Big Companies Are Too Slow on AI. Startups Are Too Reckless. Both Lose.

In early 2025, two companies in Kuala Lumpur decided they were going to "do AI." One was a 4,000-person group with revenue in the billions. The other was a 9-person SaaS startup running off one developer's laptop. They started in the same week, and they both wanted the same thing: an edge from generative AI before their competitors caught up.

A year later, neither of them had it.

The corporate had spent eighteen months in committee meetings, vendor pitches, security reviews, legal sign-offs, and a "Phase 1 pilot" that never reached production. The startup had shipped an AI feature in one weekend, pushed it live, and was now quietly leaking customer data into a third-party logs dashboard while a co-founder asked in a Slack channel whether anyone knew what GDPR actually said about embeddings.

Both stories are real. We changed the names because we still talk to both of them. And both show the same thing: AI doesn't reward size, and it doesn't reward speed. It rewards something else, which most companies in this country are not yet doing.

The Corporate: 18 Months, Zero Shipped

The corporate had everything you'd want for an AI rollout. They had data: twenty years of customer transactions, sitting neatly in a Microsoft data warehouse. They had budget, a seven-figure line item set aside for "AI transformation." And they had backing from the top, with the CEO saying the word "AI" thirty-one times in the last earnings call.

What they did not have was the ability to ship anything.

Month one was picking a vendor. Three of the Big Four consulting firms pitched. Each pitch had a forty-slide deck, two case studies from European banks, and a price tag in the high six figures. Month three was procurement. Month five was the kick-off workshop. Month six was the first "AI Steering Committee" meeting, which produced a 70-page strategy document that nobody was allowed to act on without sign-off from another committee.

Then came the security review. Then the legal review. Then the data classification review, because nobody could agree whether the customer data going into the model was "internal," "confidential," or "restricted." Then a six-week argument about whether the model should run in Azure West Europe (closer to compliance teams) or Azure Southeast Asia (closer to actual customers).

Meanwhile, an off-the-books WhatsApp group of mid-level managers had started using ChatGPT on their personal phones to write reports, summarise meetings, and draft client emails. They got more value out of a USD 20 personal subscription than the whole RM 3.4 million programme had delivered. Nobody told the AI Steering Committee. They were too busy getting ready for the Phase 2 review.

The Startup: 9 Days, Three Quiet Disasters

The startup did the opposite of everything the corporate did. No committees. No strategy document. Just a Friday afternoon, a co-founder reading a Hacker News thread, and a Slack message that said "we should put GPT into the product before our competitors do." By Monday morning there was a feature flag in production.

On paper, this is the success story. Move fast, ship things, learn from real users, the whole Silicon Valley playbook. On every surface-level measure, the startup beat the corporate by a mile. They had AI in production while the corporate was still arguing about Azure regions.

Then the problems started arriving, one by one, all of them quiet.

From the outside, the startup looked like an AI success story: running in production, user testimonials, a feature page. From the inside, the AI feature was a leaky, expensive, legally exposed bolt-on that the team was too busy to fix, because they were already shipping the next thing. Every problem above is fixable. None of them were being fixed. They were being put off.

Same Disease, Different Symptoms

It's tempting to look at these two stories and say the corporate had too much bureaucracy and the startup had too little discipline. That's true, but it misses the deeper point. Both companies had the same problem: they didn't really understand what they were adopting. They just hid it in different ways.

The corporate hid behind process. If we don't understand it, we'll set up a committee, hire a consultant, write a strategy, run a pilot, schedule a review. Each step felt like progress. None of them required anyone to actually understand the technology. You can run a whole AI programme without ever reading what a token is.

The startup hid behind speed. If we don't understand it, we'll just ship and find out. Fail fast. The problem is that AI doesn't fail fast. It fails quietly, three months later, in a support ticket or a privacy complaint or a finance review. By the time the failure shows up, the team is six features deep into something else, and half the product now leans on that first feature.

Look at the third row. One was led by a vendor, the other by hype. Neither was led by a problem. Neither company started from a clear, painful business problem and asked "is AI the right tool for this?" They both started from "we should be doing AI" and worked backwards. That's the real root cause, and it's why both stories ended in the same place: money spent, time spent, no real edge gained.

Why Malaysian SMEs Get Hit Worst

Most Malaysian businesses sit between these two extremes, and they often get the worst of both. They decide as slowly as a corporate (every IT spend goes through the boss, the brother-in-law accountant, and a vendor demo) but they're as green technically as a startup (no in-house engineers, no security reviews, no idea what they're signing). They take six months to pick a tool, then six days to wire it into customer data with no controls at all.

We've sat in meetings where a 30-staff company in Klang Valley spent three months checking out "AI vendors" and then signed a contract for a basic ChatGPT wrapper that any of their staff could have built in an afternoon. We've also seen the opposite: a 12-person team in Penang who pasted their entire customer database into a free AI tool to "see what insights come out," and only realised afterwards that they'd just sent every name, IC number, and transaction record to a US server whose terms allowed it to train on the data.

What Actually Wins

The companies getting real value out of AI right now, and there are some, here and overseas, don't fit neatly into "corporate" or "startup." They do four things together, and all four matter.

The Test Before You Start

If you're about to spend money on AI, whether it's an internal tool, a customer feature, or a vendor contract, answer four questions before the first ringgit goes out. If you can answer all four, you'll probably get value. If you can't answer any of them, you're about to repeat the corporate's eighteen months or the startup's nine days. Both are expensive, just in different ways.

Bottom Line

The corporate is still in committee. The startup is still patching leaks. Neither has the AI edge they wanted, and neither will get it by doing more of the same. The corporate doesn't need another consultant, and the startup doesn't need to ship faster. Both need to do the same uncomfortable thing: slow down enough to think, then move fast enough to build.

AI is not something you buy. You can't sign a contract with the right firm and call it an edge. And it's not a weekend hack either. You can't wire an API into customer data, hope nothing breaks, and call that an edge. It sits in the awkward middle. Too fast for committees to keep up, too deep for weekend hackers to get away with.

The companies that get this right over the next few years won't be the biggest or the loudest. They'll be the ones who stopped long enough to ask "what problem are we actually solving?", picked one, shipped a small honest version of it, and learned something real before going wider. Everything else, the strategy decks, the demo videos, the LinkedIn posts about being "AI-first," is just noise from companies still stuck at one of the two extremes in this story.