Governance moves.
Evidence keeps up.
A practical reading of the Malaysian and international rules shaping AI decisions—translated into what leaders, risk teams and builders need to do next.
From voluntary guidance toward formal accountability.
Updated through 30 September 2026. Each development links to the underlying government announcement or reporting of the Parliamentary statement.
Malaysia publishes its National Guidelines on AI Governance & Ethics
The AIGE guidelines set seven responsible-AI principles and provide a voluntary national reference point for organisations. They sit within Malaysia’s National AI Roadmap and are the natural starting point for a local control framework.
MOSTI — National Guidelines on AI Governance & Ethics ↗The National AI Office becomes Malaysia’s central AI authority
NAIO was launched on 12 December 2024 under the Ministry of Digital. Its role includes coordinating policy, ecosystem development and national AI priorities.
MyDIGITAL — Malaysia launches NAIO ↗DPO and data-breach duties take effect under the amended PDPA
The Personal Data Protection (Amendment) Act 2024 introduced mandatory data-protection officer and breach-notification duties from 1 June 2025. AI programmes handling personal data must connect model governance with privacy operations.
Personal Data Protection Commissioner — Act A1727 ↗Financial-sector expectations continue to mature
Bank Negara Malaysia published an AI discussion paper for the financial sector in August 2025 and revised its Risk Management in Technology policy in November 2025. Firms should treat AI as part of established technology, cyber and operational risk governance.
Bank Negara Malaysia — AI in the Financial Sector ↗Proposed AI law sets out lifecycle accountability
The Government said the AI Governance Bill being drafted would introduce a statutory duty of care for parties developing and implementing AI systems. Responsibility would follow the system’s risk and remain traceable across ownership, operation and control. This was a policy statement—not an enacted law.
Bernama — Dewan Rakyat statement on the draft Bill ↗Malaysia launches MY-AI Standards
The Ministry of Digital introduced MY-AI Standards as practical trust infrastructure for transparent and auditable AI development. The announcement also confirmed that the National AI Action Plan 2026–2030, AI Governance Bill, National AI Code of Ethics and Digital Trust and Data Security Strategy were being developed.
Ministry of Digital — MY-AI Standards ↗Privacy regulator issues automated-decision guidance
Malaysia’s Personal Data Protection Department issued guidance on automated decision-making and profiling, including AI-assisted decisions. It explains expectations around fairness, transparency, human involvement and data-subject rights; it is regulatory guidance rather than a new amendment to the PDPA.
Personal Data Protection Department — ADMP Guideline ↗Dewan Rakyat passes the Cybercrimes Bill 2026
The lower house passed a bill addressing cyber offences including certain deepfakes and non-consensual digitally manipulated intimate imagery. This is adjacent to AI governance, but separate from the proposed AI Governance Bill; the cited report did not establish full enactment and commencement.
Bernama — Dewan Rakyat passage of Cybercrimes Bill ↗Public engagement begins on Malaysia’s first cross-sector AI Bill
The Ministry of Digital and NAIO opened stakeholder engagement on the proposed AI Governance Bill. The planned framework is risk-based and horizontal: it is intended to establish common AI principles across sectors while complementing existing laws and sector regulators.
Ministry of Digital — proposed AI Governance Bill ↗NAIO is institutionalised as AI Malaysia Berhad
The Government established AI Malaysia Berhad as the national body coordinating AI policy and implementation, formally building on NAIO. It also introduced the National AI Action Plan 2026–2030, comprising 14 sector initiatives and 14 supporting initiatives, with trusted governance and a Malaysia AI Safety Institute within the body’s remit.
Ministry of Digital — AI Malaysia and National AI Action Plan ↗Draft AI Governance Bill moves toward Cabinet review
The Digital Minister said stakeholder workshops were complete and the draft was being prepared for Cabinet submission, with Parliamentary tabling targeted for late 2026 or, at the latest, the first quarter of 2027. Until it is passed and brought into force, it remains a proposed Bill—not binding AI legislation.
Bernama — latest status of the draft AI Governance Bill ↗Adoption is moving faster than organisational readiness.
said their workplace had a policy or guidance on generative AI use
reported receiving any form of AI training
of people globally were willing to trust AI systems
One control system, multiple obligations.
ISO/IEC 42001:2023
A certifiable AI management system standard for establishing, implementing and continually improving organisational AI governance.
ISO/IEC 23894:2023
Guidance for integrating AI-specific risk management into organisational processes and decisions.
NIST AI RMF 1.0
A voluntary framework organised around Govern, Map, Measure and Manage for trustworthy and responsible AI risk management.
EU AI Act
A risk-based regulatory regime with phased obligations that can affect Malaysian organisations placing or using AI systems in the EU market.
Singapore Model AI Governance Framework
Singapore’s practical governance framework for organisations deploying AI, paired with AI Verify—a testing toolkit and community of practice for responsible AI.
OWASP GenAI Security
A practical security reference for threats including prompt injection, sensitive-information disclosure and excessive agency.