Malaysia’s proposed AI law should require stronger evidence of safety wherever AI can materially affect a person’s health, livelihood or access to public services. Researchers and businesses should also have a clear, affordable route to develop useful applications. The practical question is how to make these obligations work in everyday decisions. A media report on 30 September highlighted that a draft Artificial Intelligence Governance Bill had been prepared. The Ministry of Digital’s earlier consultation announcement outlined a framework based on risk, with responsibilities reflecting each party’s role and control. Malaysia can build on its National Guidelines on AI Governance and Ethics, launched in 2024, by specifying what organisations must demonstrate before and after deploying consequential systems.
The economic stakes are substantial. According to the Department of Statistics Malaysia, information and communication technology and e-commerce contributed RM451.3 billion, or 23.4 per cent of GDP in 2024. This measures a wider digital economy, rather than AI alone. It nevertheless shows why regulation must be workable for organisations that increasingly depend on digital services. As a researcher working in computer vision and artificial intelligence, I would place evidence of performance at the centre of regulation. A model can achieve an impressive average score while still making serious errors for particular users. A successful laboratory demonstration also leaves unanswered questions about how a system behaves with unfamiliar data or in a different environment.
The first priority should be clear obligations for different levels of risk. AI used to draft a routine email needs lighter requirements than a system influencing medical treatment, recruitment or eligibility for assistance. The European Union’s AI Act offers a useful reference through its risk categories and its provisions for documentation, human oversight and monitoring of high-risk systems. Malaysia can consider adapting these ideas to local institutions and enforcement capacity. For consequential applications, developers and organisations deploying AI should assess foreseeable harms before use. Sector regulators should specify the evidence required, including error rates, security testing and arrangements for human intervention. An organisation using an overseas model should remain answerable for its own deployment decisions, while providers should supply the information needed to evaluate their products. Responsibility must follow what each party can reasonably control.
A second priority is testing that reflects Malaysia. Systems serving the public should be assessed in the languages and conditions in which people actually use them. This includes Bahasa Malaysia and, where relevant, Mandarin, Tamil, regional languages and speech that mixes languages. For computer vision, evaluation should cover relevant differences in users, lighting and equipment. Regulators should require results for relevant user groups where lawful and appropriate, rather than accepting a single headline accuracy figure. For example, a recruitment system might perform well overall while repeatedly misunderstanding one group’s qualifications. Tests should use data obtained lawfully, with privacy safeguards. Substantial changes to the model or its use should trigger reassessment, because an earlier test may no longer describe the deployed system. Singapore provides a practical example: the “AI Verify” framework and open-source toolkit combine technical testing with checks on governance processes. Malaysia could support shared testing facilities involving universities and qualified independent assessors, so that smaller organisations can obtain credible evaluations. Assessors should disclose conflicts of interest. Passing a test should document what was examined and its limitations; it cannot guarantee that a system will never cause harm.
People also need a way to challenge consequential decisions. They should be told when AI materially influences a decision about them, receive an understandable explanation and have access to timely review by a person authorised to correct it. A human reviewer needs enough information and time to question the system; otherwise oversight becomes a formality.
Public agencies should meet these expectations too. Malaysia’s Personal Data Protection Act excludes the Federal and State Governments, making equivalent safeguards for public-sector AI particularly important. Canada’s federal Directive on Automated Decision-Making offers a useful model: it requires publication of algorithmic impact assessments before covered systems enter production, alongside safeguards proportionate to their impact. Malaysia could require public agencies to publish assessment summaries and make suppliers’ testing evidence available to regulators. Access to remedies must also reflect local conditions. Department of Statistics Malaysia (DOSM) reported household internet access of 99.0 per cent in urban areas and 90.7 per cent in rural areas in 2025. This gap supports retaining telephone or in-person routes to obtain help and challenge decisions. Connectivity figures alone do not tell us whether people understand AI or can navigate an online appeal.
Another priority is deceptive use. Polis Diraja Malaysia (PDRM) reported more than RM2.7 billion in losses from online crime between January and November 2025. These figures cover online crime generally; they do not establish how much crime involved AI. They provide context for the need to enforce laws against fraud as tools for generating convincing impersonations become available. Malaysia should require appropriate disclosure for synthetic impersonations and clearly identify AI chatbots, while ensuring victims can report abuse quickly. Labels should supplement verification and enforcement. Compliance costs deserve attention. SME Corporation Malaysia reports that micro, small and medium enterprises accounted for 96.2 per cent of business establishments in 2025. Regulators should offer simple assessment templates, shared testing resources and phased implementation. Obligations should still reflect the potential harm: a small company operating a consequential system should not receive an automatic exemption. Controlled research should face proportionate requirements, with consent, data protection and research ethics maintained wherever people or their data are involved.
Implementation can begin with public procurement. Before purchasing consequential AI, agencies should require evidence of local testing, clear responsibility for failures and a workable appeal process. Sector regulators should coordinate incident reporting through an accessible entry point so organisations and affected users know where to turn. Published summaries of serious incidents and corrective action could help researchers and businesses learn without exposing personal data or sensitive security details. Malaysia should judge its framework by observable results: whether harmful systems are corrected, complaints are resolved, and useful applications can meet requirements at a reasonable cost. Universities can contribute independent evaluation and training for those enforcing the rules. That would give AI governance a firm basis in evidence and make its protections tangible to the people who depend on these systems.
Article by
Assoc Prof Dr Goh Ching Pang
Faculty of Computing and Information Technology
Tunku Abdul Rahman University of Management and Technology
