AI governance Malaysia: the AIGE guidelines, the proposed AI Governance Bill and what companies should set up

Where AI governance in Malaysia stands in October 2026

AI governance means the rules, roles and checks that decide which AI systems an organisation uses, for what, and with what safeguards. In Malaysia there are three layers to know about:

1. Voluntary guidance: the National Guidelines on AI Governance and Ethics (AIGE), published by the Ministry of Science, Technology and Innovation (MOSTI) in September 2024.
2. Existing law that applies to AI the same way it applies to any other technology: personal data protection, consumer protection, employment, cyber security, sector rules from regulators such as Bank Negara Malaysia and the Securities Commission, and criminal law.
3. A proposed AI law: the AI Governance Bill, put to public consultation by the National AI Office in July 2026.

As of October 2026 there is no AI-specific statute in force. The Digital Minister said in September 2026 that the draft was complete and being submitted to Cabinet, with tabling in Parliament hoped for by the first quarter of 2027. Until then, the AIGE guidelines and existing law are the reference points, and they are what a company AI governance setup should be built around now.

The AIGE guidelines and their seven principles

The AIGE guidelines support Malaysia’s National AI Roadmap 2021 to 2025 and are described by the government as a living document that will be updated. They are not legally binding. They name seven principles:

The guidelines address three groups. End users are told about their rights, such as knowing when their data is used, objecting, and reaching a human instead of an AI system. Policymakers in government and organisations are asked to turn the principles into governance frameworks and manage AI risk. Designers, developers, technology providers and suppliers are asked to use diverse and unbiased training data, put responsible-AI terms in contracts, monitor systems continuously and keep documentation.

The AI Rules and Governance lesson walks through these guidelines and the laws that already apply to AI.

The National AI Office and AI Malaysia

The National AI Office (NAIO) was launched on 12 December 2024 as an initiative of the Ministry of Digital and was incubated under MyDIGITAL Corporation. Its role was to coordinate national AI policy, including roadmaps and frameworks.

On 28 July 2026 the government institutionalised NAIO as AI Malaysia Berhad (AIMB), a permanent body under the Ministry of Digital with a wider remit that includes coordinating AI implementation across the public sector and industry. The same day it unveiled the National AI Action Plan 2026 to 2030. Among AIMB’s functions is the Malaysia AI Safety Institute (MY-AISafe), covering AI safety, evaluation, standards and technical assurance. The Digital Minister has also described AI Malaysia as the structure that will support compliance once an AI law is passed.

For companies, the practical point is that there is now a permanent national body for AI policy and standards. Watch its publications alongside MOSTI’s and the sector regulators’.

The proposed AI Governance Bill

On 10 July 2026 the National AI Office released a public consultation paper on a proposed AI Governance Bill, with written feedback due by 31 July 2026. The paper describes a framework, not final text. Based on published summaries of the paper, the proposal includes:

• Three risk tiers. Unacceptable risk (AI developed or deployed with intent to cause harm) would be prohibited. High risk (no intent to harm, but a risk of harm) would need risk assessment, documentation, internal controls, human oversight, monitoring and mitigation. Low risk would carry baseline responsibilities.
• Two regulated roles. Developers shape what a system can do, including those who train, adapt or integrate it. Deployers decide whether, where and how it is used. One organisation can be both.
• Five principles to which developers and deployers would give due regard: human dignity, transparency and explainability, accountability, safety and security, and data governance.
• AI incident reporting by those with control over a system, possibly including near misses.
• A central AI authority, with sector regulators acting as sectoral leads, and an AI sandbox for supervised testing.
• Scope covering systems placed on the market or used in Malaysia, with personal use and national defence and security excluded.

All of this is a proposal and can change before a Bill is tabled. Do not tell staff or clients it is the law. But the direction is clear enough to plan for: know which AI you use, know whether you are developer or deployer, rate the risk, and be ready to report incidents.

Where the PDPA overlaps

Most workplace AI touches personal data: CVs screened by a model, customer chats summarised by an assistant, staff photos used for access control, call recordings transcribed. Wherever personal data is processed in a commercial transaction, the Personal Data Protection Act 2010, as amended by Act A1727, applies whether or not AI is involved. Key overlaps:

• Notice and consent. Tell people their data will be processed by AI tools, and for what purpose.
• Sensitive data. Biometric data such as face or voice recognition is now sensitive personal data and needs a stronger legal basis.
• Processors. An AI vendor processing data for you must meet the Security Principle itself, but you still choose and supervise it.
• Transfers abroad. Many AI services run outside Malaysia, so the cross-border transfer rules apply.
• Breach notification. Personal data leaked through an AI tool is a personal data breach like any other.
• Commissioner guidelines. In April 2026 the Personal Data Protection Commissioner issued guidelines on data protection impact assessments, data protection by design, and automated decision-making and profiling, which are directly relevant to AI systems.

See PDPA amendment 2024 for the detail, and the Data Protection for AI lesson for handling personal data across prompts, documents, memory and outputs.

What a company AI governance setup looks like

Nothing here is mandated by an AI law yet. It is a practical setup that follows the AIGE principles, meets existing PDPA duties, and would put you in a good position if the proposed Bill passes in something like its consulted form.

1. Name an owner. A senior person or committee accountable for AI use, with legal, data protection, IT security, HR and business members.
2. Write an AI usage policy. Approved tools, what must never be entered, labelling of AI output, and human review. Start from the AI usage policy template.
3. Keep an AI register. Every AI system in use or in development, its purpose, owner, data used, vendor, and whether you are its developer, deployer or both.
4. Rate risk before deployment. Ask whether the system makes or shapes decisions about people (hiring, credit, discipline), safety-critical operations, or uses sensitive data. Higher risk means a documented assessment, testing for bias and accuracy, and sign-off.
5. Check vendors. Where data is stored, whether it trains the vendor’s models, security certifications, incident notice terms and exit options.
6. Keep a human in the loop for decisions with significant effects on people, with a way to appeal to a person.
7. Monitor and handle incidents. Watch for drift and errors after go-live, and log AI incidents and near misses with an escalation route.
8. Train people. Staff need the basics of safe use; managers and builders need risk assessment and oversight skills.

The AI Governance, Bias & Accountability lesson takes managers through risk assessment, bias, human oversight, vendor due diligence and AI incidents in short 3D scenes, and Using Generative AI Safely covers the everyday rules for all staff. Both sit in the AI for Everyone topic, which ends with a WorkQuest2U completion certificate. This guide is general information, not legal advice.