Malaysia is drafting its first dedicated law on artificial intelligence. The Ministry of Digital says the proposed AI Governance Bill will set common rules for AI across all sectors, take a risk-based approach and place duties on the companies that build and deploy AI systems. In a 28 July 2026 release, the ministry said work on the bill is expected to be completed by the end of this year.
The bill is the legal part of a wider build-out. On the same day, Prime Minister Anwar Ibrahim launched AI Malaysia Berhad, a national AI body under the ministry that will take over and formalise the National AI Office (NAIO), set up in December 2024. The government also announced the National AI Action Plan 2026 to 2030 and a Malaysia AI Safety Institute.
"This Bill will become Malaysia's first horizontal legal framework specifically dedicated to AI governance. It will provide a set of common principles that complement existing laws, thereby supporting a holistic AI ecosystem across various sectors," by the Ministry of Digital
What the bill is designed to do
According to the ministry's 10 July 2026 release, the underlying premise is that systemic risks can emerge at any point across an AI system’s lifecycle, rather than merely at the point of output. Statutory duties will reflect this reality: obligations are to be apportioned between model developers and downstream deployers, calibrated to each party's level of technical control. The ministry also emphasised ex-ante risk mitigation, identifying regulatory sandboxes and mandatory incident reporting frameworks as primary preventive safeguards.
Crucially, the proposed legislation will not regulate AI-generated outputs directly. The release highlighted remarks by Digital Minister Gobind Singh Deo to Parliament on 24 June 2026, confirming that unlawful content remains governed under existing statutory and regulatory regimes.
A separate answer by the minister to a parliamentary question from Kluang MP Wong Shu Qi, which he posted on 22 June, sets out how the two fit together. The government is adopting a twin-track regulatory strategy. Rather than creating duplicate criminal offences, existing statutory frameworks will be deployed to prosecute the misuse of AI-generated content, leaving the forthcoming AI Governance Bill to focus on structural prevention and lifecycle accountability. The proposed legislation introduces mandatory standards across data governance, transparency, risk assessments, and the respective liabilities of developers and deployers, aiming to neutralise risks such as deepfakes and synthetic manipulation before models achieve wide market deployment.
The ministerial response cited three enacted statutes already governing harmful synthetic outputs: the Sexual Offences Against Children Act 2017, the Communications and Multimedia Act 1998, and the Online Safety Act 2025. These will operate alongside the Cyber Crime Bill 2026, scheduled to be tabled during the same parliamentary sitting.
Consultation closed, drafting under way
NAIO held engagement sessions on the proposed bill with government agencies, industry, businesses, academia and the public through July 2026. A public consultation ran on the government's Unified Public Consultation portal from 10 July to 1 August 2026. The portal now lists it as closed, at the pre-drafting stage.
"To strengthen this foundation, the AI Governance Bill is currently being drafted as the primary legal instrument utilising a risk-based approach," by the Ministry of Digital
The ministry has not yet published a draft text or a date for tabling the bill in Parliament.
Who will run AI governance?
AI Malaysia Berhad is the institution expected to carry out the governance work. Its mandate includes trusted AI governance, which covers developing governance frameworks, codes of ethics, standards and trust mechanisms, and coordinating AI-related policy. It will also act as the Malaysia AI Safety Institute. The institute's role includes safety evaluations, testing, and AI red teaming, as well as standards, risk management, and compliance assurance.
The ministry named the first AI Malaysia board on 11 September 2026 with Aireen Omar as chairperson. The directors are the ministry's Secretary-General Datuk Fabian Bigar, Deputy Secretary-General (Digital Development) Ma Sivanesan a/l Marimuthu, EPF Chief Digital Technology Officer Muhammad Afhzal bin Abdul Rahman, and Foo Yen Ling Adelene, chairperson of Trendcell. The ministry said more appointments will follow.
What firms in Malaysia should do now?
Banks, insurers, fintechs and other firms using AI in Malaysia should treat the bill as a lifecycle obligation, not a content rule. A practical first step is an inventory of AI systems that records whether the firm is the developer or the deployer of each one, how much control it has, and what risk assessment, data governance and transparency controls are already in place. Incident reporting and testing records are also worth building now, since the ministry has flagged both. Firms already working to MAS's proposed AI risk management guidelines in Singapore, or to the EU AI Act, will find the same building blocks. Compliance teams that follow Malaysian consumer finance rules can also see our coverage of the Consumer Credit Act 2025.
