Brunei: Small State, Strategic Standards

Brunei Darussalam has moved rapidly to establish AI governance foundations despite its small size and economy. In January 2025, the Personal Data Protection Order (PDPO) was gazetted, giving the country its first comprehensive data protection law with binding obligations and tiered penalties. In April 2025, the Authority for Info-Communications Technology Industry (AITI) published the Guide on Artificial Intelligence Governance and Ethics, establishing seven core principles aligned with the ASEAN Guide. Both instruments position Brunei ahead of several larger ASEAN neighbours on formal AI governance, though neither constitutes dedicated AI legislation. The approach is voluntary and principles-based for AI, binding for data protection, and strategically linked to Wawasan Brunei 2035, the national vision for transforming a hydrocarbon-dependent economy into a diversified, digitally enabled one. Brunei will host the ASEAN Digital Ministers' Meeting in January 2027, giving it a platform to contribute to regional governance discussions. With near-universal internet penetration but a 74th global AI readiness ranking, Brunei's challenge is translating connectivity and governance frameworks into actual AI adoption and economic diversification.

Brunei's AI governance landscape has developed quickly since 2024. AITI convened a 25-member AI Governance and Ethics Working Group drawing from government, industry, academia, and technology communities in 2024, followed by a public consultation on the draft guide in July 2024. The final Guide on AI Governance and Ethics, published April 2025, establishes seven principles: transparency and explainability, data protection and governance, security and safety, robustness and reliability, fairness and equity, human centricity, and accountability and integrity. The guide is technology and sector-neutral, voluntary, and risk-based, designed to be flexible enough to accommodate rapid technological change. The Personal Data Protection Order 2025, gazetted January 8, applies to all private sector organisations and NGOs processing personal data. It empowers individuals with rights over data collection, use, and disclosure, mandates data protection impact assessments, restricts cross-border data transfers to jurisdictions with equivalent protections, and introduces a one-year phased implementation period. Penalties are tiered from $10,000 to 10% of organisational turnover. AITI serves as the enforcement authority. A national AI strategy is in development as a component of the next Digital Master Plan (post-2025), with officials confirming AI will be central to the successor framework. The National AI Application Platform was launched in December 2025 through a partnership between UNN and EVYD Technology, initially supporting the Ministry of Health.

All private sector organisations and NGOs in Brunei processing personal data face immediate compliance obligations under the PDPO 2025, with a one-year grace period from January 2025. Cross-border data transfers are restricted, which has implications for multinational companies and cloud service providers operating in the country. Government agencies are adopting AI through initiatives like the National AI Application Platform and BruneiID digital identity system, with a multi-ministry approach guiding implementation. The oil and gas sector, which accounts for approximately 50% of GDP, faces pressure to adopt AI for operational efficiency as part of broader economic diversification under Wawasan 2035. Healthcare is an early mover, with the National AI Application Platform's initial deployment supporting the BruHealth app and Ministry of Health operations. MSMEs face the challenge of understanding and adopting both data protection requirements and the voluntary AI governance principles, particularly given workforce digital skills gaps. Educational institutions are involved through the AI Ready ASEAN Programme, which targets 20,000 Brunei citizens. Technology providers and data centres, including UNN's state-of-the-art Kampong Tungku facility, are positioned at the intersection of infrastructure development and governance compliance. Foreign investors should note the PDPO's cross-border transfer restrictions when planning data architectures.

Brunei's seven AI governance principles mirror the ASEAN Guide framework closely, reflecting AITI's explicit citation of the regional guide as key input. Transparency and explainability require organisations to communicate clearly about AI system capabilities and decision-making processes. Data protection and governance align with the PDPO 2025's binding requirements, creating coherence between voluntary AI principles and enforceable data law. Security and safety address system resilience and risk management. Robustness and reliability focus on AI system dependability across operating conditions. Fairness and equity guard against algorithmic bias and ensure inclusive benefit distribution. Human centricity keeps people at the centre of AI design and deployment decisions. Accountability and integrity establish clear responsibility chains and ethical conduct expectations. The guide takes a pragmatic, principles-based stance rather than prescriptive rules, acknowledging that Brunei's AI ecosystem is still nascent and overly detailed requirements could be counterproductive. The technology and sector-neutral design ensures applicability across Brunei's priority areas: oil and gas, food production, tourism, ICT, and government services. Cultural and religious values preservation is a distinctive aspect of Brunei's digital transformation philosophy, reflected in the broader Wawasan 2035 framework within which AI governance sits.

Businesses in Brunei face a dual compliance environment. The PDPO 2025 is binding with meaningful penalties, and companies should prioritise compliance during the one-year grace period. This means implementing data protection impact assessments, establishing consent mechanisms, preparing for cross-border transfer restrictions, and appointing responsible officers where required. The AI Governance and Ethics Guide is voluntary, but adoption signals responsible practice and builds consumer trust. For companies in regulated sectors like finance and healthcare, early alignment with the guide positions them well for potential future mandatory requirements. The oil and gas sector, critical to Brunei's economy, offers the most immediate AI adoption opportunities in areas like predictive maintenance, operational efficiency, and safety monitoring. The government's economic diversification agenda creates incentives for AI innovation in food production, tourism, and ICT services. Infrastructure is a relative strength: Brunei has 98-99% internet penetration, nationwide 5G coverage, 92% household fibre coverage, and UNN's 200-rack data centre in Kampong Tungku. However, the data centre ecosystem is small by regional standards, and sovereign cloud development is still in early stages.

The most significant upcoming development is the formulation of the next Digital Master Plan (post-2025), which will position AI as a central strategic element. Officials have confirmed this will include a comprehensive Data and AI Strategy defining Brunei's long-term AI approach. The PDPO 2025's one-year implementation period expires in January 2026, after which enforcement begins in full. Companies should track AITI guidance on compliance expectations and enforcement priorities. Brunei will host the seventh ASEAN Digital Ministers' Meeting in Bandar Seri Begawan in January 2027, providing a regional platform to demonstrate governance leadership. The National AI Application Platform's expansion beyond its initial Ministry of Health deployment will indicate the pace of government AI adoption. UNN's sovereign cloud development will shape the domestic data hosting landscape and influence how cross-border transfer restrictions under the PDPO are implemented in practice. The AI Ready ASEAN Programme targeting 20,000 citizens provides a measurable indicator of workforce readiness progress. The evolution of the voluntary AI Governance and Ethics Guide toward potential mandatory requirements will depend on adoption rates and maturity of the local AI ecosystem.