Malaysia governs AI today through guidelines, not law — but that is changing. This page tracks the governance framework as it stands: the voluntary AIGE guidelines built on seven principles, the supporting laws already in force, and the risk-based AI bill expected to give the principles teeth.
It is the regulatory companion to the Action Plan and the institutional story of NAIO.
The AIGE guidelines (2024)
On 20 September 2024, MOSTI launched the National Guidelines on AI Governance & Ethics (AIGE) under the theme “AI for Malaysia, AI for All.” The AIGE is structured for three audiences — end users, policymakers, and developers/providers — and is built on the same seven Responsible-AI principles the roadmap introduced: fairness; reliability, safety & human control; privacy & security; inclusiveness; transparency; accountability; and the pursuit of human benefit. It is inspired by UNESCO, OECD and EU frameworks, and Malaysia was among the first in ASEAN to publish national-level AI guidelines.
The crucial limitation: AIGE is voluntary. It urges best practice but creates no binding obligations and no penalties.
The laws already in force around AI
The coming AI law
The clear direction of travel is from voluntary guidance toward binding, risk-based regulation. The Ministry of Digital, through NAIO, is developing an AI governance framework that takes a risk-based approach to AI harm, incident reporting and ethical principles; a complete AI legislative framework is expected to reach Cabinet in 2026. Officials have been candid that the voluntary AIGE was only ever a first step, that generative AI is straining voluntary guidance, and that it will take time for guidelines to mature into law.
For now, Malaysia sits in a familiar transitional posture: principles published, enabling laws in place, and the substantive AI statute still ahead. We track each step as it lands.
Based on the public record: the AIGE launch (20 Sep 2024, MOSTI), its seven principles and three-audience structure; the Cybersecurity Act 2024; PDPA amendments (2025); the Data Sharing Bill; and statements that a risk-based AI legislative framework is expected at Cabinet in 2026.
This is not legal advice. Full sources: airmap.my/sources. Independent of MOSTI, the Ministry of Digital and NAIO.