On August 13, 2026, Digital Minister Gobind Singh Deo told the CloudTech & DataCentre Conference in Kuala Lumpur that "the true measure of success is not how many data centres we build, but the value we create around them," according to The Star. It is the right diagnosis. Malaysia's regulatory choices over the next 18 months will decide whether it becomes an AI producer or a well-connected landlord for other countries' compute.
What was announced
The speech tied several threads together. The National AI Office is being institutionalised as AI Malaysia Berhad, a permanent anchor for national AI governance. It is tasked with delivering the Malaysia AI Action Plan 2026–2030. Gobind also described a policy, trust and infrastructure framework, with an AI Governance Bill, a National AI Code of Ethics, data protection, cybersecurity and a planned National Data Commission. He named two gaps: low AI adoption among small and medium enterprises, and shortages of AI, cloud and cybersecurity professionals.
The context is the Malaysia Digital Action Plan 2030, launched on June 29, 2026 by the Ministry of Digital. According to the ministry's announcement, its 2030 targets include a 30% digital-economy share of GDP, 500,000 high-value digital jobs, RM4.5 billion in public-sector savings and 95% of government services online end to end.
The strongest case for the Bill
The case for statutory AI rules deserves a fair hearing. Voluntary ethics codes have a poor record when a system harms someone, and enterprises that sell to government or to regulated sectors often want clear rules so they can price risk. A single national law can also prevent a patchwork of sector-specific demands. Malaysia has shown it will legislate on digital matters, including the Cyber Security Act 2024 and amendments to the Personal Data Protection Act 2010. An AI law would sit within that pattern.
Why the proposed design is better than most
The details reported so far are encouraging. On September 10, Gobind said the draft Bill was complete and that the government hopes to table it "this quarter or in the first quarter of next year," per Malay Mail. He described a three-part approach: technical standards for developers and users, regulations for issues that need oversight but not primary legislation, and the Bill itself. His stated reason is that "issues will arise quickly due to the nature of the technology."
That layering matters. Putting every obligation into a statute freezes today's understanding of a fast-moving technology into law that takes a parliamentary cycle to amend. Keeping the Bill as a thin framework and moving detail into standards and regulations lets rules adapt. A standards centre working with SIRIM, launched in August, gives that lower layer a home.
The risk is on the other side. Regulations made under a framework law can be issued faster and with less scrutiny than statutes, so a narrow Bill can still become a broad regime over time. Three safeguards would help.
- Scope by risk, not by technology. Obligations such as human oversight, incident reporting and data governance should attach to high-risk uses, not to every model or chatbot.
- Public consultation on subordinate rules. Regulations should go through the same open comment process as the Bill, with published impact assessments.
- A clear enforcement agency and appeal route. The government says enforcement structures are being set up before tabling. Their powers and their limits should be published with the Bill.
Where the hub ambition is really decided
For a country that wants to be ASEAN's AI hub, compliance design is the smaller variable. The larger ones are talent, SME adoption and the ability to turn research into products. Gobind himself named low SME uptake and thin pools of AI, cloud and security engineers. The Action Plan's talent and innovation thrusts address these, but a target of 500,000 digital jobs is only meaningful if the skills pipeline delivers people who can build models and products, not just operate infrastructure.
There is also a tension between the hub and the trust agenda. Data-centre investors care about power, connectivity and predictable rules. Startups care about access to data, compute and early customers. A governance regime that gives predictable rules for the first group while imposing heavy documentation on the second would defeat the stated goal of building home-grown IP. Small developers should not carry the compliance load designed for large deployers.
Malaysia's approach also has an advantage over more prescriptive models elsewhere. It can watch how other jurisdictions' rules perform and adopt what works. Gobind's own emphasis on standards suggests that instinct exists.
What to watch
Three things will show whether the design holds. First, the text of the Bill when it goes to Cabinet and Parliament, especially its definition of high-risk AI and its penalties. Second, whether AI Malaysia Berhad is set up as a coordinator and enabler or takes on regulatory functions, since combining promotion and enforcement in one body invites conflicts. Third, whether SME adoption programmes come with money and training, not only frameworks.
The minister's framing gets the priority right: the value created around data centres matters more than the count. A flexible, risk-based Bill will support that goal only if it stays out of the way of the people building products.