Big Companies Are Too Slow on AI. Startups Are Too Reckless. Both Lose.

In early 2025, two companies in Kuala Lumpur decided they were going to "do AI." One was a 4,000-person conglomerate with revenue in the billions. The other was a 9-person SaaS startup running off a single developer's laptop. They started on the same week. They both wanted the same thing — competitive advantage from generative AI before their competitors caught up.

A year later, neither of them had it.

The corporate had spent eighteen months in committee meetings, vendor evaluations, security reviews, legal sign-offs, and a "Phase 1 pilot" that never reached production. The startup had shipped an AI feature in a single weekend, hit production, and was now quietly leaking customer data into a third-party logs dashboard while a co-founder asked on a Slack channel whether anyone knew what GDPR actually said about embeddings.

Both stories are real. The names have been changed because we still talk to both of them. And both stories illustrate the same thing — that AI doesn't reward size, and it doesn't reward speed. It rewards something else entirely, which most companies in this country are not yet doing.

The Corporate: 18 Months, Zero Shipped

The corporate had everything you'd want for an AI rollout. They had data — twenty years of customer transactions, structured neatly in a Microsoft data warehouse. They had budget — a seven-figure line item earmarked for "AI transformation." They had executive sponsorship — the CEO had said the word "AI" thirty-one times in the last earnings call.

What they did not have was the ability to ship anything.

Month one was vendor selection. Three of the Big Four consulting firms pitched. Each pitch involved a forty-slide deck, two case studies from European banks, and a price tag in the high six figures. Month three was the procurement cycle. Month five was the kick-off workshop. Month six was the first "AI Steering Committee" meeting, which produced a 70-page strategy document that nobody was authorised to act on without sign-off from another committee.

Then came the security review. Then the legal review. Then the data classification review, because nobody could agree on whether the customer data being fed into the model was "internal," "confidential," or "restricted." Then a six-week debate about whether the model should run in Azure West Europe (closer to compliance teams) or Azure Southeast Asia (closer to actual customers).

Meanwhile, an unsanctioned WhatsApp group of mid-level managers had quietly started using ChatGPT on their personal phones to write reports, summarise meetings, and draft client emails. They got more value out of a USD 20 personal subscription than the entire RM 3.4 million programme had delivered. Nobody told the AI Steering Committee. They were too busy preparing for the Phase 2 review.

The Startup: 9 Days, Three Quiet Disasters

The startup did the opposite of everything the corporate did. There were no committees. There was no strategy document. There was a Friday afternoon, a co-founder reading a Hacker News thread, and a Slack message that said "we should put GPT into the product before our competitors do." By Monday morning there was a feature flag in production.

On paper, this is the success story. Move fast, ship things, learn from real users. The Silicon Valley playbook. By every superficial metric, the startup beat the corporate by a factor of fifty. They had AI in production while the corporate was still arguing about Azure regions.

Then the problems started arriving, one by one, all of them quiet.

From the outside, the startup looked like an AI success story. They had it in production. They had user testimonials. They had a feature page. From the inside, the AI feature was a leaky, expensive, legally exposed bolt-on that the team was too busy to fix because they were already shipping the next thing. Every problem above is fixable. None of them were being fixed. They were being deferred.

Same Disease, Different Symptoms

It's tempting to look at these two stories and conclude that the corporate had bad bureaucracy and the startup had bad discipline. That's true, but it misses the deeper point. Both companies had the same problem — they didn't actually understand what they were adopting. They just had different defence mechanisms when faced with that ignorance.

The corporate's defence mechanism was process. If we don't understand it, we'll convene a committee, hire a consultant, write a strategy, run a pilot, schedule a review. Each step felt like progress. None of the steps required anyone to actually understand the technology. You can run an entire AI programme without ever having read what a token is.

The startup's defence mechanism was speed. If we don't understand it, we'll just ship and find out. Fail fast. The problem is that AI doesn't fail fast — it fails quietly, three months later, in a customer support ticket or a privacy complaint or a finance review. By the time the failure surfaces, the team is six features deep into something else, and the original feature is now load-bearing.

Notice the third row. Both were vendor-led or hype-led, neither were problem-led. Neither company started from a clear, painful, well-defined business problem and asked "is AI the right tool for this?" They both started from "we should be doing AI" and worked backwards. That's the actual root cause, and it's why both stories ended in the same place — money spent, time spent, no real advantage gained.

Why Malaysian SMEs Get Hit Worst

Most Malaysian businesses sit between these two extremes — and they tend to inherit the worst of both. They have corporate-level decision lag (every IT investment goes through the boss, the brother-in-law accountant, and a vendor demo) but startup-level technical immaturity (no internal engineers, no security reviews, no idea what they're signing). They take six months to decide on a tool, and then six days to wire it into customer data with zero controls.

We've sat in meetings where a 30-staff company in Klang Valley spent three months evaluating "AI vendors" and then signed a contract for a generic ChatGPT wrapper that any of their staff could have built in an afternoon. We've also seen the opposite — a 12-person team in Penang who pasted their entire customer database into a free AI tool to "see what insights would come out," and only realised afterwards that they'd just sent every name, IC number, and transaction record to a US server with terms-of-service that allowed training.

What Actually Wins

The companies that are getting real value out of AI right now — and there are some, both globally and in Malaysia — share a profile that doesn't map cleanly onto "corporate" or "startup." They're doing four things in combination, and all four matter.

The Test Before You Start

If you're about to spend money on an AI initiative — internal tool, customer feature, vendor contract, anything — answer four questions before the first ringgit gets committed. If you can answer all four, you'll probably get value. If you can't answer any of them, you're about to repeat the corporate's eighteen months or the startup's nine days. Both are expensive in different ways.

Bottom Line

The corporate is still in committee. The startup is still patching leaks. Neither has the AI advantage they wanted, and neither will get it by doing more of what they're already doing. The corporate doesn't need another consultant. The startup doesn't need to ship faster. Both need to do the same uncomfortable thing — slow down enough to think, then move fast enough to build.

AI is not a vendor purchase. You can't buy your way to an advantage by signing a contract with the right firm. AI is also not a weekend hack. You can't ship your way to an advantage by wiring an API into customer data and hoping nothing breaks. It sits in the awkward middle — fast enough that committees can't keep up, deep enough that weekend hackers can't get away with it.

The companies that get this right in the next few years won't be the biggest, and they won't be the loudest. They'll be the ones who paused long enough to ask "what problem are we actually solving?", picked one, shipped a small honest version of it, and learned something real before going wider. That's it. Everything else — the strategy decks, the demo videos, the LinkedIn posts about being "AI-first" — is just noise from companies still stuck on one of the two extremes in this story.