# Malaysia Advances AI Governance Bill as New Enterprise Rules Take Shape > Source: > Published: 2026-09-14 12:55:31+00:00 Malaysia’s AI rulebook is moving closer to law. The Digital Ministry has completed the draft of its proposed AI Governance Bill and is preparing it for Cabinet, Digital Minister Gobind Singh Deo said Sept. 10. AI Malaysia followed Sept. 12 by naming the Bill and the Malaysia AI Safety Institute among its immediate priorities. Enterprises developing, adapting or deploying AI in Malaysia could eventually face formal requirements for risk management, human oversight, data governance and incident reporting. Gobind said the legislation could reach Parliament in Q3 2026 or, at the latest, Q1 2027, according to [Bernama’s Sept. 10 report](https://www.bernama.com/en/news.php?id=2605398). The regulatory push coincides with an expanding domestic AI infrastructure market, including [two planned Firmus AI Factory sites](https://www.techrepublic.com/article/news-openai-firmus-data-centers-apac-malaysia/) where OpenAI has reserved future computing capacity. ## **A broad proposal could reach vendors and customers** The legislation is not final. Malaysia’s [July 10 public consultation](https://upc.mpc.gov.my/view-consultation/264) outlined a principle-based, risk-based framework spanning the AI lifecycle, but provisions may change before the Bill reaches Parliament. A central proposal distinguishes between Developers and Deployers. Under [Baker McKenzie’s analysis](https://www.bakermckenzie.com/en/insight/publications/2026/07/malaysia-public-consultation-on-the-ai-governance-bill), a company could qualify as a Developer by training a model, adapting one for a specific use case, integrating it into another system or materially modifying it after deployment. A Deployer determines whether, where and how an AI system is used. One organization could hold both roles, potentially extending obligations to companies that significantly customize third-party models rather than simply use them. The proposal could also cover systems used by Malaysia-based Deployers even when hosted abroad. That would put multinational model, cloud and software providers serving Malaysian operations within potential reach. AI systems would fall into three risk tiers. Systems intentionally developed or deployed to cause harm would be prohibited, while high-risk systems could face risk assessments, documentation, human oversight, monitoring and mitigation requirements. Proposed incident-reporting rules could also cover failures, misuse, unexpected effects and some near misses. ## **Existing laws already shape enterprise AI use** Malaysia does not yet have a dedicated AI law. [AI Malaysia lists existing legislation](https://www.ai.gov.my/faq/ai-governance-policy/) covering privacy, cybersecurity, copyright, communications and online safety that can already apply to AI deployments. IT teams should inventory active AI systems, document how models are selected, customized and monitored, and determine whether proposed Developer or Deployer definitions could apply. Vendor contracts should also address incident notification, audit rights and access to technical information. Those controls are becoming more important as [APAC companies increase AI spending](https://www.techrepublic.com/article/news-apac-ai-spending-roi-proof/) while governments pursue different oversight models. Malaysia has also issued voluntary board-level guidance through is [Boardroom Primer for AI Adoption and Governance](https://www.ai.gov.my/governance/boardroom-primer-to-ai-adoption-and-governance/). Regional fragmentation adds another layer for multinational IT teams. Singapore and Thailand are already [deepening cooperation on AI governance](https://www.techrepublic.com/de/article/news-digital-ties-apac-singapore-thailand/), while Malaysia develops its own national framework. Shared platforms, vendors and data flows may therefore face different governance requirements across Southeast Asian markets. AI Malaysia’s [Sept. 12 update](https://www.bernama.com/en/general/news.php?id=2606395) places the Bill and safety institute within the wider AI Nation 2030 program. The final requirements remain uncertain until the legislation clears Cabinet and Parliament, but enterprises operating in Malaysia now have a concrete regulatory process to prepare for. **Let us teach you** **How to Talk to AI** **for free! Try our six-minute course at The Neuron Academy and learn a few simple ways to write better prompts and get more useful results from AI, or browse our other AI course for free for seven days.** **Check out all the lessons here →**