BUDGET 2027 introduced more incentives for Malaysians and businesses to adopt artificial intelligence (AI), but as the government encourages wider use of the technology, it is also preparing legislation that could hold organisations accountable for how they use it.
Malaysia's proposed AI Governance Bill, expected to be tabled in Parliament early next year, is not just about companies developing AI models.
It could also affect businesses using AI for recruitment, loan approvals, healthcare and other everyday decisions.
The question is whether these organisations are prepared for the responsibilities that may follow.
People hear "AI law" and picture the companies building the models, but that is not who this is really about.
Think of every work process that involves AI, from hiring to loan approvals, patient triage or customer screening.
If your organisation decides where and how an AI system is used, it could have responsibilities under the proposed law, even if someone else developed the technology.
The legislation is closer than it looks.
On Sept 10, Digital Minister Gobind Singh Deo said the draft AI Governance Bill had been completed and was being submitted to the Cabinet.
On Oct 29, he told the Dewan Rakyat that it was expected to be tabled in early 2027.
Until now, Malaysia has relied on voluntary AI governance guidelines alongside existing laws governing areas such as personal data protection and cybersecurity.
So who does this actually catch?
The proposed framework goes beyond companies developing AI models to include those deploying the technology.
This means a Malaysian company using an AI tool developed overseas could still have responsibilities under the proposed law.
Simply relying on a third-party vendor may not be enough to avoid accountability.
The extent of those responsibilities will depend on the organisation's role, its control over the system and the risks involved, while the precise scope and exemptions will become clearer when the bill is tabled.
Meanwhile, the push to adopt AI keeps accelerating.
Budget 2027, tabled on Oct 9, extended individual lifestyle tax relief to AI software subscriptions, allocated RM30 million to help 4,000 micro, small and medium enterprises (MSMEs) adopt AI and automation, and outlined plans for a sovereign AI cloud.
The prime minister said Malaysia must lead on AI without compromising its values or national security.
The more AI the country adopts, the more organisations could find themselves subject to new governance requirements.
Is Malaysia just copying others?
South Korea's AI Basic Act came into effect in January 2026, introducing binding requirements for AI governance.
Singapore has taken a different approach through frameworks such as the Model AI Governance Framework and AI Verify, which encourage companies to adopt responsible practices without imposing the same broad statutory obligations.
Malaysia's proposed framework is principle-based, but the shift from voluntary guidelines to legislation could mean that practices companies previously chose to adopt become legal obligations they must demonstrate they have met.
What does this change, in plain terms?
The proposed framework takes a risk-based approach, with three broad categories based on the potential harm an AI system could cause.
Systems intentionally developed or deployed to cause harm would fall into the unacceptable-risk category and be prohibited.
Higher-risk systems, which could cause harm even without that intention, would face stricter requirements for risk assessment, documentation, human oversight and ongoing monitoring.
Lower-risk systems would face lighter obligations, although responsible use would remain important.
The framework also envisages mechanisms for reporting and managing AI-related incidents.
For businesses, the question is no longer simply whether an AI system works, but whether they can identify its risks, explain how it is used and take responsibility when something goes wrong.
Which category a system falls into has nothing to do with how impressive the AI is. It is about what happens to a real person if it gets something wrong.
Most companies I speak with have not actually sat down and answered that question yet.
For banks, hospitals and mid-sized firms, the challenge is already here AI is increasingly being used in daily workflows, from credit scoring and fraud detection to patient triage, and now in the form of AI agents that can act rather than simply advise.
The gaps in governance are already apparent, even in highly regulated industries.
A 2026 report by the Asian Institute of Chartered Bankers and Ecosystm found that only 33% of surveyed Malaysian banks and development financial institutions had established structured AI governance and model risk management, while just 27% applied formal AI risk tiering.
This matters when a customer asks why a loan application was rejected or a card payment was blocked as suspicious.
Bank Negara Malaysia has also been examining AI governance in the financial sector, including the need for explainability and appropriate oversight.
The proposed bill could add another layer of legal responsibility, with accountability determined by an organisation's role, its control over the technology and the risks involved.
If the only explanation a company can offer is "the system decided", it may struggle to demonstrate that it has exercised meaningful oversight.
What should a company do now?
Start by listing every AI system the organisation uses, including tools that individual departments may have signed up for without central approval.
Identify which systems influence decisions affecting customers, employees or patients, and assess the potential consequences if they produce inaccurate or harmful results.
Not every AI tool can explain why a decision came out as it did, and some produce answers without a clear record of how they were generated.
Before signing with a vendor, ask whether the system produces an audit trail, how its performance is monitored and whether a human can meaningfully review or override its decisions.
Anything involving credit, fraud detection, customer screening, healthcare or other high-stakes decisions needs an accountable person who understands how the technology is used, rather than someone who simply points to a vendor's marketing materials.
Companies should also document what happens when an AI system fails and how incidents are investigated and addressed.
These are practical steps organisations can take now, even before the final requirements of the bill are known.
The work should start before the law arrives
Preparing AI systems for greater scrutiny will take time, particularly where decisions cannot easily be traced or explained.
Waiting until the legislation is passed could leave organisations scrambling to identify systems they have already deployed, assess their risks and establish appropriate safeguards.
The proposed law does not create the risks associated with automated decisions. Those risks already exist wherever AI influences people's access to jobs, financing, healthcare and essential services.
What it could change is who must answer when those decisions go wrong.
Kew Yoke Ling is executive director of KewMann, an AI company focused on regulated sectors including the public sector, finance and healthcare.