AI Governance in Malaysia

Key takeaways

• ✓Malaysia has no single AI-specific law yet. Governance currently rests on a patchwork of existing legislation, voluntary frameworks, and sector-level guidance, most notably Bank Negara Malaysia's requirements for financial institutions.

• ✓The National Artificial Intelligence Roadmap (AI-RAMP) and MDEC's AI governance principles set a direction, but compliance obligations remain lighter than in the EU or Singapore. That gap will close.

• ✓The practical risks for Malaysian enterprises, including data misuse, biased automated decisions, and uncontrolled use of generative tools by staff, are real now, regardless of whether a regulator is watching.

• ✓An AI acceptable use policy and clear internal governance structures are the minimum starting point. Most organisations don't have either.

• ✓Training staff to understand AI risks is not just an HR initiative. It is the mechanism by which governance policies actually take effect on the ground.

What does AI governance in Malaysia actually mean?

AI governance is the set of policies, processes, roles and controls that determine how an organisation builds, buys and uses artificial intelligence. For Malaysian enterprises, it means having clear answers to practical questions: Who approved this AI tool? What data is it allowed to touch? Who is accountable when it produces a wrong or harmful output? How do we know it is working as intended?

That framing matters because "AI governance" can sound abstract until something goes wrong. A customer service chatbot gives a legally incorrect answer. A recruitment screening model filters out qualified candidates in ways that correlate with ethnicity. A finance team's AI summarisation tool sends a draft report to an external vendor before anyone reviews it. Each scenario is a governance failure, and each one is preventable with the right structures in place.

Governance is not compliance by another name

Compliance asks whether you are following the rules that exist today. Governance asks whether you have the internal architecture to manage AI responsibly as the rules, tools and risks keep changing. Malaysian enterprises need both, but governance is the foundation.

Malaysia is in an active period of AI policy development. The government published its National Artificial Intelligence Roadmap (AI-RMAP) in 2021, covering the period to 2025, and the Ministry of Science, Technology and Innovation has signalled further regulatory refinement as AI adoption accelerates. At the same time, existing legislation, including the Personal Data Protection Act 2010 (PDPA) and the Communications and Multimedia Act 1998, already creates obligations that AI deployments must satisfy. Enterprises that treat governance as a "future problem" are often already out of step with current law.

There is also a commercial dimension. Regional and global customers, partners and investors increasingly ask enterprises to demonstrate responsible AI practices before signing agreements. For Malaysian companies operating across ASEAN or working with European or Australian counterparts, the governance bar set by external relationships is often higher than domestic regulation requires right now.

The practical starting point is usually internal: an AI acceptable use policy that sets clear boundaries for employees, combined with visibility into what AI tools staff are actually using. Many Malaysian enterprises are surprised to find significant shadow AI activity already running across their business before any formal governance program begins. Governance has to account for the AI that is already in the building, not just the tools that IT has officially approved.

What is Malaysia's current regulatory framework for AI?

Malaysia does not yet have a dedicated AI law. What exists instead is a layered set of existing statutes, sector-specific regulators, and national strategy documents that together shape what responsible AI deployment looks like in practice.

The anchor document is the National Artificial Intelligence Roadmap (AI-RMAP), published by the Ministry of Science, Technology and Innovation (MOSTI) in 2021. AI-RMAP sets out Malaysia's ambitions across five pillars: data, talent, infrastructure, policy and regulation, and adoption. It is a strategy document rather than binding law, but it signals the government's direction and informs how regulators and procurement panels are likely to treat AI governance going forward.

MDEC (Malaysia Digital Economy Corporation) plays a central role in operationalising AI adoption, particularly for companies operating within or connected to the digital economy ecosystem. MDEC has published guidance on responsible AI and runs initiatives to support enterprises building AI capabilities. Again, this is guidance rather than regulation, but it carries weight with public-sector stakeholders and GLCs (government-linked companies).

The laws that apply right now

While a standalone AI act remains under consideration, several existing statutes already catch AI-related risks:

• Personal Data Protection Act 2010 (PDPA): Malaysia's primary privacy law governs the collection, use, and processing of personal data. Any AI system trained on or processing personal data, including customer records, HR data, or transaction histories, falls under PDPA obligations. Amendments that came into effect in 2024 strengthened obligations and introduced mandatory breach notification requirements.

• Financial Services Act 2013 (FSA) and Islamic Financial Services Act 2013 (IFSA): Bank Negara Malaysia (BNM) supervises AI use in financial services. BNM's Risk Management in Technology (RMiT) policy document, updated in 2023, explicitly addresses model risk, algorithmic decision-making, and third-party technology risk. Financial institutions deploying AI in credit decisioning, fraud detection, or customer-facing services need to satisfy BNM that those systems are explainable, auditable, and fair.

• Communications and Multimedia Act 1998 (CMA): The Malaysian Communications and Multimedia Commission (MCMC) has jurisdiction over online platforms and content. AI-generated content, deepfakes, and automated content distribution sit in its oversight remit, even where specific AI provisions are absent.

• Capital Markets and Services Act 2007 (CMSA): The Securities Commission Malaysia has flagged AI use in investment advice, trading, and financial product marketing as an area requiring disclosure and compliance attention.

No single AI law, but real exposure

The absence of a dedicated AI act does not mean Malaysian enterprises are ungoverned. PDPA, sector regulators, and existing liability frameworks already create concrete obligations for companies deploying AI systems at scale.

What is coming

Malaysia's government has signalled an intent to develop more specific AI governance instruments. The Malaysia AI Governance Framework, developed with input from MDEC and industry bodies, provides a voluntary set of principles covering transparency, fairness, accountability, and security. Voluntary today does not mean voluntary indefinitely. Enterprises that treat current guidance as optional are building on foundations that may require expensive retrofitting when binding rules arrive.

For regulated industries, the gap between voluntary and mandatory is already narrow. If you operate in financial services, healthcare, or telecommunications, sector regulators are actively watching how AI is being governed, and examination and audit processes are beginning to include technology risk questions that reach directly into AI systems.

Which risks matter most to Malaysian enterprise leaders?

The risks that keep boards awake in Kuala Lumpur are not dramatically different from those in Singapore or Sydney, but the local context shapes how they land. A multi-language workforce, a mix of listed and GLC employers, strong cross-border trade relationships, and a regulatory environment still finding its feet all mean that some risks are amplified here in ways that generic global frameworks miss.

Data leakage through generalist AI tools

Staff across Malaysian enterprises are already using consumer-grade AI tools at work, often without IT or legal knowing about it. When an employee pastes a client contract into ChatGPT free tier, or uses a consumer image tool to process HR data, that content can be used to train external models. Under Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how organisations collect, process, and store personal data, that exposure carries compliance risk. The shadow AI problem is not hypothetical. Audits of enterprise browser activity consistently find tool usage that IT has never approved.

The practical response is an acceptable use policy that tells staff precisely which tools are sanctioned, what data categories can go into them, and what the consequences are for stepping outside it. Policy alone is not sufficient; staff need to understand the reasoning, not just the rules.

Biased or unreliable outputs in high-stakes decisions

AI models trained predominantly on English-language data perform unevenly in Bahasa Malaysia, Mandarin, and Tamil. That matters when the output informs a credit decision, a recruitment shortlist, or a customer complaint resolution. Errors in those contexts carry reputational and regulatory exposure, and in some cases discriminatory outcomes that HR and compliance teams are only beginning to audit.

Malaysian boards should ask their teams a direct question: for every high-stakes decision workflow where AI contributes, is there a human review step, and does the person reviewing it have enough AI literacy to catch a confident but wrong output?

Fraud and social engineering at enterprise scale

Voice cloning, deepfake video, and AI-generated phishing have moved from proof-of-concept to active threat. Malaysian businesses with cross-border operations, particularly those with suppliers or investors in China, are exposed to business email compromise variants that now incorporate synthetic voice calls impersonating executives. Financial services firms face additional pressure, as AI-enabled fraud in that sector is evolving faster than most internal controls were designed to handle.

Governance here is less about policy documents and more about operational protocols: verification procedures for high-value transactions, training for finance and operations staff on what these attacks look like, and a culture where it is normal to pause and check.

Concentration risk and vendor dependency

Many Malaysian enterprises are building their AI capability on a small number of large platforms. That is entirely rational in the short term. But it creates exposure when a vendor changes its pricing, deprecates a model, or suffers a significant outage. It also raises questions about data residency. When enterprise data is processed through a hyperscaler's model endpoint, knowing exactly where that processing occurs and under which jurisdiction's rules it falls is a governance question, not just a technical one.

A question worth raising in your next risk review

Ask your technology team: if our primary AI vendor changed its data processing terms tomorrow, would we know within 24 hours? Would we know what data had been exposed and to whom? If the answer is uncertain, that is a governance gap.

Accountability gaps when AI contributes to a decision

Who is responsible when an AI-assisted decision causes harm? In Malaysia, regulators and courts have not yet fully answered that question. But the absence of a clear legal answer does not protect an organisation from reputational or commercial consequences. The four AI risks every board should be asking about all trace back to the same underlying issue: AI introduces a new decision-making actor into the organisation, and most governance structures were not designed with that actor in mind.

Practically, this means every AI use case in production should have a named owner, documented assumptions about what the model does and does not do, and a clear escalation path when something goes wrong.

How do you build an AI governance framework in practice?

A governance framework does not need to be a 60-page policy document that nobody reads. The working version is a small set of decisions, written down and owned by named people, that your teams can actually follow.

Start with four building blocks.

1. Assign ownership before you write policy. Governance without an owner becomes a document that gets reviewed once and forgotten. Appoint an AI governance lead, whether that sits in legal, risk, IT, or a cross-functional committee depends on your structure. What matters is that someone is accountable when a question surfaces: "Are we allowed to do this with AI?"

2. Tier your AI use cases by risk. Not every AI application carries the same exposure. A tool that drafts internal meeting notes sits in a different category from one that scores credit applications or screens job candidates. A simple three-tier model works well in practice.

This tiering approach aligns with the spirit of Malaysia's AI Governance and Ethics Guidelines, which calls for proportionate oversight based on the level of risk an AI system presents.

3. Write an acceptable use policy your team can reference in five minutes. The policy needs to answer three questions plainly: what tools are approved, what data can be put into them, and who approves exceptions. If your staff have to interpret ambiguous language under time pressure, they will default to their own judgement, which is precisely the gap governance is meant to close. A well-structured AI acceptable use policy template gives you a practical starting point that you can adapt for your organisation's risk profile and regulatory context.

4. Build in human oversight at the right points. Human oversight does not mean a human approves every AI output. It means identifying the moments where a machine error would cause real harm, and placing a human checkpoint there. For a Tier 1 use case, that might be nothing more formal than "the person who prompted it reads it before sending." For a Tier 3 use case, it means a documented review by a qualified person who is empowered to reject the AI recommendation.

The gap most enterprises miss

Policy and tools are not enough on their own. Governance breaks down when staff do not understand why the rules exist. Training that explains the reasoning behind an acceptable use policy produces measurably better compliance than training that only lists what is permitted.

One practical step many Malaysian enterprises overlook: audit what AI tools your teams are already using before you finalise policy. If shadow AI is already embedded in daily workflows, a policy written without that knowledge will have gaps from day one. An assessment of your current AI tool landscape often surfaces tools the IT team was unaware of, particularly in functions like marketing, finance, and HR.

Governance frameworks are not static. Build in a review cadence, quarterly for the first year while the landscape is moving quickly, and annually thereafter. The MCMC and MDEC guidance will continue to develop as Malaysia's AI regulatory posture matures, and your internal framework needs to move with it.

How does Malaysia's approach compare to global standards?

Malaysia's AI governance posture sits somewhere between Singapore's pragmatic, guidance-led model and the EU's binding, risk-tiered regulation. Neither is a perfect fit for what Malaysian enterprises face, but both offer useful reference points.

The EU AI Act, which began phased enforcement in 2024, classifies AI systems by risk level and imposes mandatory conformity assessments, documentation requirements, and prohibitions on certain high-risk applications. It applies extraterritorially: if your AI system touches EU data subjects or markets, the Act's obligations follow. For Malaysian multinationals with European operations or clients, this is not a distant concern.

Singapore's Model AI Governance Framework takes a softer approach. It is voluntary, principle-based, and designed to give organisations a practical structure without prescriptive rules. The framework covers accountability, human oversight, transparency, and operations. Malaysia's own National AI Governance and Ethics Framework draws heavily from this model, sharing its emphasis on principles over mandates.

The honest comparison

Malaysia's framework is closer to Singapore than to the EU: principle-based, non-binding, and focused on encouraging responsible practice rather than enforcing it. That flexibility is useful now. But organisations building for growth, especially those handling cross-border data or operating in regulated sectors, should design governance that can meet stricter future requirements without a full rebuild.

The practical implication is directional. Malaysian enterprises that anchor governance to EU-aligned concepts (risk classification, documented impact assessments, human oversight of consequential decisions) will be well-positioned if domestic regulation tightens or if expansion into EU markets becomes a business priority. Those that treat governance as a tickbox against current local guidance may face a heavier retrofit later.

One area where Malaysia leads regionally is financial services AI oversight. Bank Negara Malaysia's frameworks for responsible AI in financial institutions are among the more detailed in Southeast Asia, and they draw on global standards including the Financial Stability Board's work on AI in finance. For banks, insurers, and fintech firms operating in Malaysia, this is the layer of regulation with the most immediate teeth.

What role does AI training play in governance?

A governance framework without workforce capability is a document, not a defence. Policies define what is acceptable; training is what makes those policies real when a procurement manager is drafting a supplier brief in Copilot, or a data analyst is feeding customer records into a third-party AI tool without thinking twice.

Malaysian enterprises are discovering this gap quickly. Governance rollouts tend to focus on committees, documentation, and technology controls. The human layer gets less attention, and that is usually where breaches, misuse, and reputational damage actually originate.

Policy without practice is a governance gap

Most AI incidents inside enterprises are not caused by rogue systems. They are caused by well-intentioned employees who did not know what they were not supposed to do. Training closes that gap.

There are three distinct capability needs inside any organisation serious about AI governance.

Leaders and board members need enough AI literacy to ask the right questions of their teams, assess risk proportionately, and hold vendors accountable. They do not need to build models; they need to understand what the four board-level AI risks actually look like in practice.

Compliance, legal, and risk teams need working knowledge of Malaysia's regulatory environment, including the PDPA, the AI Governance and Ethics Guidelines, and sector frameworks from BNM and the SC. They also need to understand how AI tools handle data at a practical level, not just in vendor contracts.

Operational staff need role-specific guidance. A finance team approving payments needs to know when AI-generated output requires human verification. An HR team shortlisting candidates needs to understand bias risk and what a defensible process looks like. Generic AI awareness sessions rarely cover these specifics with enough precision to change behaviour.

This is where AI training for Malaysian enterprise teams becomes a governance tool, not just a capability investment. When training is designed around your specific tools, your policies, and your regulatory obligations, it converts abstract governance requirements into daily practice.

The connection runs in both directions. Training surfaces governance gaps that documentation alone does not reveal. Workshops that ask staff to work through realistic scenarios, say, using an AI assistant to draft client communications, or querying a dataset with a third-party tool, consistently produce questions that expose missing policy. That feedback loop is genuinely useful, particularly during the early stages of a governance program.

One practical consideration: training should be timed to coincide with governance milestone moments, not scheduled separately as an HR initiative. When a new AI acceptable use policy is published, that is exactly the right moment to run a session that walks teams through what it means in their workflows. The same applies when a new tool is deployed, when a regulatory update lands, or when an incident occurs elsewhere in your industry and you want to get ahead of the same risk.

If your organisation is building an AI acceptable use policy or trying to understand what tools your staff are already using without approval, those efforts will only stick if the people expected to follow the policy understand why it exists and what it asks of them specifically.

Turning governance policy into team behaviour?

We work with Malaysian enterprises to design training that maps directly to your governance framework, your tools, and your regulatory context. A 30-minute call is enough to scope what that looks like for your team.

Book a discovery call →

Frequently asked questions

Is AI regulation in Malaysia legally binding right now?

No binding AI-specific legislation exists in Malaysia as of 2026. The current framework is voluntary: the AI Governance and Ethics Guidelines published by MDEC set out principles and expectations, but non-compliance does not carry a direct legal penalty. That said, existing laws, including the Personal Data Protection Act 2010 and the Communications and Multimedia Act 1998, do apply to AI systems that process personal data or publish content. Enterprises that treat governance as optional because there is no AI law yet are misreading the risk. Mandatory obligations can arrive quickly, and organisations with no framework in place will have far less time to adapt.

Does Malaysia's PDPA apply to AI systems?

Yes, the Personal Data Protection Act applies wherever an AI system collects, processes, or stores personal data about Malaysian residents. This includes model inputs, outputs logged for quality assurance, and training datasets derived from customer records. The PDPA is currently under review, and proposed amendments are expected to tighten consent requirements and introduce stricter data transfer rules. Any enterprise running AI tools that touch personal data, which is most of them, should map those data flows against current PDPA obligations and monitor the amendment process closely.

What is the minimum viable AI governance framework for a mid-sized Malaysian enterprise?

A practical starting point has four components: an AI acceptable use policy that defines what tools employees may use and for which purposes; a data handling protocol covering what can and cannot be entered into AI systems; a process for identifying and reviewing high-risk use cases before deployment; and a designated person or small committee accountable for AI risk. That is not a complete enterprise governance program, but it is enough to prevent the most common and costly mistakes, and it gives you a foundation to build on as regulation matures.

How do Malaysian AI governance expectations compare to those in Singapore or the EU?

Malaysia's current approach is more permissive than Singapore's and considerably more permissive than the EU AI Act. Singapore's Model AI Governance Framework is more detailed and has shaped how many multinationals operating across the region structure their internal policies. The EU AI Act, which affects any organisation selling into or operating in the EU, introduces mandatory risk classifications and prohibited use cases. Malaysian enterprises with regional or global exposure often find it practical to benchmark against Singapore's framework as a near-term standard, while monitoring EU requirements if they have European operations or customers.

Where does AI training fit into a governance program?

Policy documents only govern behaviour if employees understand them. Training is the mechanism that connects a written framework to day-to-day decisions, covering topics like recognising high-risk use cases, handling data correctly when using AI tools, spotting shadow AI behaviour, and knowing when to escalate. Governance without training produces a policy that sits in a shared drive and changes nothing. For Malaysian enterprises building out their programs, AI training should be treated as a core governance activity, not an add-on once the framework is drafted.

Ready to close the gap between AI policy and practice?

Most Malaysian enterprises have made some kind of start on AI governance. They have an acceptable use policy, or a data classification guide, or a list of approved tools. What they tend to lack is the connective tissue: staff who understand why the rules exist, managers who can spot when a workflow has quietly drifted outside them, and leaders who can brief the board without reaching for someone else's slide deck.

Training is where policy becomes behaviour. It is also one of the more controllable variables in a governance program, which matters when the regulatory environment is still moving.

Better People works with enterprise teams across the region to build that capability, through workshops, custom programs, and practical AI readiness work grounded in real organisational context. If you are working through what AI governance should look like for your organisation, our AI training programs in Malaysia are a reasonable place to start the conversation.

Turning your AI governance policy into everyday practice?

In a 30-minute call we can map where your team's current capability sits against what your governance framework actually requires, and work out whether training, a workshop, or something more structured makes sense for your situation.

Book a discovery call →