Malaysia made an unusual bet last year: it wired a Chinese open-source model into the machinery of its own government. This week, 21 economies that between them account for most of the world's technology output agreed that Malaysia had the right idea, with one condition attached that changes everything.
On 23 July 2026, ministers from the 21 APEC economies, the United States and China among them, adopted what is being called the Chengdu Statement. It is the first APEC statement to back open-source artificial intelligence at ministerial level, and it endorses open models built with what the text calls "strong security assurance". The meeting was chaired by Li Lecheng, China's Minister of Industry and Information Technology, who told reporters it was "the first to include open-source cooperation at a minister level". According to CNBC, the statement asks members to respect "security, data protection and intellectual property rights" while supporting open-source projects, and to help small businesses adopt affordable, easy-to-deploy AI. Ministers agreed to reconvene in Vietnam in 2027, where the focus is expected to shift from ambition to implementation.
Editor
Dinesh Raj chevron_right
Table of Contents
Malaysia already built the thing APEC just endorsed
Malaysia is not a bystander to this idea. In May 2025 the Ministry of Communications switched on what it billed as a sovereign, full-stack AI infrastructure, the first national-scale deployment of the open-source DeepSeek model anywhere outside China. As BERNAMA reported, the system runs on Huawei Ascend chips managed by a Malaysian operator, with a roadmap to deploy 3,000 advanced GPUs across the country by the end of 2026. Early users include the Prime Minister's Office, the Ministry of Communications, Permodalan Negeri Selangor, Cyberview and Universiti Teknologi Malaysia.
That deployment sits inside a wider push. The National AI Office was established in December 2024 and has since been folded into a permanent AI Malaysia body under the Ministry of Digital, with a mandate that runs to 2030. YTL AI Labs launched a home-grown Bahasa Malaysia model, ILMU, in August 2025. Budget 2026 tasks the regulator with building out sovereign AI infrastructure so that national data stays inside Malaysian-controlled systems. We looked at how far this goes in our earlier piece on Malaysia running DeepSeek while designing its own chip.
The security asterisk is the whole game
The phrase "strong security assurance" is not decoration. DeepSeek's hosted consumer app has been restricted or banned for government use in a growing list of places, including Italy, the United States, South Korea, Australia, Taiwan and India, and the Czech government barred its public administration from the service in July over data-handling concerns. South Korea's privacy regulator found the app had sent user prompts to companies in China without consent, and its data sits on servers there.
Here is the distinction that most coverage skips, and the one that matters for Malaysia: almost all of those bans target the hosted app and its data pipes, not the open model weights themselves. A set of weights running on your own hardware, inside your own borders, is a different risk profile from a chat app that ships your questions abroad. That is precisely the line Malaysia is walking, and it is the line the Chengdu Statement rewards. Open, yes, but assured, self-hosted and governed.
So the pact hands Malaysia both cover and homework. The cover is real: sovereign open-source AI is now an internationally endorsed path rather than a solo gamble, signed by the two powers that usually cannot agree on anything in this field. The homework is the harder half. "Assurance" means red-teaming, audit trails and data governance that Malaysia will have to prove it has, not just claim. When the ministers meet again in Vietnam in 2027 to measure who actually delivered, the open part will be the easy bit. The security part is where the bet is really won or lost.
Photos courtesy of Tyler and ThisisEngineering on Unsplash.
