On 5 October 2026, Digital Minister Gobind Singh Deo said Malaysia's AI Governance Bill would be tabled in the Dewan Rakyat in early 2027, later than the 2026 target set earlier. A report datelined 29 October by The Edge Malaysia says the bill "has been completed and will be submitted to the Cabinet in the near future." The Sun quotes the minister saying that "317 submissions from 218 entities have been received and are being reviewed to finalise the Bill's framework."
A slipped deadline is usually read as a failure. Here it may be the best news in the process, provided the extra months are used well.
The case for moving fast
The strongest argument for speed is that AI harms are already arriving. Deepfake fraud, synthetic impersonation and automated decisions that affect people's livelihoods do not wait for legislatures. A horizontal law gives developers and deployers one predictable rulebook. It also gives a regulator a clear mandate to investigate when something goes wrong, and it signals to investors that Malaysia takes trust seriously. Waiting, on this view, leaves citizens exposed and businesses guessing.
Why the delay costs less than it seems
That argument is weaker in Malaysia's case, because the interim protections are real. According to The Edge, Gobind said the government would keep addressing fraud, deepfakes, content manipulation and false information through existing laws: the Penal Code, the Communications and Multimedia Act 1998, the Online Safety Act 2025 and the Cybersecurity Act 2024.
Those are not paper tigers. The MCMC's page on the Online Safety Act 2025 says licensed service providers must implement measures to mitigate the risk of users being exposed to harmful content and must provide a reporting mechanism. The harmful-content categories it lists include child sexual abuse material and financial fraud and scams. The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024, according to the National Cyber Security Agency (NACSA). It covers national critical information infrastructure duties and the licensing of cyber security service providers.
So the near-term harms that drive public anxiety, scams and deepfakes, already have enforcement hooks. The AI bill is not the only thing between Malaysians and those harms. It is a framework for the broader and harder question of how AI systems are built and deployed across the economy.
What the draft proposes, and where it could go wrong
The July 2026 public consultation paper from the National AI Office is summarised in a Baker McKenzie client alert dated 13 July. It describes three risk tiers. Tier 1 covers systems developed or deployed with intent to cause harm, which would be prohibited. Tier 2, high risk, covers systems without harmful intent that nonetheless create a risk of harm. Tier 3 covers systems with no foreseeable material AI harm. Tier 2 systems would face risk assessment, documentation, internal controls, human oversight, monitoring and mitigation. A new Central AI Authority would supervise assessments, investigate incidents and run sandboxes alongside existing sectoral regulators.
Several design choices deserve credit. The scope excludes personal use and systems used solely for national defence or security. The paper proposes a supervised AI sandbox so startups can test systems without the full weight of regulation at once. And it anchors the framework in five principles: human dignity, transparency and explainability, accountability, safety and security, and data governance.
Three risks stand out.
- A broad harm trigger. The alert says base harm categories include contravention of "any written law." If that is the test for high risk, almost any AI system could be swept in, because nearly any business activity can touch some statute. A risk tier that includes everything protects no one and burdens small firms most.
- Near-miss reporting. The paper would require developers and deployers to report incidents including near misses, not only harms that occurred. That is useful for learning, but without clear thresholds it invites over-reporting and creates compliance work that large firms can absorb and startups cannot.
- Extraterritorial reach. The bill would apply to systems used by a deployer established in Malaysia regardless of where they are hosted. That is defensible, but it requires the regulator to coordinate with other jurisdictions or risk making Malaysia a harder market to serve than its neighbours.
None of these is fatal. All are fixable by drafting. They are exactly the points where industry and civil-society submissions should bite.
What the extra months should buy
The 317 submissions are the useful part of the delay. The consultation closed on 31 July, and the draft is reportedly finished. Whether it reflects the feedback is what matters, and Malaysians cannot tell yet, because the revised text has not been published. Three commitments would make the delay worthwhile:
- Publish the revised draft and a response to submissions before the Dewan Rakyat debate, so legislators and the public can see what changed and why.
- Narrow the high-risk tier to defined, evidence-based use cases with named harms, rather than a general test tied to any written law.
- Write sandbox access and incident-report thresholds into the statute, not leave them to later guidance, so small firms can plan around them.
Malaysia has a credible digital-economy ambition, and proportionate rules can support it by giving investors clarity without freezing experimentation. A bill that arrives in early 2027 with a tight risk definition and a working sandbox would beat a rushed 2026 bill that treats every algorithm as a hazard. The test now is whether the Cabinet review and the tabling preserve the proportionate parts of the July paper or trade them for breadth.