Establishing AI Governance

Strategy 1 split cleanly in two. The structural half — the AI-CIU and its committee architecture — never materialised. The normative half — the seven principles — survived, was re-expressed, and became Malaysia's actual governance output. Understanding that split is the key to the whole roadmap, because everything downstream depended on the coordinating body that initiative 1.1 was supposed to create.

1.1–1.2: the coordinating body that never formed

The AI-CIU was never established as the roadmap described — not as an apex unit under MOSTI, not with its six committees and twenty expert groups, and not in any form the public record can identify. A plan whose coordinating body never materialises does not get coordinated, and much of what reads as under-delivery elsewhere in the roadmap traces back here. We treat this in detail in the governance body that never formed.

1.3–1.5: partial, and routed elsewhere

The cybersecurity-policy ambition (1.3) overlapped with separate national cybersecurity strategy work rather than a roadmap-owned AI cyber programme; the “100% of ministries” target has no public verification trail. The data-sharing initiative (1.5) is the one with a concrete legacy: it points directly at what became the rebuilt data.gov.my / OpenDOSM open-data platform — delivered, but by the Department of Statistics and later the Ministry of Digital, not by an AI-CIU data-sharing committee.

1.4: the principles endured — and were renewed

This is Strategy 1's clearest success. The seven principles were effectively superseded and operationalised by the National Guidelines on AI Governance & Ethics (AIGE), launched by MOSTI on 20 September 2024 — voluntary, principle-based, and closely echoing the roadmap's original seven.^[1] The normative spine of Strategy 1 outlived its institutional skeleton.

The coordinating role Strategy 1 designed for the AI-CIU was eventually filled — but by a different body, under a different ministry, three years later. The National AI Office (NAIO) was launched on 12 December 2024 under the Ministry of Digital (established December 2023), incubated for its first year by MyDIGITAL Corporation. NAIO is the functional successor to the AI-CIU, and the shift from MOSTI to the Ministry of Digital is the institutional story behind it — see from MOSTI to the Ministry of Digital and NAIO vs the AI-CIU.

On principles, the AIGE guidelines now anchor responsible-AI expectations, and the successor AI Technology Action Plan 2026–2030 carries the agenda forward. The seven principles, in other words, found a permanent home; the coordinating unit took a detour through a new ministry.

Strategy 1 is the load-bearing wall of the roadmap. Its partial collapse — structure gone, principles preserved — explains the pattern visible across every sector review on this site: the ideas were largely sound and many were eventually realised, but they were realised by whoever happened to own the problem, not by the single coordinating body the roadmap built itself around. Governance-by-coincidence, rather than governance-by-design.

For 2026–2030, the open question is whether NAIO becomes the durable apex the AI-CIU never was — with real authority, standing staff and a measurement function — or whether it, too, ends up coordinating in name while delivery stays distributed. Compare with the targets scorecard for how Strategy 1's specific KPIs fared.