A 4.6GW pipeline built around one type of compute
A BMI (Fitch Solutions) note dated May 12, 2026 found that Malaysia's data centre pipeline — roughly 4.6GW of capacity either under construction or planned — is now "virtually entirely AI-focused." That is not an accident of the market. Since 2024, Prime Minister Anwar Ibrahim has frozen approvals for non-AI data centres, and in February 2026 he reaffirmed the policy explicitly. The Malaysian Investment Development Authority (MIDA) has rejected close to 30% of proposed projects, citing failures on water and electricity benchmarks under the country's sustainability screen. Microsoft's US$2.2 billion commitment from May 2, 2024 and Google's US$2 billion announcement on May 30, 2024 — its first data centre and cloud region in the country — give the policy real anchor tenants.
What Kuala Lumpur built, in two pieces
The framework has two distinct components, and the distinction matters for any honest assessment.
The first is the Guideline for Sustainable Development of Data Centres, published by the Ministry of Investment, Trade and Industry (MITI) on January 3, 2025. It is technical and measurable: a Water Usage Effectiveness target of 2.2 m³/MWh (improving to 2.0 within ten years), Power Usage Effectiveness thresholds, ISO/IEC 30134-2 and 30134-9 reporting standards, and a six-tier classification spanning hyperscalers, colocation, and enterprise facilities. It steers facilities away from water-stressed regions in Peninsular Malaysia and rewards reclaimed-water use.
The second is the Data Centre Framework, announced by the Ministry of Digital on July 22, 2025 and effective from October 2025. It consolidates approval authority at MIDA, with monitoring by a Data Centre Task Force established in February 2025. This piece is process-heavy and includes the AI-only screen that excludes ordinary colocation and enterprise workloads from new approvals.
The case for what Malaysia is doing
The pro-regulation argument is stronger than the libertarian reflex suggests. Singapore's three-year freeze on new data centre approvals (2019–2022) and Ireland's grid stress in 2024 demonstrated that data centre demand can outrun water and electricity capacity faster than utilities can adjust. Johor alone now has 268.5MW of live capacity, 507MW under construction, and 921MW more planned long-term — concentrated in a state where flooding already disrupts construction. A national screen that forces applicants to demonstrate PUE/WUE compliance and renewable sourcing is not protectionism; it is the kind of measurable, ex-ante check that lets a state avoid the moratoriums and emergency curtailments that surprised regulators elsewhere. The ISO-anchored thresholds give applicants a clear hurdle to clear and reviewers an auditable basis to say yes or no.
The part that should make people uncomfortable
The AI-only gate is a separate question. Excluding non-AI applications is industrial policy — a government betting that AI compute is the workload worth the country's scarce water and grid. There are two practical problems with that bet.
First, it requires bureaucrats to classify workloads. A dedicated training cluster is easy to label; a colocation tenant whose customers run a mix of analytics, inference, and traditional enterprise workloads is not. The longer the policy runs, the more pressure there is to game the classification — and the more discretion sits with reviewers who can grant or deny based on labels rather than measurable impact.
Second, it concentrates the market on hyperscalers. Microsoft and Google have the capital to commit US$2 billion–plus and the scale to make every approved gigawatt count. Smaller domestic operators, regional colocation players, and start-up cloud providers do not. BMI itself flags that barriers to entry in Johor are rising and "increasingly favour large, established players." That is the predictable result of an approval regime that gates on workload type rather than physical externality.
The cleaner version of the same policy
The proportionate path is not to abandon the screen — it is to lean harder on the measurable parts and let the AI-only filter wither. If a data centre clears the WUE target, sites away from water-stressed catchments, contracts renewable supply, and pays a published premium for grid capacity, the country has already secured what it actually cares about. Whether the racks behind the meter run a frontier training job, a regional bank's core ledger, or a CDN cache is not a public-interest question; the water and the megawatts are.
There is also a transparency gap to close. Baker McKenzie observed in early 2026 that "there is no formal guideline, directive or circular issued by MIDA outlining the application process and/or the supporting documents required." Applicants currently have to seek pre-consultation. That is the soft spot where industrial policy turns into favouritism. A published rule-book — even a thin one — would let smaller operators compete on the same basis as the hyperscalers.
What to watch
Malaysia is running a useful real-world experiment. If the 4.6GW pipeline delivers without water curtailments or grid emergencies, the BMI thesis — that sustainability-linked screening can catalyse, not throttle, investment — gets validated, and the lesson for Indonesia, Thailand, and Vietnam is to copy the technical thresholds. If, instead, Johor hits flood-driven delays or the AI-only gate becomes a complaint at the WTO or in bilateral talks, the lesson will be that the discretionary layer added cost without adding compliance. Either way, the part Kuala Lumpur deserves credit for is the part most regulators skip: it picked numbers, not vibes, to define what "sustainable" means.