Malaysia — AI Governance and Ethics Guidelines (AIGE) + PDPA 2010: AI Compliance Requirements
Malaysia has no mandatory AI law as of August 2026 (web-verified 2026-08-22; not yet enacted) — its first comprehensive AI Governance Bill, developed by the National AI Office (NAIO)/Ministry of Digital as a risk-based framework covering AI-related harm, incident reporting, ethical principles, and (per the 2026-07-10 consultation paper) deepfake, copyright, and data-sovereignty provisions, moved to a formal public consultation stage on 2026-07-10 (written feedback due 2026-07-31) and is now reported as targeted for completion by end of 2026 — but has not been publicly confirmed as submitted to Cabinet or enacted as of this cycle. However, the Ministry of Science, Technology and Innovation (MOSTI) published the National Guidelines on AI Governance and Ethics (AIGE) in September 2024, and it is prudent for organizations operating in Malaysia to align with its principles. Separately, significant amendments to Malaysia's Personal Data Protection Act (PDPA 2010) took effect in June 2025, updating data protection obligations relevant to AI systems processing personal data of Malaysian residents. Businesses using AI to process Malaysian residents' data must comply with the amended PDPA now.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
September 1, 2024
MYR 1,000,000 under amended PDPA 2010 (eff. June 2025) — AI-specific fines pending future legislation
What Your Business Must Do
2 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Malaysia PDPA 2010 Compliance for AI Data Processing
High PriorityThe amended Malaysia PDPA (effective June 2025) applies to any organization processing personal data of Malaysian residents through AI systems. Update your privacy notices to disclose AI-driven data processing, ensure lawful bases for automated decision-making, implement data breach notification procedures, and appoint a data protection officer if processing large volumes of Malaysian personal data.
Deadline: June 1, 2025
Personal Data Protection (Amendment) Act 2024Malaysia AIGE Voluntary Alignment
Medium PriorityWhile not yet legally binding, the National AI Governance and Ethics Guidelines (AIGE, September 2024) represent the Malaysian government's expectations for responsible AI development and deployment. Aligning now prepares your organization for the mandatory AI Governance Bill (public consultation closed 2026-07-31, targeted for completion by end of 2026 — not yet enacted). Key AIGE principles: human-centered AI, privacy by design, transparency, fairness, accountability, safety, and sustainability. Organizations in regulated sectors (financial services, healthcare, public services) should treat AIGE alignment as a compliance requirement.
Who Does This Apply To?
Applies to any organisation that processes the personal data of Malaysian residents through AI systems under the Personal Data Protection (Amendment) Act 2024, whose provisions were brought into force in phases through June 2025: 'data controller' terminology and biometric data as sensitive data (April 2025), and mandatory data-breach notification, a data-protection-officer requirement, and data-portability rights (June 2025). Practical AI duties now in force: update privacy notices to disclose AI-driven processing, establish a lawful basis for automated decision-making, operate breach-notification procedures, and appoint a DPO where large volumes of Malaysian personal data are processed. Enforced by the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) with penalties up to the amended PDPA statutory maximum (MYR 1,000,000). Malaysia has no mandatory AI statute yet: the National Guidelines on AI Governance and Ethics (AIGE, MOSTI, September 2024) are voluntary, and a first comprehensive AI Governance Bill — NAIO-led and risk-based — was slated for submission to Cabinet by mid-2026 but, as of July 2026, is not publicly confirmed as submitted or enacted (web-verified 2026-07-01) — organisations in regulated sectors (financial services, healthcare, public-sector supply chains) should treat AIGE alignment as a de-facto requirement and prepare for codification.
Recent Regulatory Guidance
MOSTI National AI Governance and Ethics Guidelines (AIGE) — September 2024
MOSTI published the National AI Governance and Ethics Guidelines establishing seven core principles for responsible AI: human-centered AI, privacy by design, transparency, fairness, accountability, safety, and sustainability. While voluntary until the mandatory AI legislation expected in 2026, organizations in regulated sectors (financial services, healthcare, government supply chains) should treat AIGE alignment as a compliance requirement — the guidelines establish the framework that forthcoming mandatory AI legislation will codify.
National AI Office — AI Governance Bill Public Consultation Paper (10 July 2026)
The National AI Office (NAIO) released a formal Public Consultation Paper on 2026-07-10 setting out the key components of the proposed AI Governance Bill — Malaysia's first dedicated, horizontal AI legal framework (rather than sector-specific rules). Public engagement sessions ran through July 2026 with government agencies, industry, and academia; written feedback was due 2026-07-31. The Bill is now reported as targeted for completion by end of 2026 — still NOT enacted, NOT yet submitted-to-Cabinet-confirmed, and NOT yet binding law as of this cycle.
Frequently Asked Questions
Does Malaysia — AI Governance and Ethics Guidelines (AIGE) + PDPA 2010 apply to my business?
Malaysia has no mandatory AI law as of August 2026 (web-verified 2026-08-22; not yet enacted) — its first comprehensive AI Governance Bill, developed by the National AI Office (NAIO)/Ministry of Digital as a risk-based framework covering AI-related… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Malaysia — AI Governance and Ethics Guidelines (AIGE) + PDPA 2010 is: MYR 1,000,000 under amended PDPA 2010 (eff. June 2025) — AI-specific fines pending future legislation. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Malaysia — AI Governance and Ethics Guidelines (AIGE) + PDPA 2010?
The 2 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.mosti.gov.my/en/usains/aige/Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan