Malaysia AI Governance Framework

The Malaysia AI Governance Framework is the set of national guidelines, principles, standards, and forthcoming legislation that defines responsible development and deployment of artificial intelligence in Malaysia. It is coordinated by the National AI Office (NAIO) under MyDigital Corporation within the Ministry of Digital and developed in consultation with industry, academia, civil society, and ASEAN partners. The framework articulates Malaysia's ambition to become an AI Nation by 2030 while ensuring that AI systems are safe, fair, transparent, and aligned with the public interest.

Origins

Malaysia's interest in AI policy intensified during the Malaysia Digital Economy Blueprint (MyDigital) launched in 2021, which placed AI alongside cloud, data, and cybersecurity as foundational technologies. The Ministry of Science, Technology and Innovation (MOSTI) published the National AI Roadmap (AI-Rmap) for 2021 to 2025, setting initial priorities for talent, governance, and adoption. In 2024 the government established the National AI Office (NAIO) within MyDigital Corporation to act as the central coordinating authority for the country's AI agenda. In the same period, Malaysia published its first national-level AI Governance and Ethics Guidelines (AIGE) in 2024, making it one of the first ASEAN states to issue such a document. The guidelines were structured to address three audiences — users, regulators, and developers — and were built around seven AI principles.

Seven principles

The AIGE framework is built on seven principles that guide subsequent standards and regulation:

Fairness — AI systems should avoid unjust bias against individuals or groups.

Reliability, safety, and human control — Systems should perform as intended and remain under meaningful human oversight.

Privacy and security — AI deployments must respect personal data protection and cybersecurity requirements.

Inclusiveness — AI should be accessible across communities, languages, and abilities.

Transparency — Stakeholders should be able to understand when AI is used and how it operates.

Accountability — Clear responsibility must exist for outcomes produced by AI systems.

Human-centricity — AI should serve human well-being and social goals.

These principles align broadly with the OECD AI Principles, UNESCO Recommendation on the Ethics of AI, and the ASEAN Guide on AI Governance and Ethics, while reflecting Malaysian priorities such as Bahasa Malaysia language support, multi-ethnic inclusion, and Islamic finance compatibility.

MY-AI standards

On 10 March 2026 the government launched the MY-AI standards platform, building on the AIGE principles. MY-AI consolidates technical and process standards covering risk management, model documentation, bias testing, data governance, and incident reporting, and it acts as a single reference point for organisations adopting AI in regulated and unregulated sectors. Standards are developed in collaboration with the Department of Standards Malaysia (JSM) and SIRIM Berhad.

Forthcoming legislation

A complete AI legislative framework is expected to be submitted to the Cabinet in June 2026, following public consultation and inter-ministerial review. The legislation is anticipated to draw on the EU AI Act, Singapore's Model AI Governance Framework, and bilateral commitments under the ASEAN Guide on AI Governance, with risk-tiered obligations and sector-specific provisions. Discussions have referenced obligations such as registration of high-risk systems, conformity assessments, transparency requirements for generative systems, and incident reporting to NAIO. In parallel, the Ministry of Digital is finalising the National AI Technology Action Plan 2026–2030, which succeeds AI-Rmap and sets out investment priorities for sovereign compute, Malay-language foundation models, AI skills, and adoption across high-value sectors.

Sector-specific regulation

The general framework is complemented by sector-specific regulation issued by line regulators: | Regulator | Scope of AI guidance | | --- | --- | | Bank Negara Malaysia (BNM) | Risk Management in Technology (RMiT), model risk management, fairness in credit decisioning | | Securities Commission Malaysia (SC) | Fintech sandbox, robo-advisers, market surveillance AI | | Malaysian Communications and Multimedia Commission (MCMC) | Online content, deepfakes, telecommunications AI | | Ministry of Health Malaysia (MOH) | Medical device software, clinical decision-support AI | | National Cyber Security Agency (NACSA) | Critical National Information Infrastructure (CNII) security, including AI assets | | Department of Personal Data Protection (JPDP) | Personal Data Protection Act 2010 (PDPA) compliance for AI training and inference | | Inland Revenue Board (LHDN) | E-invoicing, AI-assisted compliance | The Personal Data Protection Act 2010 was significantly amended in 2024 and again in 2025 to strengthen data breach notification, cross-border transfer, and processor obligations, with direct implications for AI training data and deployment.

Institutional landscape

Beyond NAIO, several Malaysian institutions play important roles in the framework: the Malaysia Digital Economy Corporation (MDEC), the Malaysian Industry-Government Group for High Technology (MIGHT), the Ministry of Science, Technology and Innovation (MOSTI), CyberSecurity Malaysia, MAMPU, the Human Resource Development Corporation (HRD Corp), and academic institutions such as the AI faculties of Universiti Malaya (UM), Universiti Kebangsaan Malaysia (UKM), Universiti Sains Malaysia (USM), and Multimedia University (MMU). Industry consultation has involved domestic firms and chambers including PIKOM, the Malaysian Tech Entrepreneur Association (MTEA), and the National Tech Association of Malaysia, alongside multinational technology providers operating in Malaysia.

Regional and international alignment

Malaysia chaired ASEAN in 2025, during which the regional grouping advanced the ASEAN Guide on AI Governance and Ethics and explored a cross-border framework for AI risk management. Malaysia is also a participant in UNESCO's AI ethics work, the Global Partnership on AI (GPAI), and bilateral cooperation arrangements with Singapore, Japan, the Republic of Korea, and the United Kingdom on AI safety and standards. These engagements shape how the Malaysia framework references international norms while protecting national interests in sovereignty, data, and language. For organisations operating in Malaysia, compliance with the AI Governance Framework involves multiple touchpoints. Financial institutions follow BNM's RMiT policy and the Securities Commission's fintech guidance when deploying credit, fraud, surveillance, or advisory models. Telecommunications and media companies, including Telekom Malaysia, Maxis, CelcomDigi, Astro, and Media Prima, operate under MCMC content and infrastructure rules and increasingly under MY-AI standards for generative content. Healthcare providers such as KPJ Healthcare, IHH Healthcare, and the Ministry of Health's public-hospital network apply medical-device software guidance from the Medical Device Authority (MDA) for AI used in diagnostics and triage. Critical infrastructure operators including Tenaga Nasional, Petronas, and major airport and port operators sit within NACSA's CNII regime, which has begun to incorporate AI-specific cybersecurity expectations. Penang and Cyberjaya host the bulk of Malaysia's AI talent and startups. Penang-based firms such as AITG Sdn Bhd, alongside Cyberjaya tenants, build products in compliance with PDPA, BNM, SC, and MY-AI standards, and engage with HRD Corp to train Malaysian engineers. SMEs are supported through the Madani Government's digitalisation grants and MDEC's Malaysia Digital initiative.

Outlook

The Malaysian AI Governance Framework is evolving rapidly. Over 2026 to 2027, the most consequential developments are likely to be the passage of dedicated AI legislation, sector-specific implementing rules, and the operational rollout of MY-AI standards across critical sectors. The framework is expected to balance Malaysia's developmental ambitions with safeguards that protect citizens and align Malaysia with global best practice.

1. Ministry of Digital, Malaysia. (2024). National Guidelines on AI Governance and Ethics (AIGE). MyDigital Corporation.
2. National AI Office (NAIO). (2026). MY-AI Standards Platform: Launch Document. MyDigital Corporation.
3. Ministry of Science, Technology and Innovation. (2021). National Artificial Intelligence Roadmap 2021–2025. MOSTI.
4. ASEAN Secretariat. (2024). ASEAN Guide on AI Governance and Ethics. ASEAN.
5. UNESCO. (2021). Recommendation on the Ethics of Artificial Intelligence. UNESCO.