Introduction
Who will shape not only the architecture, but the normative foundations of the digital world order? Emerging technologies, particularly artificial intelligence (AI), are transforming how societies process information, make decisions, and govern populations. These shifts are not merely technical: they entail profound consequences for how we understand security, political authority, economic development, and human rights.Footnote 1 In this evolving landscape, the United States (U.S.), China, and the European Union (EU) have emerged as central actors vying for influence not only by exporting their technologies but also by advancing competing standards, norms, and models of digital governance.Footnote 2 As technology becomes increasingly embedded in governance systems worldwide, the contest over technological infrastructure has thus become a contest over political futures. Despite existing differences, the EU and the U.S. are both pushing for global regulations in areas such as AI ethics, cybersecurity, and internet governance, with the EU being more concerned with data privacy and citizens’ rights, and the U.S. taking a more private sector-driven and decentralized approach to regulating technology.Footnote 3 In contrast, Beijing promotes a type of digital governance rooted in technological sovereignty, state control, and normative flexibility for national intervention.Footnote 4 While Chinese officials rhetorically support international cooperation, their interpretation of key concepts like privacy, transparency, and human rights diverges from liberal democratic norms.Footnote 5 Through initiatives such as the Digital Silk Road (DSR), China exports not only digital infrastructure, such as surveillance systems and smart city platforms, but also implicit political–technological norms aligned with the principle of cyber sovereignty.Footnote 6
This global contest over digital norms is particularly visible in Southeast Asia, a region marked by rapid digitalization, democratic ambivalence, and diverse political systems. Driven by young, tech-savvy populations and state-backed innovation strategies, Southeast Asia’s digital economy reached over USD 100 billion in 2023, led by e-commerce, fintech, and online services.Footnote 7 At the same time, the region’s enduring authoritarian legacies and uneven democratic institutions have made it a fertile site for debates about the political implications of AI and digital technologies.Footnote 8 Governments in the region face mounting pressure to engage with foreign digital norms while preserving regulatory autonomy and balancing competing geopolitical allegiances.Footnote 9 They also increasingly articulate concerns about normative asymmetries in global governance, arguing for more inclusive frameworks that reflect their developmental priorities and sociopolitical conditions.Footnote 10 Yet as the evidence presented in this article shows, norm uptake in the region is neither straightforwardly compliant nor simply resistant; it is shaped by processes of recombination that the existing literature does not adequately theorize.
This article introduces a theoretical framework of norm hybridization to explain these dynamics. Hybridization conceptualizes norm diffusion as a process of recombination, whereby local actors, including governments, firms, and civil society, synthesize elements from multiple normative sources to produce new, context-specific governance arrangements. This approach draws on and extends critical constructivist scholarship that foregrounds norm contestation, localization, reinterpretation, collision, and resistance.Footnote 11 It also engages with the literature on digital authoritarianism, moving beyond its binary focus on democratic rejection or authoritarian emulation by examining how authoritarian digital norms are selectively incorporated and reconfigured in hybrid regimes.Footnote 12 The article focuses empirically on Indonesia, Malaysia, and the Philippines as key DSR partners. The guiding research questions are as follows: (i) How do these three Southeast Asian states engage with China’s digital infrastructure and embedded political–technological norms? (ii) Under what conditions do digital norms spread in DSR host contexts? (iii) What explains variation in state responses?
Although Southeast Asia serves as the empirical focus, it functions here as a crucial case for theory-building. Its diverse regime types, mixed levels of institutional capacity, and exposure to multiple norm entrepreneurs make it a fertile site for observing hybridization in action. Drawing on a large corpus of expert interviews and official documents and speeches, I advance two main claims. First, that hybrid norms are emerging in Southeast Asia as states selectively integrate external digital governance models with domestic regulatory traditions, political incentives, and societal values. And second, that this process is shaped by a range of factors, including economic dependencies, institutional capacity, civil society strength, sector-specific dynamics, and geopolitical positioning, This article thus contributes to International Relations (IR) scholarship in three ways. First, it enriches norms research by introducing a hybridization framework that captures how norms are reassembled in contested (digital) environments.Footnote 13 Second, it advances debates on digital authoritarianism by theorizing how authoritarian technologies travel and transform in hybrid political settings.Footnote 14 Third, it situates Southeast Asia as a critical arena in the geopolitics of technological infrastructure, where states navigate overlapping normative pressures through strategic engagement and recomposition.Footnote 15
The article proceeds as follows. The next section reviews existing approaches to norm diffusion and highlights their limits in explaining recombination. ‘Strategic hybridization: a framework for norm diffusion in digital governance’ section develops the hybridization framework, outlining its typology and scope conditions. ‘Research design and case selection’ section presents the research design and case selection. ‘Hybrid norms in Southeast Asia’s digital governance’ section examines Indonesia, Malaysia, and the Philippines through comparative case studies based on interviews and documents. The conclusion reflects on the implications for norm diffusion, digital governance, and global order.
Rethinking norm circulation: hybridization across norm diffusion
Norms in IR are commonly understood as standards of appropriate behaviour for actors with a given identity.Footnote 16 Early scholarship conceptualized diffusion as a largely linear process of internalization, emphasizing persuasion, socialization, and convergence. Subsequent constructivist research has challenged this view through concepts such as localization, norm filtering, contestation, and translation, demonstrating that norm uptake is mediated by domestic institutions, political interests, and cultural contexts.Footnote 17 Yet this literature remains largely oriented towards assessing the degrees of compliance or resistance relative to a single originating norm, leaving the structured emergence of qualitatively new governance configurations under-theorized. The framework proposed in this article can be situated within the broader trajectory of IR norms research as described by Orchard and Wiener, who identify three constitutive moves: the recognition that social norms structure state behaviour, the insight that policy implementation requires interpretation and contestation, and the reconceptualization of norms as normative processes carrying changing meanings-in-use.Footnote 18 The hybridization framework builds on all three moves and advances the third in particular, by theorizing how the dynamics of contestation and reinterpretation produce specific governance configurations that emerge from the recombination of multiple competing normative sources.
A more recent body of scholarship, distinct from legal-institutional accounts of hybrid norms concerned with the hard/soft law divide,Footnote 19 has deepened this picture by theorizing the friction that arises when normative orders interact. Cardenas’s concept of norm collision,Footnote 20 Kreuder-Sonnen and Zürn’s interface conflicts,Footnote 21 Saltnes’s competing normative interpretations,Footnote 22 and Bloomfield’s norm antipreneurs,Footnote 23 all illuminate the dynamics of resistance, incompatibility, and contestation that emerge when international and domestic normative commitments clash. Nesadurai’s work goes further, using hybridization to capture the negotiated compromises that result from such interactions within transnational governance networks.Footnote 24 Together, this scholarship establishes that normative interaction is generative rather than merely disruptive, a premise the present framework shares. What it leaves under-theorized, however, is the variation in the governance configurations that emerge from recombination, namely: what structured outcomes result, and under what conditions.
The hybridization framework advanced here thus shifts attention from actor roles and negotiated compromise to the institutional configurations that crystallize from normative interaction. Rather than (re)conceptualizing hybridity as such, the framework theorizes hybridization as a structured process through which domestic and foreign normative elements are assembled into distinct governance arrangements. By specifying the conditions under which different balances of external and internal influence emerge, it explains variation in hybrid outcomes across cases. Contestation is thus treated not merely as resistance or compromise, but as generative of new institutional orders, particularly in domains such as digital governance, where infrastructure, regulatory templates, and geopolitical rivalry intersect.
The proposed framework is also indebted to Zimmermann and her three-step model of norm translation – into discourse, law, and implementation – which highlights the interpretive and contested nature of norm uptake.Footnote 25 However, her framework evaluates variation in terms of the degree to which international norms are embedded domestically, keeping outcomes tethered to the original normative frame and leaving insufficient room for theorizing the emergence of qualitatively new configurations.
This article builds on the above advances but is concerned with synthesis. It conceptualizes norm uptake as a process of recombination in which actors assemble elements from multiple normative sources – international, regional, and domestic – into context-specific governance arrangements. Rather than using hybridity descriptively, the framework theorizes it as a structured mode of norm evolution. It identifies scope conditions – economic dependency, institutional capacity, geopolitical alignment, and sectoral dynamics – under which hybrid configurations are likely to emerge and introduces a typology based on the relative balance between foreign and domestic normative influence. The paper thus draws from Acharya’s theory of localization but extends it beyond unidirectional adaptation, conceptualizing norm evolution as multi-directional recomposition involving interaction between competing norm clusters and a wide range of actors. Crucially, however, I depart from his concept of norm subsidiarity, which tends to frame norm production in the Global South as primarily reactive and presumes a binary dynamic between local and global actors, which risks overlooking the complex, negotiated, and often pragmatic ways in which norms are reconstituted in practice.Footnote 26
The need for a new approach is particularly evident in digital governance. While hybridity has been theorized elsewhere, most notably in peacebuilding scholarship as negotiated compromise between international interventions and local structures, and in cultural theory as fluid mixing of identities, these accounts deploy it descriptively rather than as a structured causal framework.Footnote 27 The present framework treats hybridization as a patterned process of recombination rather than metaphorical mixture, enabling systematic explanation of cross-case variation. Digital authoritarianism scholarship demonstrates how states deploy technologies for surveillance and control and how China promotes cyber sovereignty as a state-centric governance model, but frames diffusion in binary terms: authoritarian emulation versus democratic resistance.Footnote 28 Hybrid political systems, such as those in Southeast Asia, do not fit neatly into this dichotomy. External digital norms are neither fully internalized nor wholly rejected; they are filtered, layered, and selectively integrated. At the same time, digital norm diffusion cannot be separated from the geopolitical economy of infrastructure. Initiatives such as China’s DSR function not merely as channels of technology transfer but as instruments in broader contests over the global digital order, positioning cyber sovereignty against liberal-democratic regulatory models promoted by the U.S. and the EU. Yet diffusion remains multi-directional: Southeast Asian states actively navigate competing standards, weighing infrastructural advantages against regulatory alternatives.
These dynamics reveal the limits of existing approaches centred on adaptation, resistance, or contestation relative to a single originating norm. What emerges instead are context-specific arrangements shaped by negotiation, infrastructural entanglement, and geopolitical balancing. Governments, firms, and civil society actors recalibrate imported technologies and governance frameworks within domestic institutional settings. Chinese-provided surveillance infrastructure, for example, may be adopted for security purposes while accompanied by privacy safeguards or localized oversight. Explaining such recombination therefore requires an analytical framework that moves beyond degrees of compliance or reinterpretation and instead theorizes how multiple normative influences are assembled into distinct institutional configurations. By bridging norm contestation scholarship with debates on technological governance,Footnote 29 this article reconceptualizes digital norm uptake as strategic recombination shaped by structural and institutional conditions. The following section clarifies the conceptual and analytical status of hybridization as a structured mode of norm evolution distinct from existing typologies of norms and norm relations.
Strategic hybridization: a framework for norm diffusion in digital governance
While the previous section situated the framework within debates on diffusion, adaptation, and contestation, this section clarifies its analytical level. The hybridization framework does not propose a new type of norm, nor does it classify norms according to their degree of contestation or effect. Instead, it theorizes the structured configurations that emerge when multiple normative sources are recombined within institutional arrangements. Hybridization refers to the process through which multiple normative frameworks – international, regional, and domestic – are selectively recombined into novel, context-specific governance configurations. Rather than treating norms as discrete units that are either adopted or resisted, this perspective foregrounds the structured reassembly of external governance models and domestic institutional imperatives. Hybrid norms thus emerge not as partial adaptations of a single template but as patterned syntheses shaped by infrastructural entanglements, political contestation, and strategic positioning. The typology developed here differs from existing typologies in norms research in several ways.Footnote 30
Wiener’s body of work makes several contributions that are relevant here. First, she develops a three-tier typology distinguishing fundamental norms, organizing principles, and standardized procedures according to degrees of generalization, specification, and contestability, showing that the most abstract norms are the most contested precisely because their meaning-in-use is least fixed.Footnote 31 Then she elaborates the methodological implications of this insight, arguing that norms are best studied through the discursive practices by which actors invoke, dispute, and reproduce their meaning across contexts.Footnote 32 She further consolidates these threads into the cycle-grid model, mapping how normative meaning shifts across nine ideal-typical sites of contestation as norms move through implementation at different scales of global order.Footnote 33 In her most recent contribution, she refines this model, distinguishing types of contestation (proactive, interpretive, and reactive) and types of constitutive behaviour vis-à-vis norms (construction, contested compliance, and violation), to provide a more granular account of how emergent, hidden, and extant norms are generated and sustained through practice. Together, these works develop a framework in which contestation operates within the life of individual norms, classifying them by structural properties and tracing how actors engage with, dispute, and transform their meaning through iterative practice. The present framework builds on this emphasis on contextual meaning and the generative role of contestation but departs from it in two respects. First, whereas Wiener’s framework tracks how a single norm’s meaning is transformed through iterative engagement, the hybridization framework addresses situations in which actors draw simultaneously on multiple competing norm clusters, originating in distinct international, regional, and domestic orders, to assemble novel governance configurations. The analytical object is not the contested meaning of a given norm but the structured outcome of recombination across normative sources. Second, where the cycle-grid model maps the sites and practices through which contestation of a single norm occurs, the hybridization framework focuses on explaining variation in governance outcomes across cases, specifying the scope conditions that determine which type of hybrid configuration emerges under conditions of normative plurality.
Second, Rosert conceptualizes norms at two analytical levels: emergence and effects.Footnote 34 Her model of norm emergence traces how a problem becomes institutionalized as a new norm through agenda diffusion and negotiation, while her typology of norm effects examines the intended and unintended behavioural consequences that individual norms generate in practice, including the distinction between prescriptive and proscriptive effects and between regulatory and constitutive functions. These contributions remain oriented towards the behavioural consequences of single norms: how one norm originates and what it does once established. By contrast, the ‘outcomes’ theorized here refer neither to the birth of a single norm nor to its behavioural effects on actors. Instead, they denote the structural configurations of governance arrangements that emerge when multiple normative sources are recombined under specific scope conditions. Rather than explaining how one norm originates or shapes behaviour, the hybridization framework accounts for how sets of norms, governance models, and institutional logics are assembled into distinct institutional configurations.
Finally, work on norm clusters and norm connections illuminates the internal relational structure of normative fields – how norms bundle, reinforce, or conflict with one another as they diffuse across institutional contexts.Footnote 35 These approaches are primarily concerned with the architecture of the normative fabric itself: mapping which norms travel together, how they mutually condition one another’s uptake, and where their interactions generate coherence or tension. Some of this scholarship, such as Krook and True’s analysis of norm bundling, does draw out implications for governance outcomes, showing how norm packages shape institutional design.Footnote 36 The hybridization framework takes such relational complexity as a starting condition and asks a different question, namely under what structural conditions do actors assemble elements drawn from competing normative sources into (more or less) stable governance configurations? The analytical interest thus shifts from mapping inter-norm relations within a single diffusion process to explaining cross-source recombination and its institutional outcomes across cases. Where cluster and connection approaches ask how norms relate to one another, the hybridization framework asks how actors select from among competing normative repertoires and why the resulting configurations vary.
The empirical relevance of this framework is illustrated in the following sections through a comparative analysis of cybersecurity and ethical AI governance in Indonesia, Malaysia, and the Philippines; two domains that, as the evidence shows, generate different hybrid configurations under the same external pressures. The hybridization framework is especially relevant given China’s ambitions to become a global technological superpower and its growing influence on Southeast Asia’s digital governance.Footnote 37 In this context, regional actors engage external governance models through active calibration, embedding technological components and regulatory templates within domestic institutional logics rather than replicating them wholesale.Footnote 38 Hybridization thus offers a productive lens for understanding norm conflict not merely as resistance or instability but as a source of normative innovation. China’s promotion of cyber sovereignty, bundled with infrastructure exports, illustrates how external governance models enter Southeast Asian contexts, but are mediated by domestic institutions and geopolitical calculation. Through this dynamic process, hybrid norms emerge as global technological governance models interact with local political, economic, and cultural conditions.Footnote 39 In the case of the DSR, Southeast Asian countries calibrate between competing frameworks promoted by China, the U.S., and the EU, while also drawing on regional initiatives such as ASEAN’s emphasis on responsible AI and cross-border data governance.Footnote 40 The diversity of domestic political systems generates differentiated trajectories: some states incorporate elements of Chinese-style infrastructure governance, while others align more closely with Western privacy and rights-based standards.
This pragmatic calibration is enabled by the active agency of domestic stakeholders. Governments may engage Chinese technology providers while imposing regulatory conditions to safeguard sovereignty. Local firms adapt imported technologies to national policy frameworks, and civil society actors shape public discourse around digital rights and accountability. Norm formation in Southeast Asia therefore reflects iterative, multi-level negotiation rather than unilateral imposition.Footnote 41 Digital governance arrangements emerge as context-specific syntheses shaped by infrastructural dependencies, geopolitical positioning, and domestic institutional mediation.Footnote 42
A typology of hybrid norms
To systematically capture variation in hybridization outcomes, I develop a typology of hybrid norm configurations. As clarified above, norms are here understood as shared standards of appropriate behaviour, while hybridization denotes the process through which actors selectively recombine elements from multiple normative sources into new governance arrangements. The resulting hybrid norms are not merely adapted versions of external templates, but context-specific configurations that reflect varying balances between foreign and domestic normative influence. I refer to a governance model as a relatively coherent assemblage of normative principles, regulatory templates, institutional arrangements, and technological infrastructures that together structure how authority, accountability, and control are organized within a given domain. Models operate at a higher level of abstraction than individual norms: they bundle multiple norms into institutionalized patterns of governance and are often embedded in material infrastructures and policy practices. While actors may rhetorically invoke ‘models’ as coherent alternatives, the term is used here analytically to denote patterned configurations of norms and institutions rather than monolithic or internally consistent systems.
The below typology classifies hybridization outcomes according to the relative weight of external and internal normative elements embedded within governance models. Rather than positioning cases along a linear spectrum between adoption and resistance, it identifies patterned configurations in which foreign norms may dominate, coexist in balance with domestic priorities, or be subordinated to local institutional logics. These configurations do not emerge randomly; they are shaped by scope conditions – economic dependency, institutional capacity, geopolitical alignment, and sectoral dynamics – which structure the opportunities and constraints under which recombination takes place. By distinguishing between dominant foreign influence, balanced hybridization, and dominant local influence, as shown in Table 1, the typology provides an analytical tool for comparing how digital governance norms are recomposed under similar external pressures but divergent domestic and geopolitical conditions.
A typology of hybrid norms: Outcomes and scope conditionsFootnote 43.
Table 1 Long description
The table classifies three types of hybrid norm outcomes and links each to five scope conditions: economic dependency, institutional and regulatory capacity, geopolitical strategy, and sectoral dynamics, plus outcome characteristics. In the dominant foreign influence type, high economic dependency and low capacity constrain local agency, producing strong alignment with an external model, high technological dependency, and only limited local adaptation; telecoms and security sectors tend to reinforce foreign-led models. In the balanced hybrid type, moderate dependency and moderate to high capacity enable institutionalized filtering and selective localization, alongside active hedging between major powers; AI and fintech are cited as sectors where blending is more feasible. In the dominant local influence type, low dependency and high capacity support domestic legal innovation and resistance to unwanted features, with democratic contestation and alignment with liberal or regional frameworks; governance and data-rights innovation are highlighted. Across the typology, higher dependency generally corresponds to stronger foreign leverage, while stronger institutions correspond to more coherent filtering and greater local reshaping. The sector examples are illustrative and may vary by country and time period.
This typology provides an analytical framework that can be applied comparatively across cases and issue areas. By identifying the degree of local adaptation and the level of foreign influence as core dimensions, the typology allows us to generate hypotheses about likely outcomes given a country’s structural position and domestic capacity. For example, where economic dependency is high but regulatory capacity is strong, we should expect balanced hybrids rather than wholesale foreign adoption; conversely, weak institutional capacity combined with high dependence is likely to result in dominant foreign influence. This predictive leverage extends the study of norm diffusion beyond post hoc classification towards systematic explanation. Table 2 further identifies key scope conditions to explain why particular hybrid normative configurations emerge across different national contexts. These conditions reflect both structural dependencies and the agency of domestic actors across levels of governance.
Scope conditions and actor dimensions for hybrid norm outcomes.
Table 2 Long description
The table links four scope conditions to operational variables and describes how each condition affects hybrid norm outcomes by degree or context. For economic dependency, high reliance on foreign trade and investment, especially with China, is associated with strong foreign leverage and limited resistance; moderate dependency allows hedging; low dependency supports greater autonomy. For institutional and regulatory capacity, high government expertise, legal traditions, and enforcement capacity support filtering and adapting external norms; moderate capacity leads to uneven translation; low capacity risks incoherent norms or passive adoption. Geopolitical strategy through hedging is not ranked by degree; instead, engagement with multiple great powers, diplomatic positioning, and norm alignment strategies can moderate other conditions and increase flexibility for hybrid outcomes. Sector-specific dynamics vary by domain: technology path dependencies, actor constellations, and legacy regulation can make telecoms and security sectors more likely to follow foreign templates, while AI governance may leave more room for local reinterpretation. Effects are qualitative and context-dependent, so the same condition can play out differently across sectors and political settings.
The scope conditions outlined in the table provide a structured lens through which to understand the conditions under which hybrid digital governance norms are likely to emerge in Southeast Asia, and how they are negotiated in practice. They are meant to be ideal types and not a comprehensive list of all relevant factors that may shape the emergence of hybrid norms, and they are not presented in any particular hierarchy. On the one hand, factors such as economic dependency and geopolitical strategy underscore the structural constraints imposed by global power asymmetries and alignments – highlighting how external pressures, particularly from dominant states like China, can shape the normative space available to host countries. On the other hand, institutional and regulatory capacity, along with sector-specific dynamics, foreground the role of domestic agency by emphasizing how internal competencies, legal traditions, and sectoral configurations mediate norm uptake.Footnote 44 Crucially, these conditions do not operate in isolation; their effects are contingent and context-dependent. For example, high economic dependency may constrain agency in one period but be offset by institutional resilience or geopolitical hedging in another. Likewise, sectoral differences – such as between highly standardized telecoms infrastructure and more open-ended AI governance – create varying degrees of normative flexibility. This interplay between structure and agency underscores the importance of temporality and context in explaining how and why hybrid norm configurations emerge across different settings.
Economic dependency shapes the baseline terrain of norm diffusion: where states are highly reliant on a foreign power for digital infrastructure and investment, economic leverage acts as a conduit for normative influence, especially when financing is bundled with embedded governance templates. Its effect is not uniform; however, high dependency produces dominant foreign influence only when institutional capacity is insufficient to filter and recompose incoming norms.
Institutional and regulatory capacity determines whether external norms are absorbed passively or actively recombined. Strong bureaucracies and coherent legal systems enable selective localization and rearticulation; low capacity tends to produce shallow or incoherent uptake, with norms entering largely intact rather than reconfigured.
Geopolitical hedging expands the normative space available to domestic actors by preventing lock-in to any single external model.Footnote 45 Where states maintain parallel engagements with competing great powers and regional institutions, they can draw selectively from multiple normative repertoires, a condition that is structurally reinforced in the Southeast Asian context by ASEAN’s non-exclusivity norms.
Sector-specific dynamics condition the degree of normative flexibility available within each domain. Technically standardized sectors such as telecommunications carry strong path dependencies that favour compliance with established international benchmarks, while more ideationally open domains such as ethical AI governance create greater space for domestic recalibration and multi-source recombination. While these four scope conditions form the structural foundation of hybrid norm outcomes, they do not operate in isolation. Their effects are mediated by actor-level attributes and relational dynamics, which cut across these conditions. Civil society actors and independent media play a critical role in norm contestation and reframing. Where vibrant civic ecosystems exist, they often introduce counter-narratives, highlight normative tensions, and mobilize demands for transparency, accountability, or rights-based protections. Their capacity and autonomy directly influence the degree of normative recalibration. Business actors and sectoral coalitions shape regulatory outcomes, particularly in areas where commercial imperatives intersect with governance concerns. The political culture – including norms of consultation, authority centralization, and inter-institutional coordination – conditions how different actors interact and contest norms. Complexity (i.e., the number and diversity of stakeholders involved) affects whether hybrid norms are deliberately negotiated or emerge organically from competing pressures.
These scope conditions and actor-level dynamics form an interactionist model of norm diffusion in which structural constraints and domestic agency jointly shape the emergence of hybrid configurations. Hybridization is therefore neither deterministic nor static, but contingent on shifting alignments, institutional capacities, and sectoral contexts. In the empirical analysis that follows, this is most visible in the ethical AI governance domain, where Indonesia’s civil society actors and Malaysia’s multilateral engagement practices actively mediate between external frameworks and domestic normative priorities, contributing to balanced hybridization outcomes that neither cybersecurity’s compliance-driven logic nor a purely structural account of dependency would predict.
This reconceptualization advances theoretical debates by offering a more granular and systematic tool for analysing norm variation in hybrid governance regimes. It allows scholars to anticipate whether hybridization is likely to occur and how it is likely to manifest given a country’s specific institutional, geopolitical, and sectoral profile. In the empirical sections that follow, I apply this framework to three Southeast Asian countries, demonstrating how certain digital norms are taken up, recalibrated, or resisted. These countries selectively integrate technological components and regulatory language aligned with Beijing’s digital infrastructure offerings while embedding these within domestic regulatory traditions and political constraints. The resulting norms are neither fully Chinese nor Western, but rather hybrid constructs shaped by iterative negotiation, contestation, and synthesis.
Research design and case selection
The study adopts a comparative design that seeks to account for shared external pressures while examining how norm hybridization varies across domestic contexts. By concentrating on Southeast Asia, the analysis situates all cases within a broadly similar geopolitical environment shaped by U.S.–China technological competition. At the same time, this regional focus preserves meaningful differences in institutional capacity, economic exposure, and hedging strategies. Southeast Asia has become a key arena of digital governance contestation, as states are deeply embedded in global digital infrastructures and engage intensively with both Chinese and Western actors. Importantly, ASEAN provides more than a shared geographical setting. As a regional institution, it promotes established preferences for consensus-building, non-exclusivity, and strategic autonomy. These principles encourage member states to avoid rigid alignment with a single normative model and instead favour pragmatic accommodation and layered adaptation.
In particular, ASEAN shapes member states’ hybridization trajectories through at least three concrete institutional mechanisms. First, its consensus-based decision-making procedures, formalized in the ASEAN Charter and operationalized through the principle of non-interference, create strong incentives for member states to avoid normative commitments that would visibly align them with any single great power, thereby institutionally reinforcing hedging behaviour. Second, ASEAN’s sectoral governance forums, such as the working groups under the ASEAN Digital Integration Framework, provide platforms through which competing external standards, from China, the EU, and the U.S., are simultaneously present and must be navigated collectively, encouraging layered and negotiated norm uptake rather than wholesale adoption. Third, ASEAN’s own normative outputs, particularly the ASEAN Guide on AI Governance and Ethics and the ASEAN Framework on Digital Data Governance, function as intermediate normative templates that member states draw on to mediate between external models and domestic priorities.Footnote 46 These outputs do not resolve normative tensions but provide a legitimate regional register through which states can selectively incorporate external principles while maintaining a degree of collective autonomy. These mechanisms mean that ASEAN is an active institutional channel through which it is structured and reproduced, thus shaping how external digital norms are interpreted, filtered, and recombined rather than simply adopted or rejected.
Within this context, Indonesia, Malaysia, and the Philippines are selected because they face comparable exposure to great-power technological rivalry yet differ in analytically relevant ways. All three are hybrid political systems engaged in digital governance reform, but they vary in regulatory capacity, institutional coherence, and external alignment strategies. This combination of shared regional conditions and domestic variation enables systematic comparison of hybrid norm outcomes. Other Southeast Asian countries with strong ties to China were excluded on grounds of analytical comparability and case leverage. Cambodia and Laos show limited industrial capacity and high levels of external economic and technological dependence, which substantially constrain policy autonomy. Myanmar and Thailand were excluded due to their acute political instability. Structurally distinct political systems, such as single-party Vietnam and the city-state of Singapore, were omitted to preserve comparability.
The analysis draws on a large corpus of semi-structured interviews and publicly available written material, analysed through structured thematic coding in NVivo. The coding framework was aligned with the hybridization framework and included codes capturing references to external governance models, domestic normative priorities, and instances of institutional filtering or negotiation. Rather than treating interviews as illustrative anecdotes, the analysis traces how actors articulated trade-offs, justified regulatory choices, and referenced competing normative frameworks, enabling systematic identification of recombination processes and classification of cases according to the typology of hybrid norm configurations. The analytical process combined structured deductive coding with iterative inductive refinement. A coding guide was developed through team discussions drawing on fieldwork insights and desk research, trialled on a subset of interviews and speeches, and consolidated as a deductive instrument applied systematically across the full corpus. Hybrid norm classification, operationalized through the three types introduced in this article (dominant foreign influence, balanced hybrid, and dominant local influence), was embedded in the primary coding process from the outset rather than applied retrospectively as an interpretive overlay, with explicit decision rules for classifying data points according to the relative weight of external and domestic normative elements. These decision rules were themselves sharpened through the trialling phase, as ambiguous cases surfacing during early coding prompted clarification of category boundaries before systematic application across the full corpus.
Coding was conducted by the research team at the project’s host institute and subject to periodic consistency reviews, in which team members compared classifications of complex or ambiguous passages and resolved discrepancies through discussion. Cross-case patterns were identified by querying the coded NVivo project along country, actor type, and sectoral dimensions, enabling systematic comparison of hybrid norm outcomes across Indonesia, Malaysia, and the Philippines within and across domains. The comparative design forms part of a broader collaborative research project on technological competition and third-state agency. The selection of cybersecurity and ethical AI governance as focal domains is itself informed by the coding process: these themes generated high cross-case salience in both interview material and policy documents while also revealing contrasting hybridization patterns.Footnote 47
Hybrid norms in Southeast Asia’s digital governance
While the hybridization framework has broad applicability, this article illustrates its analytical leverage through China’s influence in Southeast Asia’s digital governance, a case that combines high infrastructural exposure with a strongly articulated normative model, making it well-suited to testing whether and how hybridization occurs under conditions of significant external pressure. A growing body of scholarship suggests that China’s exports of critical technologies promote not only infrastructure but a state-centric normative model emphasizing cyber sovereignty, centralized data control, and flexible state intervention.Footnote 48 Whether and how these norms are taken up, filtered, or recombined in recipient states is shown in the comparative analysis below across two domains: cybersecurity and ethical AI governance, which, as the findings show, produce strikingly different hybridization outcomes.
Cybersecurity
Across Indonesia, Malaysia, and the Philippines, cybersecurity reflects a configuration of dominant foreign normative influence, consistent with the scope conditions of high technological dependency on Western infrastructure providers, limited domestic institutional capacity for normative filtering, and a sector characterized by technical path dependencies that favour compliance with established international standards over local normative innovation.
Indonesia’s cybersecurity governance relies heavily on internationally recognized technical standards. Government officials explicitly confirm adherence to International Organization for Standardization (ISO) 27001, which ‘provide[s] guidelines for organizations to follow, minimizing data leakage or human error’.Footnote 49 Alignment extends into the private sector, where fintech firms and other industries operate under regulatory requirements tied to global benchmarks.Footnote 50 Governance, Risk, and Compliance protocols are structured around ISO and National Institute of Standards and Technology standards, forming part of red and blue teaming methodologies.Footnote 51 This multi-layered alignment is further confirmed at the firm level. As one member of the cybersecurity community explained, organizations ‘align with the BSSN [National Cyber and Encryption Agency] standards, based on ISO 27001’, while ‘fintech companies adhere to OJK [Otoritas Jasa Keuangan]Footnote 52 standards, banks follow BI [Bank Indonesia]Footnote 53 regulations, and ISO compliance aligns with the guidance of regulators’, producing what the interviewee described as ‘a comprehensive approach’ in which domestic regulatory bodies function as transmission mechanisms for international standards rather than as sites of normative innovation.Footnote 54 Although Indonesia references sovereignty and maintains agencies such as the BSSN, these institutions primarily disseminate and implement externally derived standards rather than generating alternative frameworks.Footnote 55 Interview evidence reveals little substantive effort to reinterpret or localize international cybersecurity norms. Recombination in this sector is thus minimal. Instead of synthesis, Indonesia embeds foreign-derived standards directly into domestic governance architecture. Sovereignty rhetoric does not translate into normative innovation.
Malaysia’s cybersecurity governance is shaped by extensive multilateral engagement and reliance on international frameworks. Officials note that cybersecurity became securitized after UN Information and Communication Technology resolutions, suggesting reactive alignment rather than proactive norm development.Footnote 56 Malaysia endorses UN Group of Governmental Experts and Open-Ended Working Group norms, but implementation remains limited. In 2019, Malaysian delegate to the UN Ahmad Tajuddin emphasized Malaysia’s support for ‘norms, rules, and principles of responsible behaviour in cyberspace’ but admitted that such participation was driven by the need for ‘continued dialogue’ rather than concrete implementation.Footnote 57 Regulatory authority is dispersed across multiple agencies (National Cyber Security Agency, CyberSecurity Malaysia, and the Ministry of Defence), producing ‘overlapping portfolios and less-coordinated functions’.Footnote 58 This fragmentation constraints systematic localization of imported standards. Capacity-building initiatives, such as cooperation with Canada’s BlackBerry and the EU-ASEAN Horizon 2020 YAKSHA project, reinforce external normative anchoring. These partnerships focus on technology transfer and threat detection, not on local norm innovation.Footnote 59 This external anchoring is reinforced at the regional level. The 2023 ASEAN Ministerial Conference on Cybersecurity endorsed the establishment of an ASEAN Regional CERT and welcomed continuing capacity-building through the ASEAN-Japan Cybersecurity Capacity Building Centre and the ASEAN-Singapore Cybersecurity Centre of Excellence, with participants proposing that both centres ‘focus their efforts on developing capacity building programmes that would help ASEAN Member States to develop national capabilities to better address new and emerging threats’.Footnote 60 Notably, the conference also endorsed an ASEAN Regional Action Plan on norms implementation, proposing that it ‘should be utilised to identify specific capacity building activities that would help ASEAN Member States implement norms in line with national priorities and capability needs’.Footnote 61 This last formulation gestures towards a degree of domestic calibration, but the norms themselves remain externally sourced. Despite launching frameworks like the Malaysia Cyber Security Strategy 2020–2024, regulatory coherence is still weak. Malaysia’s cybersecurity governance thus involves adaptation rather than recombination. Institutional weakness limits active filtering, and global norms are incorporated largely intact.
The Philippines aligns closely with Western standards, particularly through its General Data Protection Regulation (GDPR)-inspired Data Privacy Act, which was described by one interviewee as ‘very strong because it is based on the European standard’.Footnote 62 However, this legal alignment has not translated into strong domestic enforcement; an interviewee noted that ‘it’s DICT [the Department of Information and Communications Technology] that’s … been championing for cybersecurity … government agencies aren’t taking that matter so seriously’; global actors, such as the U.S., the EU, and Australia, play a central role in capacity-building and policy framing. Interviewees characterize international cybersecurity as ‘really a Western show’.Footnote 63 Despite strong legal frameworks, enforcement remains weak. Agencies operate in ‘piecemeal and siloed efforts’ that hinder comprehensive cybersecurity planning,Footnote 64 and digital sovereignty remains conceptually underdeveloped.Footnote 65 Leadership and coordination deficits constrain domestic normative agency. The tension between subscribing to international norms and navigating competing external pressures is acutely felt by Philippine officials. A senior National Security Council director articulated the dilemma as follows: while they advocate for following and implementing the UN 11 norms, they acknowledge that several ASEAN states ‘are recipient of investments from a state that is not in concurrence with that UN norms … so how are you going to strike the balance?’Footnote 66 This recognition of normative tension, however, has not translated into a distinctive Philippine framework; rather, it reinforces reliance on established international benchmarks as the default governance template. Notably, Chinese actors are largely absent from normative cybersecurity governance. Hybridization here is limited. Foreign standards are adopted formally, but fragmented institutions inhibit meaningful reinterpretation.
Despite variation in institutional strength and political rhetoric, in the case of cybersecurity governance, all three countries converge around Western-led standards with minimal localization. This outcome is driven chiefly by strong sectoral path dependencies that favour compliance with established international standards over local normative innovation, reinforced by limited institutional capacity for normative filtering. Chinese normative influence is notably absent. While Chinese firms provide infrastructure or donations (e.g., laptops to the Filipino defence staff), interviewees express mistrust of Chinese platforms, citing security and sovereignty concerns.
Ethical standards
In contrast to cybersecurity, ethical standards in AI and digital governance exhibit balanced hybridization across all three cases. Country-level economic dependency is moderate-to-high and it interacts with higher institutional capacity for normative deliberation, active geopolitical hedging, and a sector whose ideational openness affords far more space for domestic recalibration than compliance-driven technical domains.
Indonesia articulates an explicit ambition to shape digital norms in line with national values. Policymakers emphasize ethical consensus-building and a ‘gradual approach’ focused on stakeholder agreement rather than rigid compliance.Footnote 67 As one respondent noted, ‘the aspiration to create its own digital norms is indicative of Indonesia’s desire to actively contribute to shaping the global digital landscape … [It] seeks to influence norms that align with its values and principles’.Footnote 68 Ethical governance is grounded in Pancasila and Indonesia’s cultural diversity.Footnote 69 Civil society actors emphasize alignment with local values and informational contexts, in line with ‘Indonesia’s informational and contextual intricacies’.Footnote 70 This domestically grounded approach to ethical governance is articulated at the highest levels of government. A senior official stressed ‘the importance of integrating Pancasila … into the digital world’, framing digital ethics not as a matter of adopting international standards but of ‘ensuring that Indonesians are well-versed in navigating the digital landscape while upholding national values’.Footnote 71 This Pancasila framing represents a distinctive localization strategy: rather than contesting global ethical principles directly, it provides a domestic normative anchor through which international standards are filtered and legitimized. At the same time, Indonesian scholars characterize this not as withdrawal from global engagement but as an effort to ‘actively contribute to shaping the global digital landscape’ by ‘participating in international discussions and collaborating with other nations’ while seeking to ‘influence norms that align with its values and principles’, reflecting ‘a nuanced understanding of the interplay between sovereignty, global interconnectedness, and the need to define norms that resonate with Indonesia’s unique context’.Footnote 72 These perspectives illustrate that Indonesia’s balanced hybridization in ethical standards operates through a dual movement: anchoring in domestic philosophical traditions while simultaneously engaging outward to shape, and not merely receive, foreign norms.
Malaysia combines strong bureaucratic capacity with multilateral engagement. Ethical governance is framed not only as a technical issue but as a social one. A key national speech stated: ‘we must remain grounded in human values, ensuring that our digital journey is shaped by compassion, ethics, and empathy’, and called for ‘responsible AI solutions that adhere to the highest ethical standards, ensuring transparency, fairness, and accountability’.Footnote 73 The Chief Justice of Malaysia similarly noted that ‘there are very few laws in place to regulate [AI] use’.Footnote 74 Digital ethics are integrated into broader ESG frameworks and legal reform agendas.Footnote 75 Although China is a major economic partner, normative references in this domain draw overwhelmingly from Western and multilateral principles. Interview evidence confirms this outward-looking but adaptive posture. One think tank analyst observed that ‘normatively, Malaysia doesn’t have an indigenous way to protect its digital sphere and to match the international standard’, noting that ‘we look at what other countries do, and we try to match it with [the] domestic market’.Footnote 76 This assessment highlights that Malaysia’s engagement with global ethical norms is driven less by ideological alignment than by pragmatic capacity constraints, a pattern consistent with balanced hybridization, where external frameworks are adopted not uncritically but through deliberate calibration to domestic conditions. This is particularly visible in data governance, where analysts describe an active policy debate about whether to absorb ‘Europe’s GDPR to domestic Malaysian law as part of a condition as trading nations or to have a separate privacy law for Malaysian legal consumption’.Footnote 77 Malaysia thus embeds international ethical norms within domestic governance priorities, particularly ESG and legal modernization efforts.
In the Philippines, foreign norms related to ethical standards in digital governance are explicitly filtered through national values, institutional capacities, and regional commitments. This approach is characterized by selective localization and legal-normative layering, supported by moderate economic dependency, institutional competence, and active geopolitical hedging. Officials stress that global engagement must reflect ‘societal values and priorities’.Footnote 78 A leading digital governance expert emphasized ASEAN’s consensus-oriented approach to norm-setting, which shapes ethical norm uptake.Footnote 79 This confirms an important feature of balanced hybridization – namely, that global norms such as the GDPR are considered reference points, but their uptake is negotiated to respect national agency and context. As one leading digital governance expert elaborated, ‘ASEAN tends to look at global best practices all the time … So we look at GDPR, we look at what the industry groups are saying, and then of course, industry groups lobby ASEAN also’, confirming that norm uptake operates through a layered process of institutional filtering in which global standards, industry advocacy, and regional deliberation interact before norms reach the domestic level.Footnote 80 The Philippines has embedded ethical concerns, such as fairness and bias in AI, within its national strategies. For instance, the Department of Trade and Industry’s national AI strategy includes explicit coverage of AI ethics, and there are multiple recorded concerns across government agencies about ‘biased AI’ and the need for ‘ethical and responsible’ deployment of technologies.Footnote 81 This concern extends beyond policy rhetoric into technical practice. A Filipino data scientist working on AI applications explained that even models that have been checked for bias in their country of origin may produce biased outputs when applied domestically: ‘[the model] it’s probably trained on data from other countries. It may not be the same as the Philippines. … So that’s why we have to … retrain it’.Footnote 82 This practice of local retraining illustrates balanced hybridization at the operational level: foreign AI models and their embedded ethical assumptions are not rejected but recalibrated to fit domestic informational contexts. Norms are thus layered rather than transplanted. Ethical standards are localized through regional multilateralism and national value framing.
The evidence presented here suggests that despite China’s strong infrastructural presence in Indonesia, Malaysia, and the Philippines, its normative influence over ethical standards in AI and digital governance to date is limited. Regulatory approaches draw predominantly on Western and multilateral frameworks – such as GDPR-inspired data protection, UN-endorsed norms, and global AI ethics principles – while being adapted through domestic institutions and values. Western-derived principles of transparency, accountability, and fairness dominate ethical discourse, while Chinese governance models are largely absent. Taken together, the comparison across cybersecurity and ethical AI governance illustrates the sectoral variation captured by the typology of hybrid norm configurations. In cybersecurity, all three cases cluster around dominant foreign influence, as Western-derived standards are incorporated with minimal reinterpretation and limited domestic norm innovation. In contrast, ethical standards in AI governance reflect balanced hybridization, where global principles are selectively integrated and recalibrated through domestic values, institutional capacities, and ASEAN-mediated multilateralism. The absence of dominant local influence in either sector further underscores that hybridization outcomes are structured by specific scope conditions rather than ideological preference alone.
These findings confirm the central claim of the proposed hybridization framework: under conditions of infrastructural dependency and geopolitical competition, norm uptake unfolds as patterned recombination shaped by economic factors, institutional capacity, and alignment.
Digital governance in Southeast Asia thus emerges as a differentiated landscape of hybrid configurations rather than a battleground of competing normative blocs. None of the three cases produced dominant local influence in either sector, an absence the framework anticipates, given that all three occupy a scope-condition band that points toward foreign-dominant or balanced outcomes rather than locally dominant ones.
Conclusion
This article has theorized hybridization as a structured, scope-condition-bound mode of norm evolution and demonstrated its analytical purchase through a comparative study of digital governance in three Southeast Asian countries. The framework moves beyond prevailing accounts that treat norm diffusion as convergence and deviation as failure, reconceptualizing uptake as a process of recombination in which actors assemble elements from multiple normative sources – international, regional, and domestic – into context-specific governance configurations. Its main contribution lies in specifying when and why particular hybrid configurations emerge, linking variation in outcomes to identifiable structural and sectoral conditions.
While China plays a significant role in providing digital infrastructure across Southeast Asia, its normative influence to date remains limited: cybersecurity governance converges around Western-derived standards, and ethical AI frameworks reflect balanced hybridization shaped by domestic values and ASEAN-mediated multilateralism rather than Chinese models. This finding, however, does not mean the landscape is static. Within the hybridization framework, shifts in the scope conditions, particularly in the geopolitical hedging condition, would be expected to alter hybrid configurations over time. A sustained reduction in Western normative engagement, for instance, would narrow the range of competing repertoires available to host states, potentially shifting balanced hybrids towards dominant foreign influence configurations as the comparative leverage of alternative normative sources diminishes. Tracking such shifts is itself an analytical task the framework is designed to support.
While Southeast Asia served as an illustrative case in this article, the framework is broadly applicable to a range of semi-authoritarian and transitional contexts where external digital infrastructures intersect with domestic political and regulatory traditions. As such, norm hybridization offers a tool for analysing the emergent digital world order, where competing visions of sovereignty, control, and rights are not merely clashing, but being reconfigured in novel ways. The mechanisms it highlights – strategic recombination of external and domestic norms shaped by economic dependency, institutional capacity, geopolitical hedging, and sectoral dynamics – are observable across other regions. Similar dynamics appear, for instance, when African states integrate Chinese development finance norms or Latin American governments adapt European data protection standards.Footnote 83
Several other avenues for future research emerge from this framework. First, scholars should examine how digital public opinion within recipient states shapes, constrains, or facilitates the uptake and adaptation of foreign digital norms, a dimension largely absent from elite-driven accounts of hybrid norm formation. Second, more attention is warranted to the role of local tech firms and private sector actors as intermediaries who translate or filter foreign technologies and norms in line with domestic interests or market logics. Technology companies are increasingly emerging as norm entrepreneurs in their own right, shaping the stability and security of the digital domain,Footnote 84 and training programmes offered by Chinese firms such as Huawei represent promising sites for analysing normative power in practice.Footnote 85 Third, future research should investigate how hybrid norm configurations affect the robustness and resilience of governance frameworks over time: do hybrid arrangements produce more adaptive systems, or do they embed internal contradictions that generate instability? This represents the most natural extension of the framework developed here and connects directly to ongoing debates in the norm robustness literature.Footnote 86 Fourth, the adaptive dimension of norm entrepreneurship warrants closer scrutiny. Research suggests that norm entrepreneurs, and China in particular, adjust their normative messaging over time in response to feedback from recipient states, tailoring strategies to align with local elite preferences and governance styles.Footnote 87 Longitudinal research designs are better placed than the cross-sectional approach used here to capture how this learning reshapes norm diffusion trajectories. Fifth, hybridization reflects a broader trend of fragmentation in the world order, and future work should explore how fragmentation at the international, regional, and national levels drives norm recombination, and how both norm entrepreneurs and host states navigate this volatility. Finally, while this study focused on digital governance, the hybridization framework is transferable to other issue areas, including, for instance, environmental standards, health governance, and development finance, wherever competing normative orders intersect under conditions of infrastructural dependency and geopolitical competition.
Acknowledgments
The author is grateful to members of the NORM team for their insightful comments on earlier drafts of this article, especially Giacomo Bruni, Nic Marsh, Yoshiharu Wakabayashi, Greg Reichberg, Julio Amador III, Deryk Baladjay, Cheng-Chwee Kuik, Fikry Ahmad, and Habib Abiyan Dzakwan. I owe particular gratitude to Bjørnar Sverdrup-Thygeson and Stefano Guzzini, whose close reading sharpened the argument considerably. The anonymous reviewers and the editors provided detailed and constructive feedback, for which I am thankful. Finally, I am indebted to all the interviewees in Kuala Lumpur, Jakarta, and Manila, for taking time to share their knowledge with us. Any remaining errors are my own. This work was supported by the Research Council of Norway under grant number 325129.
Open access
