AI Governance in Malaysia: A Starter Guide

AI governance is the set of rules, roles and checks that decide how your organisation builds and uses artificial intelligence. Malaysia's National AI Office (NAIO) describes it as the framework of policies, guidelines, standards and regulatory initiatives behind responsible AI. For most companies the practical question is simpler. Who may use which AI tool, and with what data?

AI governance in Malaysia: what exists today

Malaysia's main guidance is voluntary. The Ministry of Science, Technology and Innovation (MOSTI) launched the National Guidelines on AI Governance and Ethics in September 2024. They set out seven principles: fairness; reliability, safety and control; privacy and data security; inclusivity; transparency; accountability; and human benefit.

NAIO also lists a voluntary AI Code of Ethics and a boardroom primer on AI adoption and governance. NAIO says these instruments aim to promote trust, accountability, safety and transparency across sectors. They are a good yardstick for your own policy.

The proposed AI Governance Bill

On 10 July 2026 NAIO issued a public consultation paper on a proposed AI Governance Bill, with feedback due by 31 July 2026. These are proposals, not law, and the final text may change.

The paper proposes a Central AI Authority and five principles: human dignity, transparency and explainability, accountability, safety and security, and data governance. It also proposes three risk tiers, which are unacceptable, high and low, with stronger duties for higher risk.

It would cover developers, who build AI, and deployers, who use it. This includes deployers established in Malaysia. Personal use and national defence systems would be exempt.

The paper also proposes reporting of AI incidents, including near-misses. Check the NAIO website for the latest status before you act.

Five steps to start your AI governance

The steps below are common good practice, not requirements from the guidelines or the Bill. They suit a company that mainly uses ready-made AI tools.

Step 1: list every AI tool in use, including free tools that staff chose themselves. Ask each team what they use. You cannot govern what you cannot see.

Step 2: name one owner. This can be a small group from IT, legal and the business. Someone must approve new tools and answer questions.

Step 3: set data rules. Decide what must never be pasted into a public AI tool, such as customer records or source code. Write the rule in plain words so every member of staff can follow it. Our article on DLP for AI tools covers the leak side, and our PDPA guide covers personal data.

Step 4: add human review where AI affects people's jobs, money or safety. A person should be able to check and overrule the result.

Step 5: plan for incidents. Decide who is told when an AI tool leaks data or gives a harmful result, and keep a simple log of near-misses.

How Primary Guard helps

AI governance is part policy and part security. Not sure where your organisation stands on AI tools and data? Primary Guard offers a free assessment. Contact us to start the conversation.

Frequently asked questions

Is AI governance a legal requirement in Malaysia today?

In the sources we checked, the national guidelines are voluntary and the Bill was still a consultation proposal. Rules can change, so check the National AI Office for the current position.

Does a small company need an AI policy?

If staff use AI tools with company data, a short written policy is a sensible start. One page that covers approved tools, banned data and a named owner is enough to begin.

Is my business a developer or a deployer?

A company that builds its own AI systems is a developer. One that uses ready-made tools is more likely a deployer. The final definitions may change, so read the law once it is published.

Key takeaway

Malaysia's AI guidance is voluntary today, and a binding law is proposed. You do not need to wait for it. List your AI tools, name an owner, set data rules, review high-impact uses and plan for incidents.

Sources

National AI Office, AI Governance page | MyGOV, National Guidelines on AI Governance and Ethics | Rahmat Lim & Partners, NAIO consultation paper (29 Jul 2026)

This article is based on public sources checked on 9 November 2026. The AI Governance Bill is a proposal and may change. It is general information, not legal advice.