Malaysia Proposes Comprehensive AI Governance Act with Risk-Based Regulatory Framework
Summary
- • Malaysia's National AI Office releases public consultation document for a proposed AI Governance Act
- • Three-tier risk classification — unacceptable, high, and low — with proportionate governance obligations for each level
- • A new central AI authority would be established with powers to investigate breaches and enforce compliance
- • Mandatory incident reporting required for AI failures, abuses, and near-misses with full root cause analysis
Details
AI Governance Act proposed
Malaysia's National AI Office (NAIO) releases public consultation document for a national AI regulation law covering the full AI lifecycle
Three-tier risk classification
Unacceptable risk (prohibited), high risk (strict governance), and low risk — each tier carries proportionate obligations; high risk includes harms causing death, injury, or deprivation of fundamental liberty
Central AI authority
Proposed new regulatory body vested with powers to investigate breaches, enforce regulations, and conduct technical fact-finding on AI incidents
Mandatory AI incident reporting
All AI incidents including system failures, abuses, near-misses must be reported with details on nature, foreseeable harm, containment measures, root cause, and remediation actions
Extraterritorial scope
Law covers all entities designing, developing, or using AI in Malaysia regardless of hardware location; personal use and national security are the only exemptions
Rows cover the proposed law's structure, risk classification system, enforcement mechanism, incident reporting requirements, and jurisdictional scope.
What This Means
Malaysia is positioning itself as a regional AI regulation leader with a framework that closely mirrors the EU AI Act's risk-based architecture. As one of Southeast Asia's first comprehensive national AI laws, the proposed Act would create binding obligations for all AI participants operating in Malaysia — including foreign entities. The mandatory incident reporting system and central enforcement authority signal serious regulatory intent beyond a guidance-only approach. While still in public consultation and subject to revision, this legislation marks a significant shift in Southeast Asia's regulatory posture toward AI.