Law Reform and Government Advisory

The National AI Office (“NAIO”) has launched a public consultation on the proposed AI Governance Bill through the Unified Public Consultation (“UPC”) platform. The consultation invites stakeholders and members of the public to submit written feedback, comments, or proposals by 31 July 2026. You can find access to the public consultation here.

Background

Artificial Intelligence (“AI”) is rapidly emerging as one of the most powerful technologies of our generation, with the ability to transform industries, enhance productivity, improve public services, and create new economic opportunities. However, the current regulatory landscape poses the risk of differing standards and approaches being applied across various sectors. In response, Malaysia is developing a national AI Governance Bill to establish a comprehensive and coherent governance framework that aims to ensure responsible and trustworthy use of AI while stimulating innovation.

It is noteworthy that the formulation of the Bill is built upon three core approaches: institutional oversight through a Central AI Authority whilst leveraging existing sectoral institutions, a principle-based approach that allows the framework to remain agile and adaptable, and a risk-based approach ensuring that regulatory obligations are proportionate to the level of risk posed by an AI System.

Key Features of the Proposed AI Governance Bill

NAIO has released a Consultation Paper setting out six key areas of the Bill for preliminary public feedback. These areas are summarised below.

Scope of the Bill

The Bill proposes to regulate the AI Lifecycle of AI Systems which are placed on the market or put into service within Malaysia, designed, developed, or used in Malaysia, or used by a Deployer established in Malaysia regardless of where the system is physically hosted. The Bill introduces definitions for key concepts including “Artificial Intelligence”, “AI Systems”, and “AI Lifecycle”, and identifies two primary regulated parties which are “Developers, who materially shape what an AI System is capable of doing, and “Deployers”, who cause the AI System to operate in the real world or domain of deployment. Exemptions are proposed for personal use and national security applications.

AI Governance Architecture

The Bill proposes the establishment of a Central AI Authority which operates as an institutional anchor for the AI governance framework. The Central AI Authority would have three core functions: AI Safety, Investigation and Enforcement, and AI Enablement. The Bill further proposes leveraging existing frameworks through the appointment of Sectoral Leads who may be appointed and delegated specific powers under the Bill to support implementation where they have sufficient legal authority, technical expertise, and governance capacity.

AI Governance Principles

Adopting a principle-based approach, the Bill sets out five guiding AI Governance Principles:

1. Protecting, promoting, and preserving human dignity by upholding human agency and safeguarding human rights.
2. Transparency and explainability proportionate to risk and impact;
3. Clear accountability through traceability and effective redress;
4. Safe and secure use through robust and resilient AI Systems; and
5. Responsible data governance and stewardship in relation to AI Systems.

Developers and Deployers of AI Systems would be required to have “due regard” for these principles throughout the AI System’s lifecycle, with compliance scaled based on the level of risk, context, and purpose of the AI System.

Implementation of these principles is expected to take a phased approach with voluntary documents issued at the early stages of the Bill and progressively moving towards codifying full implementation once a level of maturity is reached by the ecosystem.

AI Risk Framework

The Bill proposes a risk-based approach anchored to four categories of harm: death, bodily injury, unlawful deprivation of fundamental liberty anchored to the Federal Constitution, and contravention of any written law. Based on this, a three-tier risk framework is envisaged namely Tier 1 (Unacceptable Risk), Tier 2 (High Risk), and Tier 3 (Low Risk). Requirements set on these tiers will be proportionate to the nature, context, and level of risk posed by an AI System.

AI Incident Reporting

The Bill proposes a structured AI incident reporting mechanism to ensure a systematic approach in identifying, assessing, learning from, and addressing AI-related incidents. AI Incidents may include an event, failure, weakness, misuse, unexpected effect, material circumstances, or near misses.

Reporting may be made by Developers or Deployers as well as through public complaints to the Central AI Authority, and in cases where a similar mechanism exists, the Central AI Authority may leverage them through Sectoral Leads.

AI Sandbox

The Bill proposes the establishment of an AI Sandbox as a controlled environment to test AI Systems under supervised conditions. The AI Sandbox is intended to encourage innovation, facilitate flexible testing, and support evidence-based policymaking. It may be implemented either as a centralised sandbox operated by the Central AI Authority or by designating and leveraging existing infrastructures through Sectoral Leads.

Conclusion

This public consultation is timely, particularly in light of Malaysia’s aspiration to become an AI Nation by 2030 under the recently launched Malaysia Digital 2030 Action Plan. As the country seeks to position itself at the forefront of AI innovation and adoption, a robust governance framework will be essential in building trust, ensuring safety, and maintaining competitiveness on the global stage.

The consultation is also in line with the National Policy on Good Regulatory Practice (NPGRP), reflecting the Government’s commitment to inclusive, transparent, and evidence-based policy-making. Thus, all stakeholders are encouraged to take this opportunity to contribute to the shaping of Malaysia’s AI governance landscape.

This alert is for general information only and is not a substitute for legal advice.

On 26 October 2025, Malaysia and the US signed the Agreement on Reciprocal Trade (ART) during the 47^th ASEAN Summit in Kuala Lumpur.  Under Executive Order 14257 issued by the US President on 2 April 2025, the agreement is a US proposal to renegotiate tariffs on Malaysia from 25 percent to 19 percent.

The agreement covers many areas including among others in relation to Good Regulatory Practices (GRP).  This update will only focus on Good Regulatory Practices (GRP), and it is beyond the scope of this update to discuss the ART as a whole.

Good Regulatory Practices (GRP)

Article 2.8 in relation to Good Regulatory Practices (GRP) specifically states that:

Malaysia shall adopt and implement good regulatory practices as  set out in Article 2.21 of Annex III that ensure greater transparency,  predictability, and participation throughout the regulatory lifecycle.

Under Annex III: Specific Commitments, Article 2.21 in relation to Adoption and Implementation of Good Regulatory Practices (GRP) sets out the following:

With respect to the adoption and implementation of  good regulatory practices at the central level of government, Malaysia  shall─

(a)    ensure  that laws, regulations, procedures, and administrative rulings are promptly  published and made easily         accessible online;

(b)    under  normal circumstances,[1] publish  and make easily accessible online the text of proposed regulatory          measures,[2] as  well as any regulatory impact analysis, an explanation of the regulation, and  its objective;

(c)     conduct  public consultations for proposed regulatory measures in a transparent  manner; allow adequate         time for interested persons, domestic and foreign, to  submit comments, taking into account the complexity         or possible impact of the  proposed regulation; and give consideration to comments received;

(d)    give  reasonable notice of planned regulatory measures and publish regulatory  policy priorities that will be          developed, modified, or eliminated in the near  term;

(e)    use  publicly accessible high-quality data, evidence, technical information, and  risk assessments, where          appropriate, during the planning and development of  regulation;

(f)     support  international regulatory cooperation through the use of, as appropriate,  relevant international         standards, guides, and recommendations to avoid  unnecessary obstacles to trade;

(g)    conduct  reviews of regulation in effect to determine whether new information or other  changes justify          modification or repeal of regulation; and use tools, such as  regulatory impact analysis, to assess the need for          and possible impacts of  regulations, which could also include alternative approaches to regulation,  where          appropriate.

Key observations on the Good Regulatory Practice (GRP) requirements

• The requirement operates ‘one way’ for Malaysia as it only requires Malaysia to comply, perhaps on the assumption that the US has already complied with such Good Regulatory Practice (GRP) requirements in its domestic legal framework.
• The requirement is only imposed at the ‘central government’ level which is interpreted as Federal Government level and thus, is an important consideration given the autonomy of States and Local Governments to legislate on their own.
• The requirements from (a) to (g) Annex III: Specific Commitments, Article 2.21 already are reflective in our National Policy on Good Regulatory Practice (NPGRP).  The author does not intend to cover this exhaustively, but these requirements can be seen for example in our Regulatory Process Management System (RPMS) framework, adoption of evidence-based tools such as Regulatory Impact Analysis (RIA) and Behavioral Insights (BI), and specific elements there under such as the consultation process and option development.

According to the Attorney General’s Chambers (AGC), ART will only come into effect 60 days after both parties exchange written notifications confirming that their domestic legal procedures have been completed.  It is thus unclear when this will specifically occur given the range of matters agreed in the ART that would require domestic policy to be revisited.

Notwithstanding this, it is the author’s view that signing the bilateral reciprocal trade agreements would have the impact of requiring parties to upgrade domestic requirements in line with international standards, particularly on Good Regulatory Practices (GRP).[3]  Malaysia is no stranger to this where it ratified the multilateral Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) on 30 September 2022 which also included Good Regulatory Practices (GRP) requirements in Chapter 25: Regulatory Coherence.  

It is also the author’s view that from a domestic perspective on Good Regulatory Practices (GRP), it can be perceived that our domestic Good Regulatory Practices (GRP) ecosystem is already in line with best practice. In line with ASEAN’s Vision 2045 call to action to ‘embed’ GRP in every workstream, such requirements have already seamlessly been integrated into the domestic policy and regulatory development cycle.  It is then with optimism that we look forward to the next transformation of our National Policy on Good Regulatory Practice(NPGRP) that will set the benchmark of our Good Regulatory Practices (GRP)ecosystem for years to come.

The Agreement can be accessed here https://www.miti.gov.my/ART.                                                                                                                

If you have any questions or require any additional information, please contact our Partner and Head of the Government Advisory Practice, Mohamad Izahar Mohamad Izham at izaharizham@ziclegal.com of Zaid Ibrahim & Co.  

This alert is for general information only and is not a substitute for legal advice.

[1] “normal circumstances” do not include, for example, situations in which: publication in accordance with subparagraph (b) would render the regulatory measure ineffective in addressing the particular harm to the public interest that the regulatory measure aims to address; urgent problems (for example, of safety, health, or environmental protection) arise or threaten to arise for Malaysia; or the regulatory measure has no substantive impact upon members of the public, including persons of the United States.

[2] “regulatory measures” means measures of general application adopted, issued, or maintained by a regulatory authority with which compliance is mandatory, except: general statements of policy or guidance that do not prescribe legally enforceable requirements or measures concerning: (i) military, foreign affairs, or national security functions of the Government; (ii) public sector management, including personnel, pensions, public property, loans, grants, benefits, or contracts;(iii) departmental organization, procedure, or practice; or (iv) taxation, financial services, anti-money laundering, monetary policy, exchange rate policy, or government procurement. For greater certainty, a regulatory authority at the central level of government does not include legislatures or courts.

[3] At the time of writing, it is understood that the only two ASEAN countries that have signed the bilateral reciprocal trade agreements with the US is Cambodia and Malaysia.

‍

In conjunction with the recent adoption of the ASEAN Community Vision 2045, this policy brief published by the Economic Research Institute for Asean and East Asia (ERIA), co-authored by Dr. Intan Murnira Ramli, Senior Policy Fellow in the Policy Design Department at ERIA, and our Mohamad Izahar Mohamad Izham, Partner of the Government Advisory Practice at Zaid Ibrahim & Co, examines ASEAN’s progress on Good Regulatory Practice (GRP) and outlines key policy recommendations to be undertaken for the future. The brief highlights the pivotal role of GRP in supporting ASEAN’s long-term goals and calls for its systematic integration across all ASEAN Economic Community (AEC) initiatives.

As 2025 starts off with major geopolitical changes in the world and Malaysia takes the Chair for ASEAN, there are exciting developments in Malaysia that will impact businesses and FDI. We would like to update our clients on the major legislative updates to look out for particularly in the tax and energy space, as well as new opportunities in the state of Johor through the Johor-Singapore Special Economic Zone, a recap on the National Semiconductor Strategy and the focus on private equity.

‍

The Malaysia Competition Commission (MyCC) is conducting an online public consultation to obtain feedback on the proposed integration of Competition Impact Assessment (CIA) into Regulatory Impact Analysis (RIA). The aim of the consultation is to oversee the integration of CIA into RIA and its importance to the rule making process. This ensures that new regulations issued (or review of existing regulations) comply with competition law and are in line with Good Regulatory Practice (GRP). The consultation is to allow stakeholders to understand the framework of CIA and obtain feedback to better understand the needs, concerns and perspectives of regulators.  

The “Consultation Session for the Proposed Integration of Competition Impact Assessment (CIA) into Regulatory Impact Analysis (RIA)” is available both in English and Bahasa Malaysia.  

In addition to submitting general feedback, there is also a survey titled “Survey for Consultation Session for the Proposed Integration of Competition Impact Assessment (CIA) into Regulatory Impact Analysis (RIA)” available both in English and Bahasa Malaysia.

What is Regulatory Impact Analysis (RIA)?

Regulatory Impact Analysis or “RIA” is the process of systematically analysing and communicating the impacts of proposed regulations or review of existing regulations. The essential characteristic of RIA is its informed and evidence-based decision-making for regulatory intervention through analysis of problems and solution options, stakeholder consultation, a cost-benefit analysis, and implementation strategy.

What is Competition Impact Assessment (CIA)?

Competition Impact Assessment or “CIA” is the process of examining the competition effects of laws and regulations to ensure that they are pro-competitive. This integration process intends to show the regulators the methodology that can be adopted to examine the laws and regulations.

CIA is important to ensure that the laws and regulations do not bring unnecessary restraints to competition and help find alternatives that could still achieve the same objectives the regulators had intended to gain.

CIA Integration into RIA

It is important to note that CIA is already an existing component under the RIA framework as provided under the National Policy on Good Regulatory Practice (NPGRP). It is only a matter of putting into effect this requirement after over a decade of Good Regulatory Practice (GRP) implementation in Malaysia.

To support the integration, MyCC has developed a comprehensive toolkit comprising three main components:

• Part I: CIA Framework;
• Part II: CIA Checklist (for the initial screening process); and
• Part III: CIA Guideline (to assist regulators in preparing CIA).

Part I: CIA Framework

The current RIA process currently entails three stages:

• Stage 1: Digital Regulatory Notification (DRN)
• Stage 2: Initial Assessment Stage
• Stage 3: Final Assessment Stage

To incorporate CIA, the current three-stage process will remain but there will be some changes in each stage, as illustrated below.

Source:  Consultation for the Proposed Integration of Competition Impact Assessment (CIA) intoRegulatory Impact Analysis (RIA)

Part II: CIA Checklist

The CIA Checklist is a set of four main questions each with sub-questions to assist regulators in identifying potential competition concerns early in the policy development process i.e. during Stage 1: Digital Regulatory Notification (DRN).  

In the event that the CIA Checklist is triggered i.e. the questions are answered in the affirmative, further investigation of the anti-competitive practices would be required in Stage 2: Initial Assessment Stage.

Part III: CIA Guideline

The CIA Guideline is a detailed technical document on competition assessment which contains key questions to be considered when performing CIA. The CIA Guideline includes requirements that needs to be fulfilled by regulators when the CIA Checklist is triggered.

These requirements are to be undertaken during Stage 2: Initial Assessment Stage and specifically apply for Element 3: Options and Element 4:Impact Analysis of the RIA process.

The consultation is open from 13 June 2023 until 21 July 2023.

For more details on the consultation document, including the survey and feedback submission, please visit Malaysia Productivity Corporation’s Unified Public Consultation (UPC) portal here.

Recently, there has been a shift from traditional regulatory reform (which focuses on reviewing existing legislation and improving them by way of amendments or new laws) towards non-regulatory solutions (such as using behavioural sciences to revise policy framework). This is a global widespread phenomenon where even ASEAN countries are not oblivious to its impact.

In this article, our Partner and Head of the Corporate & Government Advisory practice, Mohamad Izahar Mohamad Izham and Associate Amiza binti Ahmad Murad will uncover among others, the application of Behavioural Insights among the ASEAN countries, and lessons learned from Behavioural Insights projects in select countries.