I. INTRODUCTION
A prominent artificial intelligence researcher and UC Berkeley professor, Stuart Russell warns: “The most urgent problem today is not to limit the development of AI or even to ensure it’s aligned with human values. It’s to ensure we have a plan to ensure it does what we want”. [1]
On the global stage, the European Union (EU) leads the charge as the architect of the world’s first comprehensive AI regulation: Regulation (EU) 2024/1689, commonly known as the (“EU AI Act”), which entered into force on 12.07.2024.[2] It’s a landmark move that aims on setting out how AI should be developed, deployed and governed across different risk levels.
In Malaysia, Digital Minister Gobind Singh Deo announced in November 2025 that drafting work on Malaysia’s first dedicated AI Governance Bill is nearly complete, with a broader AI legislative framework expected to be tabled before the Cabinet by June 2026. The Bill, developed through the National Artificial Intelligence Office (“NAIO”)[3], is designed to be a comprehensive governance framework for the AI era. It is expected to address key issues such as AI-related harms, mandatory incident reporting, ethical standards and clear accountability obligations for both developers and deployers of AI systems.[4]
In essence, Malaysia is not just observing the AI revolution from the sidelines, it is actively building the rulebook as it goes.
II. THE EU AI ACT: A RISK-BASED FRAMEWORK
The EU AI Act adopts a tiered, risk-based regulatory approach, classifying AI systems into four categories:-
(i) unacceptable risk (prohibited);
(ii) high risk (strictly regulated);
(iii) limited risk (subject to transparency obligations); and
(iv) minimal risk (largely unregulated).[5]
These prohibitions—among the first provisions to take effect in February 2025, six months after the Act entered into force, reflect the EU’s strong emphasis on human dignity and the protection of fundamental rights.[6] [7]
III. MALAYSIA’S AI GOVERNANCE BILL: ANTICIPATED FEATURES
Drawing on the EU AI Act model and public statements from Malaysia’s leadership, several key features are expected to shape the upcoming Malaysian AI Governance Bill.
A. Risk Classification Framework
Prime Minister Anwar Ibrahim has indicated that the Bill will introduce an AI Risk and Classification Framework, a structured, risk-based approach designed to ensure that AI deployment aligns with ethical and governance standards. This closely mirrors the EU’s tiered regulatory model.[8] Given Malaysia’s position as ASEAN’s emerging data centre hub – projected to host two-thirds of regional capacity by 2035 – the classification framework will be particularly significant for the technology and financial services sectors.[9]
B. Harm Assessment and Incident Reporting
The Bill is expected to introduce formal incident reporting obligations and harm assessment requirements. KPMG Malaysia, in its April 2026 analysis, observes that these provisions effectively shift expectations from periodic review to real-time visibility of AI system behaviour and risk.[10] This approach echoes the EU AI Act’s requirement for post-market monitoring systems and serious incident reporting obligations applicable to high-risk AI providers.
C. Developer and Deployer Accountability
A key feature of the proposed Bill is its dual accountability structure. Prime Minister Anwar has emphasised that responsibility will extend not only to AI developers, but also to deployers of AI systems.[11] This reflects a similar distinction under the EU AI Act, which differentiates between providers (those who develop and place AI systems on the market) and deployers (those who use them in practice).[12]
D. Intellectual Property and Copyright Protection
Malaysia’s approach is distinctive in its explicit integration of intellectual property considerations into AI governance. Prime Minister Anwar has confirmed that the Bill will address copyright issues across the entire AI lifecycle—from data training and model development to deployment and output generation.[13] The Intellectual Property Corporation of Malaysia (MyIPO) is expected to play a central role in safeguarding both training inputs and AI-generated outputs. This signals a broader and more integrated regulatory ambition compared to the EU AI Act, which largely leaves intellectual property matters to existing copyright regimes.[14]
E. Deepfakes and Disinformation
The Bill is also expected to address the growing risks associated with deepfakes and AI-generated disinformation. This is not merely a theoretical concern: Malaysia recorded 67,735 online crime cases between January and November 2025, with total losses exceeding RM2.7 billion.[15] In response, CyberSecurity Malaysia is already collaborating with Universiti Kebangsaan Malaysia on the development of AI-powered image and video authentication tools.[16] The forthcoming legislation is therefore expected to introduce disclosure or labelling requirements for synthetic content, broadly similar to the transparency obligations under the EU AI Act.
IV. CONVERGENCE AND DISTINCTIONS: THE MALAYSIA-EU COMPARISON
Malaysia’s proposed AI Governance Bill is expected to adopt the EU’s risk-based regulatory approach while tailoring it to local priorities. Unlike the EU AI Act, which primarily focuses on fundamental rights and market regulation, Malaysia’s framework is likely to emphasise ethical AI governance, digital sovereignty and national development objectives.
The Bill may also incorporate unique local considerations, including potential Shariah-compliance principles, reflecting Malaysia’s distinct regulatory landscape.
Importantly, the Bill is not expected to replace existing legislation. Instead, it will complement laws such as the Personal Data Protection Act 2010, the Computer Crimes Act 1997, the Communications and Multimedia Act 1998, and the Penal Code. A key challenge will be ensuring regulatory coherence and effective coordination among the various authorities overseeing AI-related activities.
V. CONCLUSION
Malaysia now stands at a defining moment in its AI governance trajectory. The forthcoming AI Governance Bill marks a clear transition from voluntary guidance to binding legal obligations, mirroring the regulatory evolution already seen in the EU.
As the world’s first comprehensive AI regulation, the EU AI Act provides a valuable reference point for anticipating the structure and substance of Malaysia’s own framework, particularly in areas such as risk classification, harm prevention, accountability, transparency, and enforcement.
For legal practitioners, businesses, and policymakers, the message is clear: this is no longer a distant policy conversation. It is an emerging regulatory reality. The real question is not whether AI regulation is coming—but how ready stakeholders will be when it arrives.
Published Date: 25 June 2026
Authors:
- Izlyn Qistina Anuar
- Lynnette Wong
References:
[1] https://mastic.mosti.gov.my/publication/the-national-guidelines-on-ai-governance-ethics/
[2] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689.
https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
[3] Gobind Singh Deo (Digital Minister, Malaysia), Statement on AI Governance Bill (24 November 2025), reported in Lexology, ‘Malaysia to Introduce Comprehensive Legal Framework for Artificial Intelligence’ (3 December 2025) https://www.lexology.com/library/detail.aspx?g=f904fcd5-3a6a-420b-bfc3-c4d45b29e97c.
[4] National Artificial Intelligence Office (NAIO), About NAIO https://ai.gov.my/about-naio/
[5] GDPR Local, ‘AI Risk Classification: Guide to EU AI Act Risk Categories’ (3 November 2025) https://gdprlocal.com/ai-risk-classification/
[6] European Commission, ‘Guidelines on Prohibited AI Practices under Article 5 of the AI Act’ (4 February 2025).
[7] Paul Hastings LLP, ‘European Commission & AI: Guidelines on Prohibited Practices’ (3 April 2025) https://www.paulhastings.com/insights/client-alerts/european-commission-and-ai-guidelines-on-prohibited-practices
[8] Anwar Ibrahim (Prime Minister, Malaysia), Parliamentary reply (24 February 2026), reported in Malay Mail, ‘Malaysia’s AI Governance Bill Still Taking Shape’ (24 February 2026) <https://www.malaymail.com/news/malaysia/2026/02/24/malaysias-ai-governance-bill-still-taking-shape>.
[9] US Department of Commerce, International Trade Administration, ‘Malaysia AI Governance Framework’ (Market Intelligence) <https://www.trade.gov/market-intelligence/malaysia-ai-governance-framework>.
[10] KPMG Malaysia, ‘From Capacity to Capability: Malaysia’s AI Governance Imperative’ (30 April 2026) <https://kpmg.com/my/en/insights/2026/04/from-capacity-to-capability-my-ai-governance-imperative.html>.
[11] Anwar Ibrahim (Prime Minister, Malaysia), Parliamentary reply (24 February 2026), reported in Marketing Interactive, ‘Malaysia’s AI Governance Bill to Reportedly Focus on Ethics, Accountability and IP’ (27 February 2026) <https://www.marketing-interactive.com/malaysias-ai-governance-bill-to-reportedly-focus-on-ethics-accountability-and-ip>.
[12] GDPR Local, ‘AI Risk Classification: Guide to EU AI Act Risk Categories’ (3 November 2025) <https://gdprlocal.com/ai-risk-classification/>.
[13] 15. National Artificial Intelligence Office (NAIO), About NAIO <https://ai.gov.my/about-naio/>.
[14] Malay Mail, ‘National AI Action Plan 2026-2030 to be Tabled in December, Says Gobind’ (6 October 2025) <https://www.malaymail.com/news/malaysia/2025/10/06/national-ai-action-plan-2026-2030-to-be-tabled-in-december-says-gobind>.
[15] New Straits Times, ‘Malaysia’s AI Framework Must be Clear and Practical’ (23 December 2025) <https://www.nst.com.my/opinion/letters/2025/12/1343073/malaysias-ai-framework-must-be-clear-and-practical>.
[16] Ministry of Digital Malaysia / National Artificial Intelligence Office (NAIO), MY-AI Standards Platform, launched 10 March 2026 <https://www.aistandards.my>.
