Chinese Data Centres: Power and AI Rules in ASEAN

Johor, June 2026: the rule arrives inside the rack

The geopolitics of AI data centres is settled in supply contracts, long before it reaches treaties.

In June 2026 Alibaba Cloud opened two facilities in Johor, bringing its Malaysian total to five data centres: the group's largest presence in Southeast Asia, as The Diplomat reports^[1]. The opening came four months after ASEAN signed off on a Malaysia-led cross-border cloud framework, with common principles on data protection, regulator access and hosting beyond national borders.

Four months separate the text from the machine. The machine will sit there for twenty years. The text will be rewritten three times.

Read the regional framework and you find principles. Read the platform manual and you find requirements: access profiles, configuration templates, security procedures. The first shapes intentions, the second governs the traffic of every single day.

Whoever lays the track picks the gauge

In 1853 the first Indian train covered the thirty-four kilometres between Bombay and Thane. The capital was British, and so was the measure of the track: 1,676 millimetres, the broad gauge India still uses today. The mechanism was elementary: whoever lays the track sets the measure, and the measure outlives the government that accepted it.

In 1906 Japan founded the South Manchuria Railway Company. The firm ran track, ports, mines and the towns that grew up along the line. Sovereignty on paper remained Chinese; actual administration followed the infrastructure.

In 1891 the experimental line between Lauffen and Frankfurt carried three-phase current over 175 kilometres. That demonstration settled the continent's electrical standard before any law wrote it down.

Three precedents are enough to call it a pattern. Infrastructure sets the standard, the law arrives afterwards and ratifies it. The Malaysian case repeats the sequence with racks in place of rails.

The mechanism: from technical lock-in to regulatory lock-in

Few companies in the world can supply data centres, compute capacity and a complete cloud stack together, at the scale frontier models demand. That scarcity is the first link in the chain.

The second link is technical. A company or an agency building on top of a platform has to make its own systems compatible with the vendor's services and comply with its access, configuration and security requirements. From that moment, internal security policy coincides with the platform's model.

The third link is legal. The specifications adopted in facilities built or run by Chinese operators shape the services running on top of them, and those services include civil registries, payments, healthcare, civil defence.

The fourth link is time. Moving a public workload from one platform to another costs years and budgets that ministries rarely secure, so dependency hardens and becomes structure. The government keeps the signature and loses the leverage.

ASEAN's text, the vendor's contract

The framework approved by regional ministers sets principles on data protection, regulator access and cross-border hosting. Fine diplomatic work. Practical effect: depends on who owns the iron.

The Chinese race for regional compute is documented. Beijing's tech firms are driving the Southeast Asian data centre boom, as ThinkChina^[2], an outlet of Singapore's SPH Media group, reports. Capital follows demand, demand follows latency, latency rewards whoever builds closest to the customers.

Here comes the point the public debate keeps avoiding. Safeguards against the misuse of data in those facilities remain thinly transparent, while Beijing carefully controls sensitive content in the models developed at home. A government renting that compute imports both things: the technical standard and the boundary of what may be said.

The market prices these campuses as industrial real estate with a decent yield. They are in fact sovereignty infrastructure, valued at the price of a warehouse.

Power decides where compute lives

The electricity grid matters more than the law. A campus drawing hundreds of megawatts looks for three things: stable power, water for cooling, cheap land.

Singapore froze new data centre licences in 2019 and reopened in 2022 under tight efficiency and consumption criteria. That choice pushed demand across the Johor Strait, where Malaysia offered grid, land and tax incentives. One country's environmental rule became its neighbour's industrial policy.

The result is a new geography. The money comes from Beijing and the Gulf, the current comes from the Malaysian grid, the workload serves customers scattered across the region. Every megawatt added moves a piece of jurisdiction.

For Kuala Lumpur the bill cuts both ways: electricity tariffs, water consumption and pressure on the domestic grid on one side, revenue and jobs on the other. The political arithmetic holds as long as power stays abundant.

Where this desk stands

The effective rule of AI in the region will be written by the hardware governments rent, and the regional framework will remain a statement of intent for as long as compute has a dominant foreign supplier.

The reasoning fits in one sentence: whoever defines access, configuration and security requirements defines operational governance, while the legislator defines the declared kind. Between the two, the one running in production wins.

What would change my mind. A regional authority with direct inspection powers over the facilities, access to logs and penalties actually enforced; or public compute capacity sufficient to host sovereign workloads; or three vendors in genuine competition, with data portability verified by an independent audit. Those facts would move the thesis. Joint declarations leave everything where it is.

This is a regime change, not an investment cycle. The cycle lasts seven years, the standard lasts a generation.

Three implications for capital

First, for family offices and sovereign funds, thirty-six-month horizon: assets tied to regional compute should be priced with a jurisdictional risk premium, because a change of government in Kuala Lumpur or Jakarta can impose localisation requirements that rewrite hosting contracts.

Second, for boards and CEOs, eighteen-month horizon: the geopolitical risk missing from strategic plans is dependence on a single stack. The right question sounds like this: how much does it cost to move the critical workload elsewhere, in months and in euros?

Third, for chief risk officers, twenty-four-month horizon: the scenario absent from VAR models is a sudden data residency requirement, capable of turning a cloud contract into a write-down. Historical variance says little about a regime that changes shape.

CFOs are left with the uncomfortable part. The narrative taken to investors speaks of abundant, low-cost compute in Southeast Asia; in eighteen months the same sentence could read as concentrated exposure to a foreign jurisdiction.

The forecast, and what to watch

Forecast: by 30 June 2027 at least one ASEAN country other than Malaysia will officially announce a new data centre built or operated by a Chinese hyperscaler (Alibaba, Tencent, Huawei or ByteDance), with site and capacity disclosed.

Confidence: 78 out of 100. Horizon: 30 June 2027. Verification: a statement from the company or the relevant ministry. Kill signal: the absence of such an announcement by the deadline disproves this reading of the speed of diffusion.

What to watch: three indicators anticipate the twelve-month outcome.

• New grid connection applications for campuses above one hundred megawatts in Malaysia, Indonesia and Vietnam
• Data residency and log access clauses in public tenders issued by ASEAN ministries
• Tender specifications naming a single cloud vendor's technical specifications outright

The last indicator carries more weight than the other two. A public tender that names a vendor's specifications has already decided the rule, and the regulatory document that follows will merely copy it.

There is no conspiracy here. There is no counterweight. The region's governments wrote common principles while a narrow group of vendors built the capacity those principles are meant to govern, and the sequence, as in 1853 and 1906, rewards whoever laid the iron.