AI Governance Bill: Malaysia’s Next Step Towards the First AI Rulebook

Malaysia’s National AI Office (“NAIO”) released a public consultation paper for the proposed AI Governance Bill (the “Bill”) on 10 July 2026. The Bill marks a shift from the country’s current reliance on existing laws and voluntary guidelines (most notably the National Guidelines on AI Governance & Ethics (2024)) towards a more specific, risk-based regulatory framework governing the development and deployment of AI across Malaysia.

We set out some key highlights from the Bill below.

Proposed Scope of the Bill

The Bill proposes to regulate the full lifecycle (from early development until the system is withdrawn) of AI systems that are (a) placed on the market or put into service within Malaysia; (b) designed, developed or used in Malaysia; or (c) used by a deployer established in Malaysia, regardless of where the system is physically hosted.

System used for personal use and systems used solely for national defence / security are proposed to be domains exempted from the Bill. This market-based applicability approach is largely similar with the EU AI Act, with potential extraterritorial reach in respect of foreign AI providers / deployers if the AI systems are used within Malaysia.

Principle- and Risk-Based Governance Framework

The Bill’s core approaches to AI governance are institutional oversight, principle-based regulation and a risk-based approach.

The Bill aims to provide flexibility and enable risk-proportionate regulation by establishing five guiding principles based on (i) human dignity, (ii) transparency and explainability, (iii) accountability, (iv) safe and secure use, and (v) data governance and stewardship. It proposes a statutory duty on developers and deployers to have “due regard” for these principles throughout the AI system’s lifecycle.

The Bill proposes that requirements on developers and deployers will be imposed in proportion with the level of risk, type of AI system, context of deployment, and degree of control. The proposed framework ranks AI systems into three risk tiers and imposes requirements accordingly: 

• Tier 1 - Unacceptable risk: developed or deployed with an intent to cause harm – subject to strict prohibition frameworks;
• Tier 2 - High risk: developed or deployed without intention to cause harm but creates a risk of harm – subject to stronger and structured obligations, e.g. risk assessment, documentation, internal controls, human oversight, monitoring and mitigation; and
• Tier 3 - Low risk: do not show foreseeable material AI harm – to be developed and deployed with baseline level responsibility.

Other proposed features include a structured reporting regime for AI incidents, as well as establishment of AI regulatory sandboxes to facilitate innovation.

NAIO proposes a phased implementation approach, whereby voluntary instruments will be issued to guide the implementation of the Bill initially, followed by codified full implementation of the principles at a later stage once the ecosystem reaches maturity.

Institutional Oversight

The Bill also proposes the establishment of a Central AI Authority with three functions: AI safety, investigation and enforcement, and AI enablement. The Central AI Authority may also appoint sectoral leads to leverage existing frameworks and expertise in implementation.

What’s Next 

Broadly speaking, Malaysia’s proposal reflects a wider convergence towards a risk-tiered regulatory approach, as AI-specific laws continue to emerge around the globe. That said, the proposal’s principle-based and “adapt and learn” methodology represents a more flexible legislative regime, rather than a highly prescriptive model. For now, it remains to be seen how the final Bill will shape Malaysia’s first AI-specific legal framework – the Bill is currently at the public consultation stage, with any written feedback, comments, or proposals for the public consultation due on 31 July 2026.