How to Use the ASEAN Guide on AI Governance and Ethics

Confirm scope before mapping controls

The ASEAN publication page identifies the ASEAN Secretariat as author and dates the publication to 2024. The Guide's primary text says that it focuses on traditional AI, is voluntary, and should be tailored to an organization's industry, technology complexity, and system risks. It also says it does not replace existing or forthcoming laws.

Start a scope card with:

If the system uses generative AI, do not silently treat the original Guide as complete coverage. The ASEAN Digital Sector's key documents page separately lists an Expanded ASEAN Guide for generative AI. Record which document and edition were used.

• deploying countries and sectors;
• business purpose, affected stakeholders, and material decisions;
• whether the system is developed, procured, configured, or merely used;
• model type, data flows, vendors, human operators, and downstream integrations;
• life-cycle stage and planned changes;
• applicable local laws, regulator guidance, contracts, and internal policies;
• reviewer, review date, and next trigger for reassessment.

Sources: [1] [2] [3]

Convert recommendations into an evidence map

Organize the mapping around the Guide's practical governance themes rather than copying paragraphs into a policy. For each applicable recommendation, create a row with the intended outcome, accountable owner, operating practice, evidence, review cadence, and unresolved gap.

A workable evidence map includes:

Mark every row as applicable, not applicable with rationale, partial, or unresolved. A policy statement is design evidence; a completed review, monitored event, or closed incident is operating evidence. Keep those evidence types separate so a reviewer can see whether the practice exists only on paper.

• Internal governance: decision rights, escalation routes, training records, and management review minutes;
• Human involvement: defined operator authority, override paths, handoff rules, and sampled decisions;
• Operations management: data lineage, test plans, monitoring results, incident records, and change approvals;
• Stakeholder communication: notices, explanations, feedback routes, and issue response records;
• Risk tailoring: impact rationale, affected groups, foreseeable misuse, residual risk, and acceptance owner.

Worked mapping for an internal support assistant

Imagine a regional company introducing an AI assistant that drafts answers for customer-support agents in Singapore and Malaysia. Agents must review messages before sending them, and the assistant cannot change accounts or issue refunds.

The scope card names both countries, the customer-support process, the vendor model, the knowledge-base connector, the human reviewer, and excluded actions. The team maps internal governance to a product owner, risk owner, and escalation committee. It maps human involvement to the send-button restriction, reviewer instructions, and a monthly sample of edited and unedited drafts. Operations evidence includes the approved knowledge sources, evaluation cases for incorrect policy answers, access logs, incident tickets, and a change record for each model or retrieval update. Communication evidence includes the customer-facing notice and complaint route.

The first review finds a gap: the system records the final sent message but not the original suggestion, so the team cannot measure how reviewers corrected unsafe or inaccurate drafts. The mapping marks monitoring as partial, assigns an engineering owner, and sets an expiry date for risk acceptance. It does not infer that mandatory review worked merely because the interface displayed a review instruction.

Resolve jurisdiction and change separately

After the voluntary-guide mapping, obtain qualified review of laws and sector rules for every deployment country. Maintain a separate legal register with effective dates and interpretations; do not relabel the Guide's recommendations as statutory duties. Where national requirements differ, record the stricter or system-specific operating rule and the reason for it.

Revisit the scope card after a new country, material model update, new data category, automated action, changed user group, incident, or revised ASEAN document. The Guide describes itself as a living document, so the source edition and access date belong in the evidence record. A completed mapping demonstrates that a review occurred; it does not by itself show that every practice operated effectively.

Two Prune can turn this method into a realistic assessment exercise using synthetic policies, system records, and incident evidence. The resulting assessment can show how a participant frames the scope, navigates evidence, and communicates gaps. It does not determine legal compliance, certify an AI system, or make an employment decision.