collection, long-term storage of sensitive information, and potential abuses under the banner of "development." Moreover, fragmented policy environments often leave citizens without clear mechanisms for redress or consent. A case in point is Thailand. As the country is embracing artificial intelligence (AI) with great enthusiasm, viewing it as a catalyst for economic growth and digital transformation, Thailand’s domestic frameworks to regulate digital development have left much to be desired. For instance, the country’s enforcement of the Personal Data Protection Act (PDPA) of 2019 has proven to be light-handed when the violations stemmed from the public sector (Sriyai 2024a). In his statement, the minister for Digital Economy and Society admitted that an extensive review of 31,561 state-run units from November 2023 to late August 2024 revealed 6,086 instances of personal data breaches, with local administrative organisations as the primary culprits (Tantivangphaisal 2024). In an earlier case, data was leaked from the Department of Older Persons, exposing 20 million Thais to potential cyber threats and scams. They also found 139 incidents where officials illicitly sold citizens’ personal data though the minister did not disclose how many citizens could potentially be affected by these incidents (Sriyai 2024c). Most astoundingly, there has yet to be any news about how these cases are being investigated and whether any individuals have been held responsible for the leaks of citizens’ personal data, raising suspicion of the government’s willingness to admit its own faults and provide redress to the affected citizens. Considering this, it remains doubtful whether the authorities are prepared to apply the law equally when data theft or breaches involve the public sector, which raises concerns about cybersecurity in state-driven development initiatives. More specifically on AI development, the National AI Action Plan (2022–2030) outlines Thailand’s strategies to integrate AI into sectors like healthcare, agriculture, and tourism, aiming to enhance competitiveness and reduce reliance on foreign technology (Trisadikoon and Umponkitviwat 2025). However, as the nation accelerates AI adoption in hope to unleash AI’s economic promises, it is seemingly falling behind on the equally urgent task of developing sufficient AI governance measures, particularly in the realm of generative AI (GenAI), which will be discussed in greater detail in the forthcoming section. While Thailand’s case of enforcement lapses underscores the reality of many low- and middle-income countries in Southeast Asia and elsewhere, a case in which policy and related programs are being deliberately used to enhance the state's surveillance capabilities is Myanmar. There, the surveillance efforts are often presented under the guise of broader development agendas and public service initiatives. This strategy allows the military junta to 4