informally. The register brings those decisions into the minutes and gives independent directors something to challenge.
- SME and founder-led boards: with five directors or fewer, one director can own the topic for a year on a rotating basis. Rotation spreads literacy and avoids dependence on a single enthusiast.
- Regional groups: a group register should note which jurisdiction each use case operates in. Data-transfer and sector rules differ across ASEAN, and a single group policy rarely fits all of them.
Questions to take into the next board meeting
- Which AI use cases would we be uncomfortable explaining to a regulator or a major customer today?
- Who in management can tell us, without preparation, what our AI systems did last quarter?
- If a vendor changed its model overnight, who would notice, and how soon would we hear?
- Which director would we ask to own this for the next twelve months, and what support do they need?
A note on method
Percentages are taken from the report’s tables. The number of answers differs from question to question, as not every respondent completed every section; the AI questions rest on 239 respondents. The sample is self-selected and skews towards members of institutes of directors. One internal inconsistency is worth knowing: the text on p.36 describes 92% of board respondents as having no systematic AI capability building, while the table shows 5% of directors with a structured programme. I have used the table. The direction is the same either way.
The Boardroom Takeaway
Management buys the tools. The board owns the consequences. A board that cannot see its AI on one page is not yet governing it.
When did your board last see every material AI use case on one page?
This article was first shared on LinkedIn: https://lnkd.in/p/gMvT2ehs
Related reading
- Boards Recruit for Fit, Then Fault the Gaps : Why Chemistry Without Capability Is a Governance Risk — https://queberra.com/?p=178
- The GNDI Report: Only 22.4% of Boards Are AI-Ready — https://queberra.com/?p=171
- The AI Governance Gap: Culture and Capability, Not Compliance Theatre — https://queberra.com/?p=168
Sources
- Institute of Corporate Directors Malaysia (ICDM), ASEAN Board Trends 2026/27: Future-Ready or Falling Behind? The New Test for ASEAN Boards (2026). https://icdm.com.my/asean-board-trends-20262027
- ICDM media release via ACN Newswire, 1 October 2026. https://www.acnnewswire.com/press-release/english/110531/
- AI Malaysia (National AI Office), Boardroom Primer to AI Adoption & Governance, July 2026. https://ai.gov.my/governance/boardroom-primer-to-ai-adoption-and-governance
- Securities Commission Malaysia, public consultation on proposals to strengthen the corporate governance ecosystem, opened 3 July 2026. https://www.sc.com.my/resources/media/media-release/sc-seeks-public-feedback-on-key-proposals-to-strengthen-corporate-governance-ecosystem