Commentary: Malaysia’s proposed AI law could make businesses accountable for the AI they use
BUDGET 2027 introduced more incentives for Malaysians and businesses to adopt artificial intelligence (AI), but as the government encourages wider use of the technology, it is also preparing legislation that could hold organisations accountable for how they use it.
Malaysia’s proposed AI Governance Bill, expected to be tabled in Parliament early next year, is not just about companies developing AI models.
It could also affect businesses using AI for recruitment, loan approvals, healthcare and other everyday decisions.
The question is whether these organisations are prepared for the responsibilities that may follow.
People hear “AI law” and picture the companies building the models, but that is not who this is really about.
Think of every work process that involves AI, from hiring to loan approvals, patient triage or customer screening.
If your organisation decides where and how an AI system is used, it could have responsibilities under the proposed law, even if someone else developed the technology.
The legislation is closer than it looks.
On Sept 10, Digital Minister Gobind Singh Deo said the draft AI Governance Bill had been completed and was being submitted to the Cabinet.
On Oct 29, he told the Dewan Rakyat that it was expected to be tabled in early 2027.
Until now, Malaysia has relied on voluntary AI governance guidelines alongside existing laws governing areas such as personal data protection and cybersecurity.
So who does this actually catch?
The proposed framework goes beyond companies developing AI
Frequently asked questions (FAQ)
What is Malaysia's proposed AI Governance Bill?
Malaysia’s proposed AI Governance Bill is intended to create a national framework for the responsible development, deployment and use of AI. The proposed approach is risk-based, with responsibilities depending on an organisation’s role, level of control over the AI system and the potential harm it could cause. (Source from: UPC)
Will Malaysia's AI Governance Bill apply only to companies that develop AI?
No. The proposed framework can also apply to organisations that deploy or use AI systems in their own operations. A company using third-party AI for areas such as recruitment, lending, healthcare, fraud detection or customer screening may still have governance responsibilities even if it did not build the underlying model. The Edge Malaysia
What AI governance requirements should Malaysian businesses prepare for?
While the final legislation has not yet been tabled, businesses should prepare for areas such as AI risk assessment, documentation, human oversight, monitoring, incident management and clear accountability. Higher-risk AI applications are expected to face stronger requirements than lower-risk uses.
What types of AI systems could be considered high risk?
AI systems that can significantly affect people may receive greater scrutiny. Examples can include AI used in credit decisions, hiring, healthcare, fraud detection, customer screening and other areas where an incorrect decision could create financial, legal or personal harm. The precise classifications will depend on the final Bill.
How can companies prepare for Malaysia's AI law now?
Companies can start by creating an inventory of the AI systems they use, identifying who owns each system and what decisions it influences. They should also review whether those systems provide audit trails, how performance and risks are monitored, where human review is required and how AI-related incidents would be investigated and managed.
Is Malaysia's AI Governance Bill already law?
No. As of November 2026, Malaysia does not yet have a dedicated AI law in force. The draft AI Governance Bill has been completed, and the government has indicated that it is expected to be tabled in Parliament in early 2027. Until then, Malaysia continues to rely on existing legislation and voluntary frameworks such as the National Guidelines on AI Governance and Ethics.
