Malaysia's AI Policy: The National AI Office and the AI Action Plan

When a country wants to steer artificial intelligence but does not want to wait years for a law, it builds an office first. Malaysia did exactly that: rather than opening with an AI Act, it stood up a coordinating agency, published a set of voluntary ethics principles, and wrote a five-year plan — then began drafting the statute afterward.

The result is a layered, soft-law posture that is easy to misread. There is no single “Malaysia AI law” to point to. Instead there are three moving parts — an agency, a set of guidelines, and an action plan — plus a governance bill now taking shape behind them.

Who actually runs AI policy in Malaysia?

The central body is the National AI Office (NAIO). The Cabinet approved it on 28 August 2024, and Prime Minister Datuk Seri Anwar Ibrahim launched it on 12 December 2024. It sits under the Ministry of Digital and, for its first year, operated with guidance from MyDIGITAL Corporation during an incubation period.

NAIO’s job was coordination: to strategise AI development, centralise resources, standardise governance through ethical guidelines, encourage responsible AI use, and accelerate innovation through joined-up research. In practice it acts as the connective tissue between government, industry, academia and civil society, organising much of that work through specialised working groups.

That coordinating office has since been made permanent. In late July 2026, the government launched AI Malaysia Berhad (company registration 202601028115), a national entity under the Ministry of Digital that formally institutionalises NAIO. According to The Edge Malaysia, the move gives the AI agenda “a permanent structure, broader responsibilities and the mandate to implement” it — a step up from a coordinating office to a delivery body. The Edge reports that Shamsul Izhan Abdul Majid, who had led NAIO since its establishment, ended his tenure in June ahead of the transition.

The overarching ambition attached to all of this is for Malaysia to become an “AI Nation by 2030.”

What are the guidelines everyone keeps citing?

Before the office and the plan came the ethics rulebook. In September 2024, the Ministry of Science, Technology and Innovation (MOSTI) launched the National Guidelines on AI Governance and Ethics (AIGE) as part of the National Artificial Intelligence Roadmap (AI-Rmap) 2021–2025.

Two features matter most. First, the guidelines are voluntary — they set expectations and build trust rather than impose penalties. Second, they are aimed at three stakeholder groups: end users and the public; policymakers; and technology developers and providers. MOSTI describes AIGE as a “living document” to be updated as the technology moves, and positions it as a foundation for eventual legislation.

The guidelines rest on seven principles:

#	AIGE principle	What it asks for
1	Fairness	Prevent bias and discrimination
2	Reliability, safety and control	Systems operate securely and under human oversight
3	Privacy and data security	Protect personal information
4	Inclusiveness	Equal access and participation
5	Transparency	Clear explanation of how AI reaches decisions
6	Accountability	Responsibility for AI outcomes
7	Human benefit	Serve social welfare and prevent misuse

For a business, AIGE is the closest thing to a national compliance checklist today — not enforceable in itself, but the reference point regulators and courts are likely to lean on until a statute exists.

What does the AI Action Plan 2026–2030 actually commit to?

The plan is the strategy layer. The National AI Action Plan 2026–2030 — also branded “AI Nation 2030” — succeeds the AI-Rmap 2021–2025 and was tabled toward the end of 2025. It is coordinated by NAIO/AI Malaysia and structured around 28 initiatives: 14 that apply AI to specific sectors, and 14 foundational ones covering talent, innovation, infrastructure, governance and financing.

The headline targets are concrete:

• AI to contribute over RM60 billion to GDP by 2030.
• Malaysia to rank among the top 20 countries in global AI readiness by 2030.

Those targets are set against a market that is already moving. Data cited by the US-ASEAN Business Council put around 2.4 million Malaysian businesses — roughly 27% — as already using AI, with adoption growing about 35% year on year. Among adopters, 65% reported higher revenues (averaging a 19% increase) and 72% cited significant productivity gains. The most-cited constraint, flagged by 52% of respondents, was a shortage of skills — which is why talent runs through the foundational half of the plan.

The plan is designed to align Malaysia’s ecosystem with international reference points rather than diverge from them, and Digital Minister Gobind Singh Deo has framed it as reinforcing, not replacing, the AIGE ethics guidelines.

Where does the law fit in — is an AI Act coming?

This is the part that is changing fastest. For most of 2024 and 2025, Malaysia’s stance was deliberately soft: govern through voluntary guidelines and existing sectoral laws, and avoid a heavy standalone statute that might chill investment.

That posture is now evolving. According to The Edge Malaysia, the government is drafting an AI governance bill that adopts a risk-based approach, with completion targeted for the end of 2026. Alongside it, a Malaysian AI Safety Institute is planned to run safety assessments, test AI models and conduct red-teaming exercises. In other words, the “no AI Act” description is becoming a moving target: soft law remains the operating reality today, but statutory, risk-tiered oversight is explicitly on the roadmap.

Here is how the pieces line up over time:

Date	Milestone
2021–2025	National AI Roadmap (AI-Rmap) — the predecessor framework
September 2024	MOSTI launches AIGE ethics guidelines (voluntary)
28 August 2024	Cabinet approves the National AI Office
12 December 2024	PM Anwar launches NAIO under the Ministry of Digital
End of 2025	National AI Action Plan 2026–2030 tabled
Late July 2026	AI Malaysia Berhad launched, institutionalising NAIO
End of 2026 (target)	Risk-based AI governance bill to be completed

What does this mean if you build or deploy AI in Malaysia?

For now, there is no licence to obtain and no AI-specific penalty regime. The practical baseline is: follow the seven AIGE principles, comply with existing laws that already touch AI (data protection, sectoral regulation), and watch the governance bill closely because a risk-based law would introduce obligations that scale with how high-stakes your system is.

What’s next

The load-bearing question is the governance bill. If it lands by its end-2026 target with a genuine risk-based structure, Malaysia moves from soft law to statutory AI regulation, and the AIGE principles gain teeth. Watch three things: the bill’s risk tiers and which uses count as “high risk”; the standing-up of the Malaysian AI Safety Institute and what its assessments actually require; and the first progress reporting against the RM60 billion GDP and top-20-readiness targets. This article will be updated as those documents are published.