Malaysia — AI Law & Policy Updates

Malaysia has not enacted an AI-specific statute, with the words 'artificial intelligence', 'kecerdasan buatan', and 'algoritma' absent from roughly 700 principal Acts, according to the Attorney General's Chambers. Instead, AI deployments are bound by existing laws including the Personal Data Protection Act 2010 (Act 709, amended 2024), the Cyber Security Act 2024 (Act 854), the Online Safety Act 2025 (Act 866), and the Communications and Multimedia Act 1998 (Act 588). The National AI Office (established December 2024) and MOSTI's National Guidelines on AI Governance & Ethics (2024) are voluntary policy measures, not legal obligations.

Act 709 — Personal Data Protection Act 2010 amended by Act A1727, the Personal Data Protection Amendment Act 2024 · Act 866 — Online Safety Act 2025 · Act 854 — Cyber Security Act 2024 · Act 588 — Communications and Multimedia Act 1998 · National Guidelines on AI Governance & Ethics MOSTI, 2024 — voluntary — Status: No AI-specific law — data-protection, cyber-security and online-safety law bind Malaysia has not enacted an AI statute, and that is a measurement over the whole register rather than a summary: the Attorney General’s Chambers publishes the complete Laws of Malaysia series as its own PDF export, and the words “artificial intelligence”, “kecerdasan buatan” and “algoritma” appear nowhere across roughly 700 principal Acts — nor anywhere in the separate Amendment Acts series. Malaysia established a National AI Office in December 2024 and MOSTI published National Guidelines on AI Governance & Ethics in 2024, both of which are policy and neither of which creates an obligation. What binds a business deploying AI in Malaysia is the digital stack that does exist: the Personal Data Protection Act 2010 Act 709 , whose seven Personal Data Protection Principles — General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access — govern any personal data used to train or run a system, and which was significantly amended in 2024; the Cyber Security Act 2024 Act 854 , which imposes duties on entities running National Critical Information Infrastructure; the Online Safety Act 2025 Act 866 , which regulates harmful online content and applies to platform providers; the Communications and Multimedia Act 1998 Act 588 , under which the MCMC licenses and regulates network and content services; and the Computer Crimes Act 1997 Act 563 .