Is AIGE legally binding in Malaysia?

No. AIGE is voluntary guidance from MOSTI that works alongside existing laws such as the Personal Data Protection Act 2010, and it carries no penalties of its own. A separate AI Governance Bill is being prepared by the Ministry of Digital. Until that becomes law, AIGE and the AI Code of Ethics are the clearest signal of what is expected.

What are the seven AIGE principles?

Fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and the pursuit of human benefit and happiness. In practice they ask organisations to avoid bias, test systems properly, protect personal data, include all user groups, explain AI use, name who is responsible, and use AI for a genuine benefit.

What is Malaysia's AI Governance Bill?

A proposed law from the Ministry of Digital, described as Malaysia's first horizontal legal framework for AI governance. It takes a risk-based approach, assigns duties by role across the AI lifecycle and complements existing laws. Engagement and public consultation began in July 2026, and in October 2026 the minister told Parliament it is scheduled to be tabled early in 2027.

What is AICE and how is it different from AIGE?

AICE, the AI Code of Ethics, is a voluntary code published by AI Malaysia Berhad, the National AI Office. It builds on AIGE's seven principles and is meant to help organisations apply them in everyday AI design and deployment. AIGE sets out the principles; AICE is the more operational companion that turns them into practice.

Does a small business that only uses ChatGPT or Copilot need to follow AIGE?

AIGE treats you as an end user, and adoption is voluntary. Its basic habits are still sensible for any business: know which AI tools staff use, keep personal data out unless approved, check outputs before relying on them, tell customers when AI is involved, offer a human route, and write a short AI use policy.

Malaysia AI Governance Guidelines (AIGE) Explained for Businesses

Malaysia's National Guidelines on AI Governance and Ethics (AIGE) are a voluntary framework launched by the Ministry of Science, Technology and Innovation (MOSTI) in September 2024. They set seven principles and give separate guidance to end users, policy makers and developers. They are not law, but a risk-based AI Governance Bill is on the way, so AIGE is your best preview of what will be expected.

At a glance (checked October 2026)

Published by: MOSTI, September 2024, as part of the National AI Roadmap 2021 to 2025.
Legal status: voluntary guidance that works alongside existing laws. It calls itself a living document.
Seven principles: fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; pursuit of human benefit and happiness.
Three audiences: end users, policy makers, and developers, designers, technology providers and suppliers.
What is new in 2026: AI Malaysia Berhad (the National AI Office) has published a voluntary AI Code of Ethics (AICE) built on the seven principles, and the Ministry of Digital began engagement and public consultation on an AI Governance Bill in July 2026.

What AIGE is, and what it is not

AIGE sits under the National AI Roadmap and carries the theme "AI for Malaysia, AI for All". It explains what AI is, sets out ethical issues and Malaysian considerations such as the Rukun Negara and the Federal Constitution, and then gives practical guidance to each group of stakeholders. The full document is on MOSTI's MASTIC publication page, and the government portal has a short summary of AIGE.

It is not a licence, a certification scheme or a regulation with penalties. Adoption is voluntary. But it does not replace the laws that already apply to how you use AI, the most important for most businesses being the Personal Data Protection Act 2010. If your staff paste customer data into AI tools, read our guide to PDPA and AI tools at work alongside this one.

AIGE also admits its gaps. It says generative AI policy and intellectual property questions are still being explored and will be addressed in the next version. Treat it as a foundation, not the final word.

This article is general information, not legal advice.

The seven principles in plain English

Principle	What it asks	What it looks like at work
Fairness	Avoid bias against any group of users	Test outputs across age, gender, religion and ethnicity
Reliability, safety and control	Test well, fail safely, keep humans in control	Pilot before rollout, with a way to switch it off
Privacy and security	Protect personal data across the lifecycle	Consent where needed, privacy and security by design
Inclusiveness	Do not leave groups out	Work in the languages and on the devices your users have
Transparency	Make AI use and decisions explainable	Tell people when AI is involved and how to challenge it
Accountability	Someone owns the outcome, good or bad	A named owner and records for each AI system
Pursuit of human benefit and happiness	AI should improve lives and avoid harm	A clear purpose that helps customers or staff

AIGE also describes three levels of human oversight, which are useful labels for your own policies:

Human-in-the-loop: a person can step in at every decision cycle of the system.
Human-on-the-loop: people can intervene during the system's design cycle and monitor how it operates.
Human-in-command: people oversee the system's overall activity and decide when and how it is used.

A loan decision or a hiring shortlist calls for a person in the loop. A chatbot answering opening hours can usually run with people on the loop, monitoring it.

What AIGE asks of each group

End users: most businesses

If your company uses AI tools rather than building them, AIGE treats you as an end user. Its dos and don'ts come down to a few habits: define the problem you want AI to solve before you buy a tool, protect personal data, do not over-rely on AI output, stay within the regulations that apply to you, and keep learning.

Policy makers

This section is for government, agencies and sector bodies. It encourages a risk-based approach, translating the principles into sector policy, and coordination across agencies. Watch it if you work in a regulated sector, because it signals how your regulator may think.

Developers, designers, technology providers and suppliers

If you build AI products or deploy models for clients, AIGE expects more: relevant testing and certification, risk and impact assessments, and accountability established at each stage of the lifecycle. During design it asks you to consider four things: the system's purpose, what the technology can do, its quality and reliability, and whether sensitive users such as children or vulnerable people are affected.

The consumer rights AIGE lists

AIGE lists rights that consumers of AI should have:

the right to be told when personal data is used to make offers or decisions about them, or is shared with third parties;
the right to object and receive an explanation;
the right to have personal data deleted;
the right to interact with a human instead of AI;
the right to redress and compensation, including collective redress;
the right to complain to a supervisory authority or take legal action.

The one most businesses can act on this week is the human route. If a customer is talking to your AI agent, make it easy to reach a person.

What changed in 2026: AI Malaysia, AICE and the AI Governance Bill

AI Malaysia Berhad and the AI Code of Ethics

The National AI Office was set up on 12 December 2024. It has since been institutionalised as AI Malaysia Berhad, the national AI agency under the Ministry of Digital, which was launched on 28 July 2026 together with the National AI Action Plan 2026 to 2030 and a Malaysia AI Safety Institute (MY-AISafe), according to the agency's launch media release.

Its governance page now lists the instruments in use. The newest are:

The AI Code of Ethics (AICE): a voluntary, non-binding code for organisations, developers, deployers and researchers. It describes itself as an operational bridge between AIGE's seven principles and real AI design and deployment. You download it, in English or Bahasa Melayu, through a short form.
The Boardroom Primer to AI Adoption and Governance: a voluntary guide for directors and senior management, with a board AI readiness maturity assessment.

Public sector teams should also note that Jabatan Digital Negara published a public sector AI adoption guideline in 2025.

The AI Governance Bill

On 10 July 2026 the Ministry of Digital, through the National AI Office, began engagement on a proposed AI Governance Bill with a public consultation on the Unified Public Consultation portal expected to open the same day. The ministry describes it as Malaysia's first horizontal legal framework for AI governance. Key points from the official release:

it takes a risk-based approach, with duties matched to each party's role and level of control across the AI lifecycle;
it is meant to complement existing laws, not replace them;
it encourages incident reporting, safeguards and AI sandboxes;
it will not directly regulate AI output, which stays under existing laws.

On 5 October 2026 the Digital Minister told the Dewan Rakyat that the bill is scheduled to be tabled early in 2027, as reported by The Edge. Until the bill is published, nobody can tell you its exact obligations. What you can do is get your house in order using AIGE and AICE, because a risk-based law will ask the same questions.

A practical AIGE checklist for Malaysian businesses

Use this as a starting point for a one-page AI register and policy:

List every AI tool and system in use, who uses it, and what data goes into it. Include free tools staff use on their own.
Name an owner for each one. Accountability starts with a person, not a department.
Rate each use by risk. Anything that affects people's jobs, money, health or access to services is high risk. Drafting internal emails is low.
Check personal data handling against the PDPA, and involve your data protection officer.
Test for fairness on the groups your system serves, including the languages your customers actually write in, such as Bahasa Malaysia, English, Chinese and Tamil.
Tell people when AI is involved, and label AI-generated content that customers see.
Give a human route and a way to challenge AI decisions.
Set the oversight level for each system: in the loop, on the loop or in command.
Keep records: prompts and instructions, model or tool versions, test results, incidents and fixes.
Train your people. AIGE's end-user guidance only works if staff understand what AI can and cannot do.
Write it down in an AI use policy. Our guide to writing an AI use policy for a small team has a template structure.
Watch for the bill. Read AICE now, and review your register when the bill is tabled.

Leaders who need to sponsor this work will find our guide to AB-731 for Malaysian managers useful.

How CertTulen Academy can help

Governance only sticks when people understand the technology. For managers who must set direction and own AI risk, Drive AI Transformation in Your Organization (AB-731) is built for the leaders who sponsor AI programmes. For staff who use AI every day, AI Fluency: Framework and Foundations builds the habits AIGE asks of end users. CertTulen Academy runs both live and instructor-led, online or as private cohorts. CertTulen is an HRD Corp accredited training provider, and many of its professional courses can be claimed by HRD Corp registered employers, so ask us which courses are claimable. Contact us to plan a session.