Malaysia's First AI Law Is Coming. Here's What's Actually in It
For years, Malaysia governed artificial intelligence the way most countries did before they had to, with guidelines nobody could be fined for ignoring. The National Guidelines on AI Governance and Ethics, published by Malaysia's Ministry of Science, Technology and Innovation back in September 2024, told developers and deployers what "responsible AI" should look like. It just never made anyone legally responsible for anything.
Malaysia is now attempting to change that. On 10 July 2026, the National AI Office (NAIO), operating under the Ministry of Digital, released a Public Consultation Paper for what would become Malaysia's first horizontal AI statute: a single law covering AI across every sector, rather than a patchwork of guidelines, data protection rules, and whatever a particular regulator happens to think about algorithms this year. Written submissions closed on 31 July 2026, and the government has said it wants the Bill tabled and completed before the year is out. That is an aggressive timeline for a law this broad, and it tells you something about how urgently Putrajaya wants this on the books.
Why "horizontal" matters here
Most of the world's AI rules so far have been vertical. A banking regulator handles AI in banking, a health authority handles AI in diagnostics, and everything in between is grey space. Malaysia's own consultation paper is refreshingly candid about the problem this creates: it warns of "differing standards and approaches" building up across sectors, and notes that existing tools only really respond after something has already gone wrong.
The Bill tries to fix that by sitting above the sector specific rules rather than replacing them. It rests on three pillars.
- First, a Central AI Authority, which would still lean on existing regulators (think Bank Negara Malaysia for financial services or the Securities Commission for capital markets) through what the paper calls "Sectoral Leads."
- Second, a set of baseline principles written into law rather than left as suggestions: human dignity, transparency and explainability, accountability, safety and security, and data governance.
- Third, a structure that scales obligations to how dangerous a given AI system actually is, instead of regulating a spam filter and a hospital triage algorithm with the same rulebook.
The mechanics: three tiers, two roles, one authority
The risk framework itself splits into three tiers: Tier 1 for unacceptable risk, Tier 2 for high risk, and Tier 3 for low risk, with obligations scaling up as the potential for harm does. Obligations fall on two kinds of actors: Developers, who materially shape what a system can do, and Deployers, who actually run it in the real world. A single company can be both. This split deliberately echoes the controller and processor distinction from Malaysia's Personal Data Protection Act, though not perfectly, a point several legal commentators have already flagged as a source of future confusion, since a Deployer processing personal data will usually be a controller under the PDPA, while a Developer offering a hosted model might only be a processor.
The Central AI Authority itself is proposed to run three functions: an AI Safety function that maintains the risk framework and oversees testing and incident reporting; an Investigation and Enforcement function with power to demand fact finding and issue directions after incidents; and an AI Enablement function that produces guidance, templates, training, and runs the AI Sandbox, a controlled testing environment meant to let companies experiment before the full weight of compliance lands on them. For smaller businesses without in house compliance teams, that enablement mandate may end up mattering more day to day than the enforcement powers do.
Two more features round out the design. An incident reporting mechanism would require Developers and Deployers to flag not just failures but near misses and unexpected effects, with the public also able to lodge complaints directly. And the Bill's territorial reach is broad by design: it would apply to any AI system designed, developed, or used in Malaysia, regardless of where the underlying infrastructure sits, carving out exemptions only for personal use and national security matters.
How this stacks up against the EU AI Act
Malaysia's drafters have clearly been reading Brussels' homework, and it shows in the structure: a tiered risk model, a central authority, mandatory obligations tied to risk level. But the resemblance is more skeletal than skin deep once you look at the details.
The EU AI Act is a fully codified regulation running to hundreds of pages, with named prohibited practices spelled out in an annex, specific high risk categories listed by sector, and detailed conformity assessment procedures before a system ever reaches the market. Malaysia's Bill, at consultation stage, is still working from principles and a harm list rather than an exhaustive catalogue of prohibited or high risk use cases, closer in spirit to a framework law that leaves the granular detail to subsidiary guidelines and Sectoral Leads. That's partly a function of timeline: the EU spent roughly three years negotiating its Act before adoption, while Malaysia is trying to move from consultation paper to finished statute inside a single year.
Enforcement philosophy differs too. Brussels built the AI Act around compliance that happens before deployment: conformity assessments, technical documentation, and sign off procedures similar to product safety certification, particularly for high risk systems. Malaysia's design leans more on an enablement first posture, with sandboxes, guidance, and incident reporting sitting alongside enforcement powers rather than in front of them, at least as currently framed. Whether that survives contact with the final legislative text is an open question. The consultation drew real pushback from law firms wanting harsher penalty ranges and clearer thresholds, so the version tabled in Parliament may look tougher than the one made public in July.
There's also a jurisdictional difference worth flagging. The EU AI Act has genuine extraterritorial teeth backed by the largest single market in the developed world, which is why companies far outside Europe still comply with it. Malaysia's Bill claims similarly broad reach on paper, covering any system used in Malaysia regardless of where it's hosted, but the practical leverage to enforce that against a foreign Developer is a different question entirely, and one the Edwin Lee and Partners (Law firm based in malaysia) submission specifically raised as a gap needing an international cooperation mechanism.
India and AI Regulation
India has spent the past year deliberately walking in the evolving direction. Through MeitY's India AI Governance Guidelines, released in November 2025 ahead of the India AI Impact Summit, explicitly reject a standalone AI statute in favour of what officials have repeatedly called a "light touch" model: seven guiding principles, trust, people first, innovation, fairness, accountability, transparency, and safety, layered on top of existing law rather than a new one. The Digital Personal Data Protection Act, 2023 and the IT Act, 2000 with amendment rules, do most of the actual legal work, with sector regulators like the RBI and SEBI handling the specifics for their own industries.
The contrast with Malaysia is almost a case study in two governance philosophies. Where Malaysia is building a central authority with enforcement teeth from day one, India has so far preferred advisory bodies, an AI Governance Group and a proposed AI Safety Institute, that shape norms without imposing binding cross sectoral obligations.
Where Malaysia's Bill would be justiciable law with penalties attached, India's framework is closer to a philosophy statement with sandboxes and a national incident database bolted on. That is not a weaker approach so much as a different, and arguably shrewd, bet. India is the world's largest testing ground for AI adoption at scale, from welfare delivery to vernacular language tools, and a heavy compliance regime risks slowing exactly the kind of grassroots experimentation the government is trying to encourage. Betting on existing law and institutional judgment, at least for now, keeps that door open, and it has let India move fast without waiting for a perfect law first.
That said, India's position has been visibly shifting. In July 2026, MeitY Secretary S. Krishnan signalled the government is now exploring dedicated AI legislation after all, a notable departure from the "no early regulation" stance the ministry had held in 2023, and this is likely accelerated by growing concern over deepfakes and synthetic media, which already prompted binding traceability and labelling obligations under amended intermediary rules earlier this year.
The stakes for the next few months
None of this is finished. Malaysia's Bill is still a consultation paper, not enacted law, and the gap between what NAIO proposed in July and what Parliament eventually passes could be significant. Several submissions are already pushing for a wider harm list, sharper enforcement thresholds, and clearer rules for foreign Developers who never set foot in Kuala Lumpur. But the direction is set. Malaysia has decided AI governance can no longer run on goodwill and voluntary guidelines, and it now attempts to write enforceable AI law on a real deadline rather than settling for guidelines. However, the final Bill lives up to that ambition, or gets watered down in the process, is something only the next few months will show.
References
- Ministry of Digital. "Kementerian Digital Mulakan Libat Urus Cadangan Rang Undang Undang Tadbir Urus Kecerdasan Buatan (AI)." 10 July 2026. https://www.digital.gov.my/en-GB/siaran/Kementerian-Digital-Mulakan-Libat-Urus-Cadangan-Rang-Undang-Undang-Tadbir-Urus-Kecerdasan-Buatan-(AI)
- Digital Watch Observatory. "Malaysia launches consultations on AI Governance Bill." July 2026. https://dig.watch/updates/malaysia-ai-governance-bill-consultation
- Baker McKenzie, Wong and Partners. "Malaysia: Public Consultation on the AI Governance Bill." July 2026. https://www.bakermckenzie.com/en/insight/publications/2026/07/malaysia-public-consultation-on-the-ai-governance-bill
- Digital Policy Alert. "Testing requirements in AI Governance Bill" and related entries on the National AI Office consultation. https://digitalpolicyalert.org
- Rahmat Lim and Partners. "National AI Office issues public consultation paper on proposed Artificial Intelligence (AI) Governance Bill." https://www.rahmatlim.com/perspectives/articles/33264/mykh-national-ai-office-issues-public-consultation-paper-on-proposed-artificial-intelligence-ai-governance-bill
- Edwin Lee and Partners. "Malaysia's AI Governance Bill: Our Submission to the Consultation." https://lpplaw.my/ai-governance-malaysia/
- Kiizen. "Overview of the Proposed Malaysia's AI Governance Bill." https://www.kiizen.com.my/proposed-malaysias-ai-governance-bill/
- Zicelegal. "Consultation Alert: Public Consultation on Malaysia's AI Governance Bill." https://www.ziclegal.com/resources/consultation-alert-public-consultation-on-malaysias-ai-governance-bill
- Welcome.AI. "Malaysia's AI Governance Bill Expands Regulation and Accountability for Businesses." July 2026. https://www.welcome.ai/content/malaysias-ai-governance-bill-expands-regulation-and-accountability-for-businesses
- Regulations.ai. "Malaysia AI Regulation Overview." https://regulations.ai/regulations/RAI-MY-NA-SUMMARY-2026
- w.media. "Malaysia to enact AI law." https://w.media/malaysia-to-enact-ai-law/
- VisionIAS. "India's New AI Governance Guidelines Push Hands Off Approach." November 2025. https://visionias.in/blog/current-affairs/indias-new-ai-governance-guidelines-push-hands-off-approach
- EY India. "AI governance guidelines: A bet on innovation." https://www.ey.com/en_in/insights/ai/ai-governance-guidelines-a-bet-on-innovation
- TechnoSports. "Airegulation: Indian Government Finalizes AI Regulation." May 2026. https://technosports.co.in/airegulation-india-framework/
- The AI Track. "India AI Governance Guidelines Released for 2025 to 26." https://theaitrack.com/india-ai-governance-guidelines-2025/
- Lexology, contributed by a law firm. "India's AI Governance Model: MeitY's AI Guidelines and The Evolving Copyright Landscape." March 2026. https://www.lexology.com/library/detail.aspx?g=ffc0c58c-3727-4472-9914-5fa6a33ffffd
- Srishti IAS. "India's First AI Governance Framework 2026: Principles, Oversight, and Inclusive Growth Strategy." February 2026. https://srishtiias.com/india-first-ai-governance-framework-ahead-of-impact-summit-2026/
- Whalesbook. "India Plans Dedicated AI Law, Shifting From Light Touch Approach." July 2026. https://www.whalesbook.com/news/English/other/India-Plans-Dedicated-AI-Law-Shifting-From-Light-Touch-Approach/6a4811c9c7db2a6cf1650f24
- Saikrishna and Associates. "Decoding the India AI Governance Guidelines." November 2025. https://www.saikrishnaassociates.com/decoding-the-india-ai-governance-guidelines/
- News on Air. "MeitY Unveils India AI Governance Guidelines to Promote Safe and Responsible AI Adoption." 5 November 2025. https://www.newsonair.gov.in/meity-unveils-india-ai-governance-guidelines-to-promote-safe-and-responsible-ai-adoption
Contributors
- Maj. Vineet Kumar, Founder & Global President, CyberPeace
- Mr. Neeraj Soni, Senior Research Analyst, Policy & Advocacy, CyberPeace
Related Blogs
Executive Summary
Border 2 is set to hit theatres today, January 23. Meanwhile, a photograph is going viral on social media showing actors Sunny Deol, Suniel Shetty, Akshaye Khanna and Jackie Shroff sitting together and having a meal, while a woman is seen serving food to them. Social media users are sharing this image claiming that it was taken during the shooting of Border 2. It is being alleged that the photograph shows a moment from the film’s set, where the actors were having food during a break in shooting. However, Cyber Peace research has found the viral claim to be false. Our investigation revealed that users are sharing an AI-generated image with a misleading claim.
Claim
On Instagram, a user shared the viral image on January 9, 2026, with the caption: “During the shooting of Border 2.” The link to the post, its archive link and screenshots can be seen below.
Fact Check:
To verify the claim, we first checked Google for the official star cast of the film Border 2. Our search showed that the names of the actors seen in the viral image are not part of the film’s officially announced cast. Next, upon closely examining the image, we noticed that the facial structure and expressions of the actors appeared unnatural and distorted. The facial features did not look realistic, raising suspicion that the image might have been created using Artificial Intelligence (AI). We then scanned the viral image using the AI-generated content detection tool HIVE Moderation. The results indicated that the image is 95 per cent AI-generated.
In the final step of our investigation, we analysed the image using another AI-detection tool, Undetectable AI. According to the results, the viral image was confirmed to be AI-generated.
Conclusion:
Our research confirms that social media users are sharing an AI-generated image while falsely claiming that it is from the shooting of Border 2. The viral claim is misleading and false.
Our research revealed that users are sharing an AI-generated image along with misleading claims
Executive Summary
A viral image circulating on social media claims that Tamil Nadu Chief Minister C. Joseph Vijay touched the feet of Congress leader Rahul Gandhi during his swearing-in ceremony, while Congress and several other parties extended support to his government. The image is being widely shared with captions suggesting it captures a real political moment. However, CyberPeace Research Wing research has found the claim to be false. The image is AI-generated and does not depict any real event.
Claim
A Facebook user shared the viral image on May 10, 2026, claiming that TVK chief and actor Vijay had taken oath as the Chief Minister of Tamil Nadu. The post further claimed that during the ceremony, Vijay touched Rahul Gandhi’s feet to seek blessings, and the gesture was applauded by leaders present on stage. The post, along with archived links and screenshots, is being circulated as authentic evidence of the alleged incident.
- https://www.facebook.com/100057774695228/posts/1389222123013598/?rdid=FEzRYpVvSIieeUbj#
- https://archive.ph/kv4e1
Fact Check
A keyword-based search on Google did not return any credible news reports supporting the claim or confirming such an event. A closer visual examination of the image raised strong suspicions of AI manipulation, prompting verification through AI detection tools. When the image was analyzed using the SIGHTENGINE detection tool, the results indicated that the image is 99% likely to be AI-generated.
Further verification using another AI detection platform, HIVE MODERATION, also flagged the image as synthetic, showing an 81% probability of being AI-generated.
Conclusion
The research clearly shows that the viral image is not real. It has been generated using artificial intelligence and is being falsely shared as a real political event.
Introduction
The Telecommunications Act of 2023 was passed by Parliament in December, receiving the President's assent and being published in the official Gazette on December 24, 2023. The act is divided into 11 chapters 62 sections and 3 schedules. Sections 1, 2, 10-30, 42-44, 46, 47, 50-58, 61 and 62 already took effect on June 26, 2024.
On July 04, 2024, the Centre issued a Gazetted Notification and sections 6-8, 48 and 59(b) were notified to be effective from July 05, 2024. The Act aims to amend and consolidate the laws related to telecommunication services, telecommunication networks, and spectrum assignment and it ‘repeals’ certain older colonial-era legislations like the Indian Telegraph Act 1885 and Indian Wireless Telegraph Act 1933. Due to the advancements in technology in the telecom sector, the new law is enacted.
On 18 July 2024 Thursday, the telecom minister while launching the theme of Indian Mobile Congress (IMC), announced that all rules and provisions of the new Telecom Act would be notified within the next 180 days, hence making the Act operational at full capacity.
Important definitions under Telecommunications Act, 2023
- Authorisation: Section 2(d) entails “authorisation” means a permission, by whatever name called, granted under this Act for— (i) providing telecommunication services; (ii) establishing, operating, maintaining or expanding telecommunication networks; or (iii) possessing radio equipment.
- Telecommunication: Section 2(p) entails “Telecommunication” means transmission, emission or reception of any messages, by wire, radio, optical or other electro-magnetic systems, whether or not such messages have been subjected to rearrangement, computation or other processes by any means in the course of their transmission, emission or reception.
- Telecommunication Network: Section 2(s) entails “telecommunication network” means a system or series of systems of telecommunication equipment or infrastructure, including terrestrial or satellite networks or submarine networks, or a combination of such networks, used or intended to be used for providing telecommunication services, but does not include such telecommunication equipment as notified by the Central Government.
- Telecommunication Service: Section 2(t) entails “telecommunication service” means any service for telecommunication.
Measures for Cyber Security for the Telecommunication Network/Services
Section 22 of the Telecommunication Act, 2023 talks about the protection of telecommunication networks and telecommunication services. The section specifies that the centre may provide rules to ensure the cybersecurity of telecommunication networks and telecommunication services. Such measures may include the collection, analysis and dissemination of traffic data that is generated, transmitted, received or stored in telecommunication networks. ‘Traffic data’ can include any data generated, transmitted, received, or stored in telecommunication networks – such as type, duration, or time of a telecommunication.
Section 22 further empowers the central government to declare any telecommunication network, or part thereof, as Critical Telecommunication Infrastructure. It may further provide for standards, security practices, upgradation requirements and procedures to be implemented for such Critical Telecommunication Infrastructure.
CyberPeace Policy Wing Outlook:
The Telecommunication Act, 2023 marks a significant change & growth in the telecom sector by providing a robust regulatory framework, encouraging research and development, promoting infrastructure development, and measures for consumer protection. The Central Government is empowered to authorize individuals for (a) providing telecommunication services, (b) establishing, operating, maintaining, or expanding telecommunication networks, or (c) possessing radio equipment. Section 48 of the act provides no person shall possess or use any equipment that blocks telecommunication unless permitted by the Central Government.
The Central Government will protect users by implementing different measures, such as the requirement of prior consent of users for receiving particular messages, keeping a 'Do Not Disturb' register to stop unwanted messages, the mechanism to enable users to report any malware or specified messages received, the preparation and maintenance of “Do Not Disturb” register, to ensure that users do not receive specified messages or class of specified messages without prior consent. The authorized entity providing telecommunication services will also be required to create an online platform for users for their grievances pertaining to telecommunication services.
In certain limited circumstances such as national security measures, disaster management and public safety, the act contains provisions empowering the Government to take temporary possession of telecom services or networks from authorised entity; direct interception or disclosure of messages, with measures to be specified in rulemaking. This entails that the government gains additional controls in case of emergencies to ensure security and public order. However, this has to be balanced with appropriate measures protecting individual privacy rights and avoiding any unintended arbitrary actions.
Taking into account the cyber security in the telecommunication sector, the government is empowered under the act to introduce standards for cyber security for telecommunication services and telecommunication networks; and encryption and data processing in telecommunication.
The act also promotes the research and development and pilot projects under Digital Bharat Nidhi. The act also promotes the approach of digital by design by bringing online dispute resolution and other frameworks. Overall the approach of the government is noteworthy as they realise the need for updating the colonial era legislation considering the importance of technological advancements and keeping pace with the digital and technical revolution in the telecommunication sector.
References:
- The Telecommunications Act, 2023 https://acrobat.adobe.com/id/urn:aaid:sc:AP:88cb04ff-2cce-4663-ad41-88aafc81a416
- https://pib.gov.in/PressReleasePage.aspx?PRID=2031057
- https://pib.gov.in/PressReleaseIframePage.aspx?PRID=2027941
- https://economictimes.indiatimes.com/industry/telecom/telecom-news/new-telecom-act-will-be-notified-in-180-days-bsnl-4g-rollout-is-monitored-on-a-daily-basis-scindia/articleshow/111851845.cms?from=mdr
- https://www.azbpartners.com/wp-content/uploads/2024/06/Update-Staggered-Enforcement-of-Telecommunications-Act-2023.pdf
- https://telecom.economictimes.indiatimes.com/blog/analysing-the-impact-of-telecommunications-act-2023-on-digital-india-mission/111828226
