Malaysia - AI Governance Guidelines

Overview

The National Guidelines on AI Governance & Ethics (AIGE) were published by the Ministry of Science, Technology and Innovation (MOSTI) and launched on 20 September 2024 as Malaysia’s foundational, voluntary guidance on responsible AI. AIGE defines seven core principles and delivers targeted guidance for three stakeholder groups (end users, policymakers and developers) to implement responsible, human-centred AI while supporting the National AI Roadmap (AI‑RMAP 2021–2025). The Guidelines are positioned as a non‑binding national reference that aligns Malaysia with international instruments and regional practice; see the official MOSTI publication MOSTI – AIGE flipbook and the Malaysia National AI Office overview NAIO – Governance.

Definitions

AIGE defines key concepts for consistent application across stakeholders, including "AI system" (software or systems that use statistical, probabilistic or machine‑learning methods to produce recommendations, predictions or decisions), "developer/provider" (entities that design, build or supply AI tools), "deployer/operational user" (organisations that implement AI into products or services), "end user" (individuals interacting with AI products), "human‑in‑the‑loop" and other human oversight modalities, and "high‑risk application" (systems whose failure or misuse could materially affect safety, rights, or economic outcomes). These definitions are pragmatic and risk‑focused to support sectoral adaptation and interoperability with existing Malaysian law and international definitions.

Governance and Institutional Framework

AIGE sets out a multi‑layered governance architecture that leverages MOSTI as the coordinating authority while promoting cross‑agency collaboration. The Guidelines recommend establishing or strengthening internal AI governance bodies within organisations (e.g., AI ethics committees, risk committees, compliance officers) and coordination between national authorities through the National AI Office (NAIO) incubated under MyDIGITAL. The approach balances central coordination with sectoral regulator roles: financial, health, telecommunications and critical infrastructure regulators are encouraged to adopt sector‑specific rules that build on AIGE. For the public sector, AIGE advocates embedding responsible AI checks into procurement and policy design processes and using central repositories for model registration and impact assessments; see the NAIO institutional pages NAIO – About and MOSTI materials MOSTI – AIGE flipbook for official context.

Key Focus Areas

AIGE concentrates on seven principle‑based areas: fairness (mitigating bias and disparate impacts), reliability/safety/control (robustness, testing and fail‑safes), privacy/security (data governance, secure model training and protection against misuse), inclusiveness (accessibility and non‑discrimination), transparency (disclosure of AI use, explainability and documentation), accountability (clear assignment of roles, audit trails and incident reporting), and pursuit of human benefit and happiness (human‑centred design and ethical alignment). The Guidelines detail operational practices: pre‑deployment risk assessments, dataset provenance checks, validation/testing regimes, continuous monitoring, user communication and redress pathways. AIGE emphasises special attention to high‑impact domains such as healthcare, finance, public services and critical infrastructure where harms can be acute, and it supports sector regulators developing mandatory rules for those domains.

Implementation Framework

AIGE recommends a staged implementation model: (1) awareness and capability building across the public and private sectors; (2) governance setup (policies, roles, committees); (3) risk categorisation and impact assessment for AI systems; (4) technical and organisational controls (testing, security, privacy by design); (5) documentation, transparency and recordkeeping (model cards, datasheets, logs); and (6) monitoring, incident management and remediation. The Guidelines encourage organisations to adopt international standards where available and to document conformity efforts to facilitate procurement and cross‑border interoperability. MOSTI signals that AIGE will inform future sectoral guidance and procurement rules, and organisations are urged to consider AIGE compliance as part of best practice for contract terms and third‑party risk management.

Monitoring and Evaluation

AIGE calls for continuous monitoring and periodic evaluation of AI systems and national governance arrangements. Monitoring mechanisms include automated performance and fairness metrics, human oversight checkpoints, red‑flag incident reporting, and centralised reporting to coordinating agencies when public harm is suspected. Evaluation occurs via post‑deployment audits, third‑party reviews and periodic public reporting of uptake and impact. The Guidelines recommend that NAIO and sectoral regulators compile national statistics on AI adoption, incidents, and compliance trends to drive iterative policy updates.

Penalties, Liability, and Appeals

As a voluntary instrument, AIGE does not itself create new criminal or administrative penalties; rather, it clarifies how existing liability regimes and sectoral laws (for instance, data protection and cybersecurity statutes) apply to AI practices and signals that future mandatory measures may follow for high‑risk uses. The Guidelines recommend that organisations implement internal remediation and appeals mechanisms for affected individuals and that policymakers consider formal enforcement routes (administrative fines, suspension from procurement lists, civil liability) where non‑compliance to sectoral mandatory rules causes harm.

Relationship to Other Instruments

AIGE explicitly situates itself alongside Malaysia’s National AI Roadmap (AI‑RMAP 2021–2025) and existing legal instruments such as the Personal Data Protection Act (PDPA) and the national cybersecurity framework. It also complements sectoral regulatory initiatives (e.g., finance, health, telecommunications) and existing national digital strategies (MyDIGITAL). The Guidelines reference international soft‑law instruments — OECD AI Principles, UNESCO Recommendation on the Ethics of AI, and ASEAN AI guidance — to promote interoperability and provide a bridge to future bilateral or multilateral regulatory alignment.

International Alignment

AIGE was drafted to align Malaysia with multinational norms and to reduce friction for cross‑border AI services. The Guidelines reference OECD and UNESCO principles and encourage adoption of internationally accepted technical standards and testing regimes. They also highlight the need to monitor extraterritorial rules (for example the EU AI Act) that may affect Malaysian providers operating internationally, and they promote participation in regional ASEAN coordination efforts to harmonise principles and facilitate trade in AI services.

Implementation Timeline

Sources and References