A prime minister names the tension out loud
At the July 28, 2026 launch of AI Malaysia — the entity formally replacing the National AI Office (NAIO) at Cyber Axis Tower in Cyberjaya — Prime Minister Anwar Ibrahim did something unusual for a leader courting foreign tech capital: he publicly questioned the legal architecture underneath it. Anwar told the audience the new agency still has to work out "how far should we establish a sovereign cloud, how do we deal with the problem of the United States' CLOUD Act, which can penetrate all other systems," listing sovereign-cloud arrangements and cybersecurity alongside CLOUD Act exposure as open national-security questions.
That is a striking thing to say weeks after Malaysia locked in one of the largest tech-investment waves in its history. AWS, Microsoft, Google and Oracle have committed a combined $16.9 billion to Malaysian cloud and data-centre infrastructure through 2038, according to Malaysia's own investment authority, MIDA — Oracle's $6.5 billion cloud-region commitment alone is among the largest single tech investments the country has recorded. Anwar is not rejecting that capital. He is asking, correctly, what jurisdiction actually governs it once it lands.
Steelmanning the sovereignty worry
The concern is not paranoia. The US CLOUD Act, enacted in 2018 as part of that year's Consolidated Appropriations Act, amended the Stored Communications Act so that US legal process can compel an American provider to produce data "wherever it happens to be located," per the Department of Justice's own account. A workload sitting in a Johor or Cyberjaya facility run by a US hyperscaler is not, in jurisdictional terms, outside Washington's reach — a US court order can travel with the corporate parent, not the server rack.
The Electronic Frontier Foundation raised the sharpest version of this objection when the Act passed: it lets US law enforcement compel disclosure of content and metadata "even if it is stored in a foreign country, without following that foreign country's privacy laws," bypassing the mutual legal assistance treaty process that used to force at least nominal respect for the host country's legal standards. For a government hosting national AI models, health data, or critical-infrastructure telemetry on US-operated cloud, that is a live governance gap, not a hypothetical one.
The answer already funded: a narrower sovereign layer
Malaysia isn't waiting to answer it. In the Budget 2026 tabling on October 11, 2025, Anwar announced that the Malaysian Communications and Multimedia Commission (MCMC) will build a RM2 billion sovereign AI cloud — government-controlled infrastructure meant to keep sensitive national data, models and compute inside Malaysian borders and under Malaysian law, with subsidised GPU access rolled out to SMEs and an AI Transformation Centre run jointly with Multimedia University. That is the right shape of response: a bounded, purpose-built layer for the workloads that actually need sovereign guarantees, sitting alongside — not replacing — the hyperscale capacity that AWS, Microsoft, Google and Oracle are building.
Why a wholesale retreat would be the wrong lesson
The mistake would be reading Anwar's CLOUD Act comment as a cue to renegotiate or slow-walk the $16.9 billion pipeline. That investment is not incidental to Malaysia's AI Nation 2030 agenda; it is the compute, talent pipeline and regional-hub positioning the agenda depends on. Full data localisation — forcing every workload onto domestic infrastructure regardless of sensitivity — would sacrifice the scale, redundancy and frontier-model access that only hyperscalers currently offer, in exchange for a jurisdictional guarantee that a RM2 billion sovereign cloud can deliver more cheaply for the narrow set of workloads where it actually matters: government records, critical-infrastructure control systems, health and biometric data.
The more durable fix sits below the infrastructure question entirely: contractual and technical safeguards — client-side encryption with keys never held by the US parent, data-processing addenda that specify Malaysian law as governing for stored data, and lobbying (alongside ASEAN peers) for an executive agreement under the CLOUD Act's own reciprocal framework, the mechanism the Act itself created for exactly this friction. The UK and Australia already have such agreements with Washington; Malaysia asking for the same standing is a more proportionate ask than re-litigating whether US cloud providers belong in the country at all.
Anwar framed the CLOUD Act problem as a question still being worked out, not a verdict. That is the correct posture. A government that keeps its sovereign layer narrow, keeps the hyperscale capital flowing, and treats jurisdictional exposure as a contract-and-treaty problem rather than a reason to decouple will get more digital-economy growth — and arguably more real sovereignty — than one that tries to build an island.