The 2026 Philippine CEO Survey, conducted by Isla Lipana & Co./PwC Philippines with the Management Association of the Philippines, surveyed 176 CEOs and senior business leaders across industries in the Philippines. Some 83% expressed confidence in their industry’s 12-month outlook and 81% expect revenue growth.

The same respondents cited regulatory uncertainty and climate change at 93% each, geopolitical conflict at 92%, technology disruption at 85%, and supply-chain constraints and skills shortages at 84% each.

That is not a contradiction. A company can see opportunity in the Philippine economy while recognising the operating environment has become harder to read. The more useful question is what happens when these risks stop arriving one at a time.

The Risks Stopped Arriving One at a Time

Corporate risk management typically sorts exposure into categories: geopolitical, financial, operational, cyber, supply chain, regulatory, climate, technology, talent. Each gets its own owner and its own line in the annual report. Actual disruptions rarely respect those categories.

A geopolitical conflict raises oil prices. Higher oil prices raise electricity, transport and logistics costs. Higher operating costs compress margins and consumer demand. Slower demand pushes companies toward automation to protect productivity, which deepens dependence on AI, cloud infrastructure and the cybersecurity, data governance and skills base that dependence requires.

A geopolitical shock ends as a technology-and-talent problem, several steps removed from where it started.

The World Bank’s August 2026 assessment identifies two compounding shocks weighing on the economy: policy uncertainty and a surge in global energy prices. The Bank held its 2026 growth forecast at 3.7%, down from 4.4% in 2025. Headline inflation averaged 4.8% in the first half, driven largely by energy costs.

Energy Is Where the Chain Starts

The clearest evidence of convergence sits in the energy system, because the Philippines is a net importer of petroleum products and remains exposed to global fuel markets.

After hostilities involving the United States, Israel and Iran began on 28 February 2026, the Strait of Hormuz, a critical corridor for global oil shipments, was closed to shipping. On 24 March 2026, President Ferdinand Marcos Jr declared a state of national energy emergency under Executive Order No. 110.

Initial Independent Electricity Market Operator of the Philippines (IEMOP) simulations indicated that the Wholesale Electricity Spot Market (WESM) supply could exceed PHP9/kWh, compared with pre-conflict average WESM prices of PHP5/kWh or less.

For energy-intensive businesses, a WESM price spike can feed into procurement and tariff costs, depending on their supply contracts and exposure to spot-market pricing. It is an input-cost risk that can move faster than annual budgeting cycles can absorb.

The World Bank’s June 2026 financing package for Philippine energy and water security linked affordable, reliable electricity directly to business growth and investment, while highlighting reduced exposure to global fossil-fuel price shocks as a resilience priority.

The IMF’s 2026 assessment of Asia’s exposure to the same shock found the effects running through inflation, external balances and narrower monetary policy space, with knock-on disruption to fertiliser and petrochemical supply chains.

Its Philippines Article IV consultation separately named heightened geopolitical tension a downside risk precisely because it generates commodity volatility that reaches confidence, investment, tourism, trade and supply chains simultaneously, and can quickly move beyond the government-affairs function that first identifies it.

AI Adoption Is Compressing Several Risks Into One

More than eight in 10 surveyed CEOs have incorporated AI into their strategic or business plans, up from 68% a year earlier, and 79% have begun implementing AI initiatives. Read against the same survey’s 85% concern about technology disruption, 84% about skills shortages and 82% about cyber risk, AI adoption is not one more item on the risk register. It is the mechanism connecting several existing ones.

AI adoption requires specialist skills. Meeting that gap increases dependence on external providers and platforms. Platform dependence raises cybersecurity and data-governance exposure, which intersects directly with regulatory compliance, a concern already topping the survey at 93%.

In July 2026, President Marcos signed Executive Order 119, updating government data classification and establishing a risk-based data residency framework for government data, against a backdrop of expanding cloud and AI infrastructure. The 2026 Strategic Investment Priority Plan identifies cybersecurity, artificial intelligence and data science among its priority activities.

Meeting rising compute demand also raises electricity consumption, looping the chain back to the energy exposure above. The IMF has separately warned that AI and cloud dependency can create concentration risk, where an outage or breach at a single critical provider affects multiple institutions at once.

The Philippines is expanding its AI infrastructure regardless: its AI+ Infrastructure Masterplan 2026–2033 targets a 30-fold expansion in AI data-centre capacity, from a 50MW baseline to 1.5GW by 2033.

The binding constraint on all of this may increasingly be execution rather than capital. Skills shortages sit at 84% in the same survey, and the IMF’s Philippines assessment identifies skills development as central to digitalisation, including the exposure this creates for the country’s outsourcing sector.

The constraint is organisational: whether a company can recognise an interconnected risk quickly enough to act before the chain reaction it triggers has run its course.

Five Questions Replace the Old Risk Register

The shift for boards is from listing risks independently to interrogating how they interact. Five questions can reveal what a conventional risk matrix may miss:

1. Where are the critical dependencies across energy, suppliers, cloud, data, logistics, geography, financing and talent?
2. Which risks amplify each other when two or three materialise together?
3. What happens to unit economics under simultaneous stress from energy prices, currency movement, supply disruption and higher financing costs?
4. Where is transformation creating new dependencies, particularly through AI and cloud?
5. Which investments improve growth and resilience at the same time, rather than trading one for the other?

None of this replaces conventional risk management. It reorganises it around connections a category-based register cannot see.

Where the Convergence Becomes an Advantage

The Philippines is not short of policy momentum to work with. Digital infrastructure, AI, renewable energy, semiconductor investment and the Luzon Economic Corridor all sit inside the same growth agenda the government has set out.

Companies that understand interconnected risk can do more than limit exposure. The same visibility that helps them prepare for compounding shocks can also improve how quickly they identify and act on opportunities.

The Philippines is not facing one defining business risk. It is facing an environment in which geopolitics, energy, technology and talent increasingly move together. The question for management is no longer simply which risks are biggest. It is which risks amplify each other, and what happens when several land at once.

Indonesia signed Government Regulation No. 33 of 2026 on 16 July 2026 – the long-awaited implementing rule for the country’s 2022 Personal Data Protection Law. It circulated publicly only in late August. The regulation fills in detail on cross-border data transfers, breach notification and impact assessments that businesses had navigated without since the law took effect in October 2024.

It does not complete the picture. Article 58 of the 2022 law calls for a dedicated authority to oversee personal data protection. As of September 2026, that authority has yet to be formally established.

Deputy Minister of Communication and Digital Affairs Nezar Patria said in July, at a US-ASEAN Business Council dinner in Jakarta, that the agency will “operate independently across all its structures.” The presidential regulation establishing it is still being finalised.

The Capital Is Already Moving

The investment cycle is not waiting. Indonesia currently has around 580 megawatts of operational data-centre capacity. Coordinating Minister for Economic Affairs Airlangga Hartarto said, as reported by the Jakarta Post on 12 July 2026, that investors had expressed interest in another 1.3 gigawatts. That represents an estimated USD 15–20 billion in additional investment.

Some of that is already committed. Firmus Technologies, working with Nvidia, is developing a 360-megawatt AI Factory campus in Batam designed for up to 170,000 Nvidia accelerators. Offtake agreements, Firmus says, could generate USD 25–30 billion over six years. EDGNEX has separately committed USD 2.3 billion to a 144-megawatt facility in Cikarang.

Where Digital Growth Meets Governance

 

Two cybersecurity leaders from Indonesia interviewed for this piece describe the same commercial dynamic playing out across Indonesian enterprises. Ardi Sutedja K., chairman of the Indonesia Cyber Security Forum, frames it as a question of pace at the enterprise level.

“In my experience, one of the most significant gaps lies in the speed at which organisations are investing in AI and cloud technologies versus the pace at which their security governance is maturing. Many Indonesian enterprises are quick to adopt new technologies, driven by the promise of increased efficiency and competitive advantage.

“However, the same urgency is not always applied to developing robust security frameworks. This often results in a reactive rather than proactive approach to cyber security, where measures are only put in place after a breach has occurred,” he explained.

Sugiarto RM, founder of the Indonesia CXO Network, sees it playing out across the wider economy.

“Indonesia already has a growing regulatory framework around personal data, critical information infrastructure and financial-sector cyber resilience, while enterprises are simultaneously increasing spending on cloud, AI and digital infrastructure. The challenge is making sure those two curves converge.”

The National Cyber Security Index provides another indication of the governance challenge. Indonesia scores 47.50, receiving full credit for having personal data protection legislation while scoring zero on the indicator for an empowered personal-data protection authority.

The result highlights the distinction between having a regulatory framework on paper and having the institutional capacity to enforce it.

Banks Already Know What Governance Looks Like

The clearest contrast is financial services. Indonesian banks sit inside a supervisory framework where technology governance and cyber maturity are binding requirements, not aspirations.

OJK Regulation 11/2022 established IT-governance rules for commercial banks. SEOJK 29/2022 added annual cyber-maturity assessments. POJK 1/2026, effective since 1 March 2026, tightened information-technology and third-party risk requirements further.

Philip Lee, head of Orange Cyberdefense APAC, told Bizruption.asia that this is the point at which cybersecurity stops being an IT problem and becomes a board one.

“This shift is increasingly driven by the evolving threat landscape, regulatory compliance and growing pressure from shareholders and local governments. With increased regulatory requirements around data protection, critical infrastructure, incident reporting, and cybersecurity governance, boards have become more engaged with the organisation’s operational environments.

“A major cyber incident or compliance failure can directly affect revenue, business continuity, reputation, customer trust and legal exposure. Translating technical risks into business outcomes helps boards understand their risk appetite and accountability. As cybersecurity becomes integrated into enterprise risk management, it is increasingly recognised as a strategic business resilience issue rather than simply an IT expense,” he said.

Banking has a mechanism for making that translation visible. The question for the rest of Indonesia’s digital economy is how the same discipline can develop as the data centres, cloud platforms and AI ventures now absorbing its investment wave continue to scale.”

What Actually Closes the Gap

Ardi frames the work ahead as cultural before it is technical.

“There must be a cultural shift within organisations where cyber security is viewed as a shared responsibility. This involves continuous education and awareness programs to ensure that every employee understands their role in protecting the organisation’s digital assets.”

Sugiarto describes the practical work still outstanding.

“The corresponding governance layer, who owns the risk, how data is classified, what can be put into an AI model, how third-party and cloud risks are assessed, how identities and access are controlled, and how quickly an organisation can recover from a compromise, is often still catching up.”

The measure that matters, Sugiarto added, is not the size of the security budget. It is whether the board understands the cyber risk it is buying, accepting or transferring. Asked what would close the gap, he ranks the constraints directly.

“Regulation is the catalyst, budget is the enabler, talent is the constraint, but governance and accountability are what will actually close the gap.”

That ranking matters for how capital gets allocated. A regulation can set the obligation and a budget can fund the response, but neither guarantees that someone at the top of the organisation is accountable when the controls fail. That accountability is what boards and investors are now being asked to underwrite.

The USD 15–20 billion now moving into Indonesian data centres is part of a much broader digital transformation. As the country’s infrastructure, AI adoption and digital economy continue to expand, the evolution of governance and accountability will become increasingly important to the companies, boards and investors participating in that growth.

For investors, understanding how governance develops alongside that opportunity will be an increasingly important part of the decision-making process.

The War That Split Vietnam’s Own Energy Strategy in Two Iran’s disruption of Gulf energy flows in March delivered Southeast Asia’s largest energy shock in a decade. By late April, the region’s import bill had risen by an estimated USD 3.36 billion a month. AMRO held its 2026 ASEAN+3 growth forecast at 4.0% in June but raised its inflation call to 1.8% from 1.4%, because the war ran longer than expected and energy, commodity and logistics costs stayed high.

Headline growth no longer measures resilience. The real question is whether businesses still treat this as a passing oil shock rather than a permanent shift in the operating environment.

Inflation, subsidies, energy security and industrial competitiveness now move together. The war is not hitting Southeast Asia evenly. It is separating markets with real buffers from markets whose resilience runs out the moment the shock outlasts their patience.

The Region Looks Resilient. The Buffers Are Uneven

Southeast Asia entered 2026 from genuine strength. AMRO argues the region sits better than in past crises: inflation started low, energy efficiency improved, most governments kept policy room to manoeuvre. True in aggregate. False market by market.

The region still runs on imported hydrocarbons. The Middle East supplies roughly 55% of Southeast Asia’s crude oil imports. Oil and gas cover close to 90% of transport energy and 31% of electricity generation.

When Gulf shipments stopped moving, oil prices rose first. What mattered more: businesses had to rewrite assumptions about inflation, power costs, logistics, fiscal support and industrial competitiveness all at once.

This is not an energy shock. It is a repricing of how investors judge resilience across Southeast Asia.

The Assumptions That No Longer Hold

For years, Southeast Asia investment cases rested on four assumptions: cheap energy, cost-optimised supply chains, temporary geopolitical shocks, growth that outruns disruption. The war broke all four. Energy security is becoming a competitive advantage. Supply chains are being built for resilience, not cost. Disruption is becoming routine, not exceptional. Growth still matters, but capital is increasingly following staying power instead.

The Philippines Is the Clearest Stress Case

If one market shows the war’s direct transmission into economic risk, it is the Philippines. Manila declared a state of national energy emergency, expanded coal generation and pushed for regional energy cooperation. Transport subsidies and tax relief cushioned the initial blow but didn’t touch the underlying exposure.

The real risk isn’t the fuel price. It’s the speed: transport, food distribution and household spending all reprice fast once energy inflation accelerates, and a weakening consumer can turn a commodity shock into a demand shock.

For boards, the Philippine question isn’t headline GDP. It’s how fast inflation, subsidy strain and softer household demand start feeding each other.

Boardroom Implication: Stress-test Philippine demand forecasts against prolonged energy inflation. Don’t assume fuel costs snap back.

Indonesia Can Buffer the Shock, But the Fiscal Bill Matters

Indonesia looks more resilient, but the resilience is rented. Pertamina’s price controls have capped the pass-through of higher fuel costs, holding down headline inflation. The price is a growing subsidy bill: the longer the war runs, the more the government pays to keep pump prices still.

For investors, the risk isn’t an energy shortage. It’s a slow transfer of market risk onto the state’s balance sheet. Expand the subsidy and fiscal room narrows. Cut it and inflation jumps.

Indonesia’s lesson for boards: government intervention delays repricing. It doesn’t cancel it.

Boardroom Implication: Weigh Indonesia’s fiscal resilience against its resource strength. Subsidies move risk from consumers to the government’s balance sheet. They don’t remove it.

Thailand and Malaysia Have Better Shock Absorbers Than Their Neighbours

Thailand and Malaysia sit in a steadier middle, for different reasons. Thailand leans on its Oil Fuel Fund and refinery capacity to smooth prices at the pump. Malaysia has held its RON95 price at MYR 1.99 a litre throughout, a subsidy Prime Minister Anwar Ibrahim has said could reach MYR 24 billion this year if the war drags on.

Neither is insulated. Both face higher energy costs, softer demand and pressure on energy-intensive industry. What separates them is that both still have policy levers left to pull.

The sharper question isn’t whether they can absorb today’s prices. It’s whether prolonged disruption changes the competitiveness of the industries they’re courting.

Thailand is building itself into a regional hub for EVs, advanced manufacturing and logistics. Malaysia is fighting for semiconductor production, AI infrastructure and hyperscale data centres – sectors that need reliable power and predictable costs far more than they need a tax holiday.

If energy costs stay structurally higher, the next competitive edge goes to governments that can guarantee power and fiscal room, not the ones offering the biggest incentive package.

The war hasn’t broken either country’s investment case. It has raised the price of executing it.

Boardroom Implication: Weigh long-term energy availability alongside labour costs and incentives. The next competitive edge may come from resilience, not price.

Vietnam Shows How Quickly Transition Narratives Can Reverse

Vietnam shows how fast a transition story can reverse. Its manufacturing success now depends on energy resilience as much as labour costs and supply-chain diversification. During the crisis, Hanoi loosened fuel pricing, cut fuel taxes and restricted exports.

More telling: coal-fired generation jumped 44% month on month in March. That single number says more about the region’s energy vulnerability than any policy speech.

Vietnam is still Southeast Asia’s strongest long-term manufacturing story. But the war proved how fast an ambitious transition plan yields to immediate energy security, and that matters to boards, lenders and long-term investors well beyond environmental policy.

It touches electricity reliability, financing assumptions, operating costs, and the economics of export manufacturing assets priced under a different energy scenario.

The difference now: investors should price a higher premium for energy resilience than most valuation models assumed six months ago.

Boardroom Implication: Stress-test manufacturing investments against scenarios where energy security beats decarbonisation, temporarily or not.

The Second Shock Is Strategic

AMRO’s June update confirms the damage has spread past fuel markets. Energy, commodity and logistics costs have surged; petroleum supplies have tightened; disruption has reached industrial inputs including helium, sulfur and fertiliser.

This is where geopolitics becomes a boardroom risk: logistics costs, insurance premiums, commodity prices and financing conditions keep moving long after the military headlines fade.

It’s also where Southeast Asia’s markets start to separate. Smoothing pump prices for a month is easy. Absorbing logistics costs, protecting fiscal space, holding industrial competitiveness and keeping an energy transition on track – all at once, for a year – is not. That gap is the real divide opening across the region.

The Iran War Is Repricing Resilience

The war’s first phase was an energy shock. Its second phase is a strategy shock. Markets that once looked equally attractive are diverging by their ability to absorb repeated disruption.

Energy security, fiscal flexibility, industrial competitiveness and policy credibility are converging into a single investment consideration, not four separate ones. That’s why this conflict matters past the Middle East: it is quietly rewriting how capital gets allocated across Southeast Asia.

Companies still evaluating the region on labour costs, consumer growth and incentives alone are missing the forces now deciding who wins. The region remains one of the world’s most attractive destinations for capital. Resilience, though, is no longer evenly distributed and preparing for the next shock matters less than accepting that disruption is now part of the operating environment.

Photo Credit Tom Fisk

In April 2026, the Federation of Thai Industries reported that Thailand produced 369,751 vehicles in Q1 2026, up 5.3% year-on-year and the first quarterly increase in six quarters. The BOI has also confirmed 137.7 billion baht in committed EV supply-chain investment through June 2025. Both figures are real. Neither tells the story that fund managers and private equity principals with Thai automotive exposure actually need.

The Q1 recovery was partly driven by compensatory production requirements under Thailand’s EV incentive framework, not by a clean return to organic demand. The investment pipeline is building a supply chain with different ownership, different technology content and different value capture from the one it is replacing. That is the variable that does not appear in the headline numbers.

The Production Numbers Are Real. The Recovery Story Is Not

Thailand produced 1.47 million vehicles in 2024, down 26.5% from 2019. Domestic sales also fell sharply in 2024, marking one of the weakest periods for the sector in years. Honda has already closed its Ayutthaya vehicle assembly line, while Nissan, Suzuki and Subaru have consolidated or exited Thai production altogether.

That does not mean the sector is stabilised. BEV output in 2024 remained a small share of total production, and the spike in EV assembly late in 2025 reflected production-offset obligations rather than a clean demand-led rebound. Surapong Paisitpatanapong of the Federation of Thai Industries said the domestic production spike was tied to companies fulfilling those compensation requirements.

For investors reading the production figures, the context matters. A factory meeting a regulatory deadline is not the same as a factory running because end-demand has returned.

The EV Investment Is Replacing One Supply Chain with Another

The 137.7 billion baht in committed EV supply-chain investment is real capital, but the more important question is what it is building and who captures the value. Japan’s OEM ecosystem spent decades building a dense Thai supplier base across steel, plastics, tyres, logistics and tier-two and tier-three manufacturing.

The emerging EV ecosystem is different. Chinese brands now dominate Thailand’s EV market and the supply chain is more dependent on imported battery cells and core technology, with Thai participation still concentrated in assembly and lower-value components.

That matters because the capital headline tells you investment is arriving. It does not tell you how much of that capital stays in Thailand.

The EV3.5 framework also raises the domestic production ratio to 2:1 in 2026 and 3:1 in 2027 for imported EVs under the scheme, while the government continues to support a broader electrification transition.

That creates a more structured path for production commitments, but it also accelerates the pressure on older ICE supplier networks. Thailand’s automotive institute has warned that a large number of workers remain exposed to displacement as the sector reconfigures.

For private equity principals holding Thai industrial assets, that creates two forms of risk at once: earnings pressure from a restructuring sector and balance-sheet risk from assets whose future cash flows may have been modelled against the wrong transition speed.

The Japanese Signal the Market Has Not Priced

Masato Otaka, Japan’s ambassador to Thailand, said at The Standard Economic Forum on 29 June 2026 that “EV is not a singular answer.” That line matters because it reflects a broader multi-pathway argument – EVs, hybrids and biofuels in parallel – that aligns with the commercial interests of Japanese OEMs still tied to existing Thai production.

Thailand’s 30@30 target remains a policy ambition rather than a fully binding industrial endpoint. If the government continues to lean toward a multi-pathway approach, the transition will stay slower and more uneven than a pure-EV narrative suggests.

That extends the window for Japanese OEM production. It also extends the uncertainty for suppliers caught between two industrial architectures with different technology paths and different capital needs.

The market is not yet pricing that tension cleanly.

The Portfolio Question the Headline Numbers Do Not Answer

At current valuations, the Asia-Pacific private equity market does not reward earnings uncertainty. The Thai automotive sector carries structural uncertainty on two axes: the speed of Chinese EV capital displacing Japanese supplier networks, and the extent to which Thailand’s policy path stays on a multi-track rather than a pure-EV trajectory.

The sector is not at a crossroads. It has already taken one turn. Production has fallen, Japanese capital has consolidated and Chinese EV capital has entered. The question for investors is whether the assets they hold were valued for the road already taken or the one they were told was coming.