Back to AI Regulations Review
Draft Bill Since Jul 2026 + AI & PDP Framework to 23 Oct 2026 Malaysia

Malaysia's Draft AI Governance Bill

// Draft Bill + AI & PDP Framework - Voluntary Today, Statutory Tomorrow

Malaysia is sequencing its rulebook deliberately: voluntary guidelines first, national standards second, statute third. The AI Governance Bill in consultation since July 2026 will be Malaysia's first binding AI framework, while the parallel AI & PDP Framework details how Act 709 already applies across the AI lifecycle. Organizations that align during the voluntary window will absorb the transition cheapest.

AIGE Sep 2024NAIO Dec 2024AI & PDP Framework Oct 2026
// Key Highlights

Key Highlights

From AIGE principles to the NAIO bill and the AI & PDP draft Parts A to J, plus the hard law already in force. AI & PDP content may change based on feedback.

  1. 01

    The National Guidelines on AI Governance and Ethics (AIGE), published September 2024, set seven voluntary principles: fairness, transparency, privacy, security and safety, accountability, robustness, and benefit to humanity.

  2. 02

    The National AI Office (NAIO), launched December 2024 under the Ministry of Digital ecosystem, coordinates national strategy, standards harmonization, and a forthcoming high-risk AI register.

  3. 03

    The MY-AI national standards platform launched March 2026 with the Department of Standards Malaysia and SIRIM, consolidating technical and process standards covering risk management, model documentation, bias testing, data governance, and incident reporting.

  4. 04

    The draft AI Governance Bill entered public consultation on July 10, 2026. It proposes a risk-based model covering the entire AI lifecycle - stand-alone, embedded, integrated, or service-based systems alike.

  5. 05

    A second track runs in parallel: JPDP Consultation Paper No. 1/2026 on the AI & PDP Framework under Act 709, open to 23 Oct 2026. Content may change based on feedback, but the draft already details lifecycle controls in Parts A to J.

  6. 06

    The AI & PDP draft does not create a new legal basis for AI. It clarifies how Act 709 applies to in-house, procured, open-source, SaaS/API, cloud, embedded, and general-purpose AI models and systems, including definitions for anonymisation, pseudonymisation, de-identification, and re-identification.

  7. 07

    The bill adds provisions beyond risk tiering: deepfake controls, copyright questions around AI-generated works, and data sovereignty expectations.

  8. 08

    The framework is expected to draw on the EU AI Act's structure tempered by Singapore's Model AI Governance Framework and the ASEAN Guide - risk-tiered obligations without EU-scale penalties at launch.

  9. 09

    Hard law already applies today regardless of the bill: the Cyber Security Act 2024 imposes incident-reporting and audit duties on AI within National Critical Information Infrastructure, and the PDPA Amendment Act 2024 treats biometric data as sensitive and mandates Data Protection Officers for large-scale processing.

  10. 10

    Sectoral regulators moved first: Bank Negara Malaysia's RMiT and the Securities Commission's GTRM already demand rigorous technology-risk governance from financial institutions using AI.

// Governance & Compliance Playbook

Action Items for Governance and Compliance

Eight moves that turn the voluntary phase into an advantage, mapped to the AI & PDP technical section below.

Adopt AIGE principles as internal policy now

A01
Governance

Publish an AI acceptable-use and ethics policy mapped explicitly to the seven AIGE principles, endorsed by leadership.

Compliance

Run self-assessments against MY-AI reference controls so alignment evidence exists before any mandate arrives.

Prepare your inventory for future registration

A02
Governance

Assign one accountable register owner with a documented classification methodology.

Compliance

Design the register schema so it ports cleanly into the national high-risk registry NAIO is expected to operate.

Close sectoral gaps immediately

A03
Governance

Align model governance to BNM RMiT and SC GTRM expectations where you touch Malaysian finance.

Compliance

Meet Cyber Security Act clocks for NCII-classified systems: incident reporting windows and periodic audits.

Harden PDPA alignment for AI use

A04
Governance

Appoint the Data Protection Officer, involve the officer in AI oversight, and define biometric-processing and under-18 approval workflows with necessity tests.

Compliance

Ship AI-specific notices disclosing AI use and decisions, enforce purpose limits with fresh notice and fresh consent on change, and keep withdrawal and breach-notification runbooks that satisfy JPDP enforcement under Act 709.

Gate external AI and cross-border flows

A05
Governance

Run proportionate due diligence on AI service providers covering data reuse for training, sub-processors, and known bias, and collect model and system cards before approval.

Compliance

Put data processing terms in place, assess section 129 transfers with a Transfer Impact Assessment, and retain transfer records for the Commissioner.

Build synthetic-content readiness

A06
Governance

Set a labeling policy for generated media across products and marketing before deepfake provisions take effect.

Compliance

Ship content-marking capability ahead of enactment rather than retrofitting under deadline.

Engage the consultation process

A07
Governance

Submit structured industry feedback through NAIO and JPDP channels while both drafts are still shapeable. Note the AI & PDP draft closes 23 Oct 2026 and content may change based on feedback.

Compliance

Track bill and framework milestones and sandbox opportunities to time governance investment correctly.

Prove the lifecycle with records and audits

A08
Governance

Assign lifecycle owners for testing, monitoring, retraining, and decommissioning decisions, with Data Protection by Design gates and periodic Data Protection Impact Assessments.

Compliance

Keep purpose, legal basis, data sources, assessments, incidents, provider oversight, and audit findings as an evidence pack for the Commissioner, and re-validate after material model or data changes.

// From Rulebook to Build

Engineering Translation

High-level capabilities that make the eventual statutory leap painless.

[REGULATION_BUILD_PLAN] HIGH LEVEL

>_AIGE principles encoded as checklist gates inside delivery workflows instead of policy PDFs.

>_Register designed once, portable to the forthcoming national registry format.

>_Incident connectors aligned to critical-infrastructure reporting timelines and section 12B breach duties.

>_Consent and biometric data flows isolated behind auditable request boundaries with fresh-consent triggers.

>_External LLM and API egress guarded by Data Loss Prevention, encryption, and need-to-know access.

>_Transfer Impact Assessment records and sovereign-hosting options for section 129 cross-border transfers.

>_Retraining and decommissioning gates with secure deletion or anonymisation on retirement.

>_Synthetic-content labeling hooks shipped ahead of the mandate.

Delivered as capabilities, not paperwork

Each obligation above is translated into product-level engineering capabilities. The underlying stack and internal tooling are intentionally abstracted here; they are covered in technical briefings.

Educational summary only. This is not legal advice. Confirm obligations with qualified counsel for your jurisdiction.

Get Malaysia-Ready Before the Bill Becomes Law

Book a technical briefing to align your AI estate with AIGE principles and prepare registration-ready governance records.

Book Technical Briefing
// JPDP Consultation Paper No. 1/2026

AI and Personal Data Protection: What Engineers Must Build For

High-level delta on the AI & PDP draft Parts A to J, with technical requirements in depth. Consultation closes 23 Oct 2026 and content may change based on feedback.

Scope: in-house, procured off-the-shelf, bespoke, open-source, SaaS, cloud, API, embedded, and general-purpose AI models and systems. Key terms: AI system, AI service provider, External AI system, general-purpose AI model and system, anonymisation, de-identification, pseudonymisation, and re-identification.

Part D - ss. 11 to 14

Build, test, and validate

  • Data Protection by Design from design through training, testing, and validation.
  • Training and test data adequate, relevant, and limited. Verify multi-source accuracy. Prefer anonymised or pseudonymised data where identity is not needed.
  • Pre-deployment validation on purpose fit, output reliability, foreseeable conditions, material errors and limits, and safeguard effectiveness.
  • Use only necessary personal data in testing with safeguards. Close material issues before deployment. Re-assess on significant build changes.

Maps to action: Prove the lifecycle with records and audits

Part E - ss. 15 to 19

Deploy, monitor, retrain, retire

  • Deploy only after Part D validation, configured to purpose and legal basis, with integration checks and formal authorisation.
  • Authorised personnel on authorised systems only. Inputs, prompts, and outputs adequate, relevant, and not excessive.
  • Operational monitoring for drift in behaviour, data, or environment. Periodic relevance reviews. Restrict processing until material issues are fixed.
  • Re-validate modified or retrained systems. Plan retention, transfer, anonymisation, or secure disposal at retirement. Do not retain only because the system used the data.

Maps to translation: retraining and decommissioning gates

Part F - ss. 20 to 23

External AI and cross-border

  • Proportionate due diligence on purpose, data categories, dataset and pre-trained model quality, reuse for training or fine-tuning, sub-processors, transfers, provider controls, and known bias.
  • Define controller, processor, or third-party roles. Set processing terms on scope, instructions, protection, incidents, and return or deletion. Collect model and system cards.
  • Section 129 transfers need safeguards plus a Transfer Impact Assessment: host countries, accessors, provider practices across jurisdictions, onward transfers. Keep records and re-assess on material service change.

Maps to action: Gate external AI and cross-border flows

Parts G to H - ss. 24 to 34

Rights, fairness, and security

  • Rights persist in AI flows: access includes retrievable AI-derived data, correction fixes AI-caused errors at source, portability stays secure, and opaque or embedded flows need extra transparency and channels.
  • Test training, testing, and live data for bias across race, gender, religion, age, disability, and related traits. Review outputs, correct material issues, and escalate where outputs significantly affect people.
  • Controls: access, encryption, patching, logging, sensitive-data segregation, and incident response. AI extras: Data Loss Prevention on prompts to external models and APIs, encrypted LLM channels, need-to-know access, protected training and inference, embedded device review, section 12B breach duties, and Data Integrity accuracy checks.

Maps to translation: LLM egress, breach, and accuracy controls

Parts I to J - ss. 35 to 43

Govern, assess, and prove

  • Proportionate governance with clear owners, Data Protection Officer involvement, privacy-preserving defaults, and periodic policy reviews.
  • Risk-based Data Protection Impact Assessments covering data type and volume, purpose, complexity, bias and accuracy risk, misuse and re-identification, decision impact, safeguards, and likelihood and severity. Mitigate before deploy or continue.
  • Plain-language explainability notices. Periodic reviews and audits covering drift, expanded use, transparency, and prior fixes. Keep lifecycle evidence for the Commissioner with continuous provider oversight.

Maps to action: Prove the lifecycle with records and audits

Educational summary of a draft framework for engineering audiences, not legal advice. Confirm obligations with qualified counsel. Draft content may change based on feedback received by 23 Oct 2026.