On 10 July 2026, the National AI Office (NAIO) released a Public Consultation Paper for Malaysia’s first AI Governance Bill. While Malaysia previously relied on the AI Governance and Ethics (AIGE) Guidelines as a voluntary framework to encourage the adoption of responsible AI practices, the proposed bill indicates a significant shift towards a legally enforceable regulatory framework.
If enacted, the Bill will introduce legal obligations for organisations that develop or deploy AI Systems (a system that incorporates, applies, or is enabled by AI capability), reflecting Malaysia’s commitment to fostering responsible AI usage while strengthening accountability and public trust. As AI becomes increasingly embedded in business operations, organisations should begin reviewing their governance practices and preparing for a more structured regulatory environment.
We will look at the proposed responsibilities of AI developers and deployers, the core governance principles shaping the Bill, and the practical steps organisations can take to prepare for compliance before the legislation comes into force.
AI Developers vs. Deployers: Understanding Your Compliance Responsibilities
Unlike the voluntary AIGE Guidelines, the proposed AI Governance Bill introduces a governance framework that recognises different actors within the AI lifecycle. Rather than imposing identical obligations on every organisation, the consultation paper proposes that accountability should correspond to the degree of control a party has over an AI system at each stage of its lifecycle.
The Bill defines a Developer as any individual or organisation that materially shapes an AI system’s capabilities, intended functions, performance, limitations, or potential risks. This extends beyond model developers to include organisations that adapt foundation models for specific business use cases, integrate AI into larger systems, or substantially modify existing AI systems after deployment.
In contrast, a Deployer is the individual or organisation that decides whether, where, how, and under what conditions an AI system operates in the real world. Although deployers may not have developed the underlying AI capability, they control how AI is implemented within business operations and therefore influence the risks that arise from its use.
This distinction is important because governance responsibilities should reflect actual control over an AI system. For example, a software vendor that fine-tunes a large language model for customer service may assume responsibilities different from a financial institution deploying that solution to interact with customers.
Another crucial point to consider is that the proposed Bill is intended to regulate AI systems placed on the Malaysian market, developed in the country, or used in Malaysia. It also covers systems used by deployers based in Malaysia, regardless of where the systems are physically hosted. This recognises the increasingly cloud-based and cross-border nature of AI services while ensuring that organisations operating within Malaysia remain accountable for responsible AI use.
Both developers and deployers are expected to actively apply the 5 Core Principles of AI Governance, which will be further discussed in the next section.
The 5 Core Principles of AI Governance
The proposed AI Governance Bill takes a principle-based approach to enable the legislation to remain adaptable as AI technologies continue to evolve while allowing detailed operational requirements to be developed through future government instruments.
These five principles are expected to become the foundation of responsible AI governance across both the public and private sectors.
1. Protecting Human Dignity
The first principle places human beings at the centre of AI governance. AI should support human decision-making, not replace it entirely.
The consultation paper emphasises that meaningful human agency should remain part of important decisions, particularly where AI systems influence an individual’s rights, opportunities, or wellbeing. Organisations should therefore consider where human review remains necessary and ensure that individuals are not reduced to data points within automated decision-making processes.
For businesses, this means evaluating whether employees remain sufficiently empowered to review, override, or intervene when AI-generated outputs may have significant consequences.
2. Transparency and Explainability
Trustworthy AI depends on users understanding when AI is being used and how it influences decisions.
Rather than requiring complete technical disclosure of AI models, the consultation paper proposes transparency and explainability proportionate to the level of risk and context. Organisations responsible for governing AI systems should understand the system’s role, intended purpose, limitations, and potential impact, while affected individuals should receive appropriate awareness and safeguards.
As organisations increasingly deploy generative AI for customer engagement, recruitment, and internal productivity, clear communication regarding AI-assisted decision-making will become increasingly important.
3. Accountability
The Bill reinforces an important principle already reflected across international AI governance frameworks: responsibility always remains with people and organisations, and not with AI systems themselves.
The consultation paper proposes maintaining a clear and traceable chain of accountability supported by governance structures, documentation, monitoring, and corrective mechanisms where necessary.
Rather than treating AI governance solely as an IT issue, organisations should establish cross-functional governance involving legal, compliance, risk, technology, and business leaders to ensure accountability throughout the AI lifecycle.
4. Safety and Security
Responsible AI requires organisations to anticipate risks before harm occurs.
The proposed principle encourages proactive measures to assess foreseeable risks, implement safeguards proportionate to those risks, and ensure AI systems remain robust, resilient, and capable of operating safely under changing conditions.
This aligns with broader international trends encouraging organisations to incorporate AI risk management into existing enterprise governance processes instead of treating AI as a standalone technology initiative.
5. Responsible Data Governance
High-quality AI depends upon high-quality data.
The consultation paper emphasises responsible stewardship of data, including its quality, integrity, provenance, security, and lawful use. Organisations should ensure that datasets remain fit for purpose while complying with applicable laws relating to privacy, intellectual property, and data management.
As generative AI models increasingly rely on large and diverse datasets, effective data governance becomes a critical component of trustworthy AI.
Managing AI Risk: High-Risk Systems, Deepfakes, and Responsible Innovation
Recognising that not every AI application presents the same level of risk, the proposed Bill adopts a risk-based approach.
Instead of applying identical regulatory obligations to every AI system, the consultation paper proposes three broad categories:
- Tier 1: Unacceptable Risk, covering AI systems intentionally developed or deployed to cause harm.
- Tier 2: High Risk, covering AI systems that may create foreseeable risks despite legitimate purposes.
- Tier 3: Low Risk, covering AI systems that do not present foreseeable material AI harm.
Importantly, the consultation paper proposes that governance expectations should increase alongside the level of risk posed by an AI system.
As governance expectations become more stringent for higher-risk AI systems, organisations will need structured processes to identify, assess, and mitigate AI-related risks before deployment. For example, the EU AI Act imposes specific obligations on high-risk AI systems, while ISO/IEC 42001 encourages organisations to establish systematic AI risk management processes as part of their AI management systems. Organisations preparing for Malaysia’s future regulatory environment may therefore benefit from incorporating AI risk assessments into existing governance processes.
One area where this risk-based approach becomes particularly relevant is the growing misuse of deepfakes and synthetic media. While existing legislation already provides legal avenues to prosecute unlawful AI-generated content, the proposed Bill is intended to serve as a preventive layer that addresses risks before harmful content is produced. Rather than regulating the output alone, the Bill seeks to govern the entire AI lifecycle by requiring developers, providers, users, and operators of AI systems to adopt governance measures that are proportionate to the level of risk posed by their systems.
According to Digital Minister Gobind Singh Deo, “AI risks do not only appear at the end when content is produced. They can arise earlier through system design, data selection and use, model training methods, security controls, access controls, human oversight and how the AI system is used in its operational context.” This reflects the philosophy underpinning the proposed AI Governance Bill, which seeks to govern AI throughout its lifecycle rather than focusing solely on harmful outputs. By introducing governance measures that are proportional to the level of risk posed by an AI system, the proposed framework aims to reduce risks at their source while complementing Malaysia’s existing legal framework for addressing unlawful AI-generated content.
While the proposed Bill strengthens governance expectations, it also recognises the need to encourage responsible innovation. Thus, to support this objective, the consultation paper proposes introducing an AI Sandbox. Rather than functioning as a regulatory exemption, the sandbox is intended to provide organisations with a supervised environment to develop, test, and evaluate AI systems before wider deployment. This enables businesses to identify governance gaps, validate safeguards, and improve compliance while supporting innovation.
How AI Governance Training in Malaysia Can Help Your Organisation Prepare
Preparing for compliance extends beyond implementing policies and technical controls. Organisations need people who understand how AI governance principles translate into daily decisions, alongside organisational processes that support responsible AI adoption.
As Malaysia moves towards a more structured regulatory framework, investing in local AI governance training enables organisations to build internal capabilities before compliance becomes mandatory. Business leaders, compliance professionals, legal teams, and technical practitioners all play a role in ensuring AI systems are developed and deployed responsibly.
Straits Interactive supports organisations through a combination of professional training and advisory services tailored to different stages of AI maturity.
- AI Business Professional (AI Ethics & Governance) Course: Equips teams with practical competencies in responsible AI adoption, governance frameworks, ethics, privacy, security, and accountability. It helps professionals generate value with generative AI while conducting proper due diligence.
- Gen AI Capability Development Consultancy: Works directly with organisations to build an AI-ready workforce, establish governance frameworks, identify capability gaps, and create practical roadmaps for safe adoption.
By combining capability development with expert guidance, organisations can embed responsible AI practices into their operations while accelerating innovation with confidence.
Prepare Your Organisation for Malaysia’s AI Governance Framework
Malaysia’s proposed AI Governance Bill marks an important step towards a more coordinated and accountable AI governance ecosystem. Although the legislation is still undergoing public consultation, organisations should not wait for the final Bill before strengthening their governance capabilities.
Understanding the respective responsibilities of developers and deployers, embedding the five AI Governance Principles into organisational processes, adopting risk-based governance practices, and investing in workforce capability will position organisations to respond more effectively as Malaysia’s AI regulatory landscape continues to evolve.
Avoid regulatory bottlenecks before Malaysia’s AI laws go into effect. Contact Straits Interactive to conduct a comprehensive AI capability gap assessment, or enrol your technical leaders in our certified AI Governance courses today.
Learn more about our AI and Generative AI programmes here.
