Malaysia's AI Governance Bill Is Ready, and AI Malaysia Bhd Gets Its First Board

In July I wrote about the National AI Office being formally institutionalised on 28 July. That happened: it is now AI Malaysia Bhd, a company under the Ministry of Digital that runs the National AI Action Plan 2026 to 2030. Two months on, the scaffolding around it is going up fast. In one week in September we got a completed AI Governance Bill, a named board for AI Malaysia, and a large AI conference in Kuala Lumpur. Let me take these in turn, then add the East Malaysia angle, and finish with what a Sabah business should do.

The AI Governance Bill is drafted and heading to Cabinet

Speaking in George Town on 10 September 2026, Digital Minister Gobind Singh Deo said the draft Artificial Intelligence Governance Bill is complete and will be submitted to Cabinet. His stated timeline: tabled in Parliament this quarter or, if not, in the first quarter of 2027. The National AI Office ran engagement sessions through July to refine the draft, so this is not a surprise document; it is the result of a consultation that businesses and industry groups took part in.

The more useful detail is how Gobind described the structure. Governance, he said, has three components: standards, regulations and law. Matters that can be handled by standards or regulations move faster than legislation. The Ministry has already set up MY-AI Standards, working with SIRIM Berhad, and AI Malaysia is being built to ensure compliance and take enforcement action when the law is in place. He was explicit that the enforcement structure is being set up in parallel with the Bill rather than after it.

It will be tabled in Parliament this quarter or, if not, in the first quarter of next year.from Gobind Singh Deo, Digital Minister, 10 September 2026, as reported by The Star

For a business, the practical translation is this. Some obligations will arrive as voluntary or semi-voluntary standards first, probably around transparency, data handling and risk classification. The law comes later and gives those standards teeth. If you start aligning with the standards early, the law will feel like paperwork rather than a change in how you operate.

AI Malaysia Bhd gets its first board, with a Sabah connection

On 11 September Gobind announced the first board of directors of AI Malaysia Bhd. The chair is Aireen Omar, a corporate figure who sits on the board of Tune Protect Group and is an adjunct professor at Universiti Malaysia Sabah. She is joined by Datuk Fabian Bigar, Secretary-General of the Ministry of Digital; Ma Sivanesan, the Ministry's Deputy Secretary-General for Digital Development; Muhammad Afhzal Abdul Rahman, Chief Digital Technology Officer at the Employees Provident Fund; and Adelene Foo Yen Ling, chairman of Trendcell and a director of MyTeksi.

Gobind said the board brings strategic leadership, good governance and perspectives from both public and private sectors, and that its job is to take the national AI agenda from strategy to aligned and impactful implementation. That last phrase matters. Malaysia has had AI roadmaps before. What it has not had is a single body with a board, a budget and an enforcement mandate. Now it does, and one of its leaders has a direct link to Sabah's university.

The wider picture: KL, Sarawak and Sabah

The same week, the World AI Show held its 48th global edition in Kuala Lumpur on 9 and 10 September, bringing policymakers, enterprise leaders and investors together around the AI Nation 2030 goal. The money behind that goal was set in Budget 2026: RM5.9 billion for AI and digital infrastructure, including a RM2 billion sovereign AI cloud and extra funding for the national AI body, plus the extra 50 percent tax deduction for SMEs on AI and cybersecurity training. In Johor, the data centre build-out continues, with Empyrion's 200 megawatt MY1 campus scheduled to deliver its first phase this month and TM Nxera's AI-ready campus on track for the second half of 2026.

Across the border in Sarawak, the state Premier launched a Sovereign AI Infrastructure Platform on 17 August 2026, a state-governed high-performance computing environment run by Sarawak Information Systems (SAINS) and hosted entirely in local data centres, so government agencies and state-linked companies can build AI systems without data leaving Sarawak. It is one of the clearest examples in the country of a state taking AI infrastructure into its own hands.

Sabah's conversation is a little earlier in the curve but moving. The 10th Malaysia Digital Economy Forum was held in August at ITCC in Penampang, where the state Finance Minister said AI, automation, cloud and data analytics should be judged by the economic value and opportunities they create for Sabah and its people, with SME productivity, higher-value jobs and better public services as the targets. That is exactly the right frame. Infrastructure follows demand, and demand comes from businesses that know what to do with these tools.

What this means for SMEs and for Sabah specifically

• Rules are coming, but in stages. Expect standards first, then regulations, then the Act. If your business uses AI to make decisions about customers, staff or pricing, start keeping a simple record of what tools you use, what data goes into them and who checks the output. That record is the core of every AI governance framework in the world.
• The training incentive is still live. Budget 2026's extra 50 percent tax deduction on AI and cybersecurity training, on top of HRDC claims for eligible employers, means structured AI training is close to the cheapest investment a Malaysian SME can make this year.
• Sabah has a seat at the table. A UMS adjunct professor chairs the national AI body, and the state government is framing AI around SME productivity. That is a good moment for Sabah businesses to show up as users of AI, not just as recipients of policy.
• Data residency is becoming a selling point. Sarawak's sovereign platform and the national sovereign cloud both answer the same worry: where does my data go? If your customers or government clients ask that question, being able to answer it clearly will win you work.

The practical takeaway

Malaysia is moving from talking about AI to institutionalising it: a company with a board, a law with a timeline, standards with a certifying body. None of that changes what happens inside a shop in Kota Kinabalu or a clinic in Tawau on a Tuesday afternoon. What changes that is whether the people there know how to put the tools to work, safely and with a record they can show. The governance side will reward businesses that already do this, and it will eventually be a headache for those that do not.

That is the gap NextGen Training Academy exists to close. Our hands-on, HRDC-claimable AI workshops in Sabah teach practical AI on your real business tasks, with the safe-use habits that the coming standards will expect. Build the skills now, and the rules, when they land, will already be how you work.