AI regulation in Malaysia (2026)

Minister Gobind Singh Deo publicly confirmed that Malaysia's first dedicated AI Governance Bill—covering deepfakes, copyright, data sovereignty, and risk-based harm classification—was in active drafting under NAIO, with Cabinet submission targeted for June 2026. The announcement marked the formal transition from voluntary guidelines toward binding AI law.

Passed by Parliament in December 2024 and gazetted in May 2025, the Online Safety Act came into effect on 1 January 2026, imposing content-moderation obligations on digital platforms over AI-generated harmful material including deepfakes, and empowering MCMC to mandate takedowns and levy compound penalties on non-compliant platforms.

The Ministry of Digital announced that Malaysia's first AI Governance Bill was nearly finalised, adopting a risk-based regulatory model with formal harm-assessment tiers, mandatory incident reporting, and sector-wide ethical deployment requirements developed through NAIO.

PM Anwar Ibrahim officially launched NAIO on 12 December 2024, establishing Malaysia's central AI authority under the Ministry of Digital with a RM 10 million Budget 2025 allocation; NAIO's seven 2025 deliverables include an AI Code of Ethics, a national AI register, and the AI Technology Action Plan 2026–2030.

Passed by both houses of Parliament in July 2024 and enacted in October 2024, the amendments to the PDPA 2010 (Act A1727) introduced mandatory data-breach notification, mandatory Data Protection Officers, data portability rights, and explicit coverage of biometric data—directly tightening the legal environment for AI systems processing personal data.

MOSTI launched AIGE, Malaysia's first national AI ethics framework, built on seven principles—fairness, safety, privacy, inclusiveness, transparency, accountability, and human benefit—structured in separate guidance tracks for developers, regulators, and end-users; the guidelines are voluntary but designate Malaysia among the first ASEAN states with comprehensive AI ethics guidance.

The Malaysian Cabinet formally approved creation of NAIO on 28 August 2024, to be incubated within MyDIGITAL Corporation under the Ministry of Digital, signalling a policy shift from ad hoc AI governance toward a permanent, dedicated institutional authority.

Gazetted on 26 June 2024 and brought into force on 26 August 2024, the Cybersecurity Act created the first dedicated legal regime for regulating National Critical Information Infrastructure and licensed cybersecurity service providers, establishing a foundational layer for securing AI-driven critical systems.

The World Economic Forum and the Malaysian Government jointly launched C4IR Malaysia on 15 May 2023—the first WEF C4IR in the Asia-Pacific—to co-design governance frameworks and accelerate applied AI and emerging-technology projects across green transition, digital transformation, and regulatory domains.

MOSTI formally adopted Malaysia's first dedicated AI strategy on 1 December 2021, spanning six pillars—governance, R&D, digital infrastructure, talent, adoption, and innovation—and setting quantitative targets to grow AI's share of GDP; it became the direct policy basis for the AIGE guidelines and NAIO established in 2024.

Launched on 1 July 2021, the National 4IR Policy identified AI as one of five core foundational technologies and established the National Digital Economy and 4IR Council as the cross-ministerial governance body, embedding AI investment and oversight into Malaysia's whole-of-government planning architecture.

Unveiled on 19 February 2021, MyDIGITAL is Malaysia's master roadmap to become a high-income digital nation by 2030 across six strategic thrusts and three phases; it positioned AI as a cross-cutting economic enabler and triggered the cascade of AI-specific policies—4IR Policy, AI Roadmap, AIGE, NAIO—that followed over the next five years.