Malaysia to introduce AI law holding firms accountable for automated decisions

From guidelines to legal mandates

Malaysia is moving toward a formal legal framework for artificial intelligence. Until now, the country has relied on voluntary guidelines alongside existing laws for cybersecurity and personal data protection. The proposed AI Governance Bill marks a shift toward binding requirements for how organizations manage these technologies.

Digital Minister Gobind Singh Deo announced that the draft bill has been submitted to the Cabinet. It is expected to be tabled in Parliament in early 2027. This legislation aims to ensure that the country leads in AI adoption without compromising national security or core values.

The new law will specifically target the deployment of AI in everyday business processes. While many people assume AI laws only affect the companies building the models, this bill focuses on the entities using them. If a company chooses to use an AI system for hiring or loan approvals, it may be held responsible for the outcomes.

A risk-based approach to oversight

The proposed framework is designed around a risk-based model. This means the level of regulation will depend on the potential harm an AI system could cause to real people. The government plans to categorize systems into three broad groups based on their level of risk.

Systems that are intentionally designed or deployed to cause harm will fall into an unacceptable-risk category and be prohibited entirely. Higher-risk systems, which could cause harm even without intent, will face strict requirements for documentation, human oversight, and ongoing monitoring. Lower-risk systems will face lighter obligations but will still be expected to follow responsible use principles.

This structure means that the complexity of the AI technology is less important than the consequences of its mistakes. The primary concern for regulators is what happens to a person if a system produces an inaccurate or harmful result. Organizations will need to be able to identify these risks and explain how their specific systems function.

Impact on regulated industries

The bill will have a significant impact on sectors like banking, healthcare, and customer screening. These industries already use AI for credit scoring, fraud detection, and patient triage. Under the new law, these companies may need to demonstrate meaningful oversight rather than simply relying on a vendor's marketing materials.

Current data suggests that many organizations are not yet prepared for this level of scrutiny. A 2026 study from the Asian Institute of Chartered Bankers and Ecosystm revealed that only 27% of surveyed Malaysian financial institutions applied formal AI risk tiering. This gap highlights a need for structured governance before the law takes effect.

The legislation clarifies that using a third-party tool developed overseas does not exempt a Malaysian company from responsibility. If an organization controls the system and it influences decisions affecting customers or employees, that organization is the one that must answer when things go wrong. The bill will define the specific scope and exemptions as it moves through Parliament.

Preparing for accountability

Businesses can begin preparing for these requirements by auditing their current software use. This includes identifying every AI system used across all departments, including any tools that specific teams may have purchased without central permission. Companies should prioritize systems that influence high-stakes decisions like credit or healthcare.

When evaluating new vendors, organizations should ask for specific technical details. They need to know if a system produces an audit trail, how its performance is monitored, and if a human can meaningfully override its decisions. Some AI tools may produce answers without a clear record of how they were generated, which could pose a compliance risk.

The goal is to move away from the excuse that "the system decided" as a valid defense. Companies should document what happens when an AI system fails and establish clear procedures for investigating incidents. Taking these steps now can help organizations avoid a scramble for compliance once the legislation is officially passed.

The broader economic context

The government is simultaneously pushing for faster AI integration through financial incentives. Budget 2027 included lifestyle tax relief for AI software subscriptions and provided RM30 million in funding to support 4,000 small and medium-sized businesses in adopting automation. These measures aim to boost productivity across the economy.

Malaysia's approach sits between different regional models. South Korea's AI Basic Act, which began in early 2026, introduced binding requirements similar to the proposed Malaysian bill. In contrast, Singapore has used frameworks like AI Verify to encourage responsible practices without imposing broad statutory obligations.

The transition from voluntary to mandatory rules means that practices companies previously chose to adopt may soon become legal requirements. As the country moves toward a sovereign AI cloud, the legal landscape will continue to evolve. Organizations must balance the benefits of rapid adoption with the growing necessity of transparent and accountable AI governance.

Next steps for businesses

The most immediate task for companies is to map out their current AI footprint. This involves identifying which tools are making decisions that affect people's access to jobs, financing, or essential services. Identifying these high-risk areas early allows for more deliberate risk assessment.

Organizations should also look for "explainability" in their tools. This is the ability of a system to provide a clear reason for a specific output. If a bank cannot explain why a loan was rejected, they may struggle to meet the oversight requirements of the upcoming bill.

As the draft AI Governance Bill moves toward Parliament, the specific rules for reporting and managing incidents will become clearer. For now, the focus remains on establishing a culture of accountability. Companies that can demonstrate they have identified risks and established human oversight will be better positioned to navigate the new regulatory environment.

Actionable steps

Start by listing every AI system your organization uses, including tools that individual departments may have signed up for without central approval. Identify which systems influence decisions affecting customers, employees, or patients, and assess the potential consequences if they produce inaccurate or harmful results.

Malaysia's proposed AI law could make businesses accountable for the AI they...