Malaysia’s AI Governance Bill is coming in early 2027: what SMEs that use AI should know

AI 3 Nov 2026 5 min read

If your business uses AI to reply to customers, write posts or sort enquiries, Malaysia is getting closer to having a law about it.

On 29 October 2026, Digital Minister Gobind Singh Deo answered a question in the Dewan Rakyat about the AI Governance Bill (Rang Undang-undang Tadbir Urus Kecerdasan Buatan). Here is what he said, and what it means for a small business.

What was said in Parliament

The Minister was answering a question from the Member for Bagan Serai, Datuk Haji Idris bin Haji Ahmad. According to the Parliament of Malaysia’s draft Hansard for that day:

Timing. The Bill is expected to be tabled in the Dewan Rakyat in early 2027.
Risk-based. The government is taking a risk-based approach. The Minister used the English words “the risk-based approach” himself.
Public input. Public consultation and engagement sessions have been held with ministries, agencies, industry, academics, professional bodies, civil society and the public. The Minister said 317 responses from 218 entities were received and are being studied to finalise the Bill’s framework.
Next step: Cabinet. Answering a follow-up question, the Minister said the paper on the Bill has been prepared and will be submitted to the Cabinet shortly.
What it will cover. In principle, the framework being developed will cover AI risk management, the accountability of those involved in developing and using AI, and mechanisms for reporting and managing incidents.
Who is responsible. The Bill is expected to give a legal basis so that parties that develop, provide or use AI systems have suitable responsibility to identify, assess and manage risk. This includes taking suitable steps to prevent and reduce harm, and making sure corrective action can be taken if there is an incident, a system failure or harm linked to AI use.
Responsibility depends on your role. The Minister said responsibility should be decided by a party’s role, its level of control, and the level of risk of an AI system across its whole life cycle.

(The Hansard is in Bahasa Malaysia and is still marked as a draft, so its wording may change. The points above are our plain-English summary, not an official translation. The Bill’s actual text has not been published yet.)

What applies today, before the Bill

While the Bill is being finalised, the Minister said, the government is relying on existing laws. He listed these, plus one new Bill:

Scams and deepfakes: the Penal Code (Act 574), supported by the National Scam Response Centre (NSRC), and the Cybercrimes Bill 2026, which Parliament passed in July 2026 but which is not yet in force.
Content manipulation and false information: the Communications and Multimedia Act 1998 (Act 588) and the Online Safety Act 2025 (Act 866).
Personal data: the Personal Data Protection Act 2010 (Act 709). The Minister said it was amended with stricter compliance and penalties. That amendment is the Personal Data Protection (Amendment) Act 2024 (Act A1727), which came into force in stages between 1 January and 1 June 2025.
Cyber security: the Cyber Security Act 2024 (Act 854), overseen by NACSA.

So the new Bill is not the only rule. If an AI tool in your business handles customer names, phone numbers or orders, personal data law already applies.

What this means for a small business

We don’t know the Bill’s details yet, so nobody can tell you exactly what you’ll need to do. But the direction is clear from what the Minister said: users of AI, not only the companies that build it, are expected to carry responsibility that fits their role, their level of control and the level of risk.

For a Malaysian SME, “using AI” often means AI that talks to your customers. That is exactly where risk shows up: a wrong price, a promise you can’t keep, or a customer’s details going somewhere they shouldn’t.

What you can do now

These steps are good practice today, whatever the final Bill says.

1. List where you use AI. Write down every place AI touches your business: customer chats, social media replies, ads, content, lead forms. You can’t manage risk you haven’t listed.

2. Know what your AI is allowed to say. Make sure it answers from information you approved, such as your prices, opening hours and policies, and that it says “I don’t know” instead of guessing.

3. Keep a human in the loop. Decide when a chat must go to a person, such as complaints, refunds or anything sensitive. Check that the handoff actually works.

4. Look after customer data. Know what customer information your AI tools collect, where it is kept, and who can see it.

5. Keep a record when things go wrong. The Minister said the Bill’s framework will cover incident reporting. Start simple: when the AI gives a wrong answer, note what happened and what you fixed.

6. Ask your AI provider questions. Who controls what the AI says? Can you review its chats? Can you switch it off or take over a chat quickly?

Where ThinkChat fits

ThinkChat is a multi-channel AI Chat Agent, not a chatbot. WhatsApp is the main channel in Malaysia, connected through Meta’s official WhatsApp Business Platform API or a QR scan, and ThinkChat also works on other channels like Instagram, Facebook Messenger and website chat. It answers from the information you approve, and hands the chat to a person when a customer needs one.

Soft next step

Want an AI Chat Agent to answer your customers 24/7? Talk to Lyia on WhatsApp: +60 11-5515 9317.

This article is general information, not legal advice.

Sources

Checked 3 November 2026.

← All articles