From Studying Models to Running One
For years, Malaysia's International Regulatory Conference was a venue for comparing notes — Malaysian officials sat across from European, Singaporean and Australian counterparts and asked how other jurisdictions handled online harms. At IRC 2026, held July 21-22 at the Shangri-La Kuala Lumpur under the theme "Shaping the Next Digital Era: Regulation, Resilience and Trust," that posture flipped. As MCMC Deputy Managing Director Eneng Faridah Iskandar put it, referencing earlier editions of the conference: "When the IRC was first held, online safety was among the issues most frequently discussed, and at the time we did not yet have the ONSA" — the Online Safety Act 2025, or Act 866 (Bernama). Act 866 received royal assent on 6 May 2025, was gazetted on 22 May 2025, and took effect 1 January 2026 (MCMC). IRC 2026 was the first edition to showcase not a proposal but a functioning enforcement regime.
The Machinery: Deadlines, Fines and a Man-Hour Problem
Act 866 and its six subsidiary Period Regulations impose some of the tightest content-moderation clocks in the region. Priority harmful content — child sexual abuse material and financial fraud — must be made inaccessible immediately upon a rejection decision and, once confirmed, permanently removed within one hour; other harmful content gets four and twelve hours respectively. Platforms have one hour to acknowledge user reports and twelve hours to complete an initial assessment. Breach of the core Part III safety duties carries a civil penalty of up to RM10 million; missing a takedown deadline or ignoring a written MCMC instruction adds fines up to RM1 million plus RM100,000 per day of continuing non-compliance, with personal liability reaching directors and compliance officers who cannot show due diligence (Mayer Brown).
The scale of what MCMC itself has processed under this regime is the headline number from IRC 2026: from 1 January to 1 July 2026, the commission actioned 345,712 pieces of harmful content, roughly 91% of it gambling and scam material generated on repeat by the same criminal networks. Communications Minister Fahmi Fadzil told reporters that at 30-45 minutes of documentation per request, that volume consumed the equivalent of 19.7 years of staff time (The Star) — a burden he is now explicitly trying to shift onto platforms themselves, pushing them toward automated detection rather than MCMC-initiated referrals.
Steelman: Why Malaysia Built It This Way
The case for this design is not frivolous. Financial-fraud content and CSAM are precisely the categories where speed of removal correlates directly with harm prevented — a scam ad left up for 48 hours can drain victims' savings before any appeal process would matter, and MCMC's own numbers show the fraud/gambling problem is the dominant share of what regulators are fighting, not a marginal one. A regime that leaves takedown timing to platform discretion, as most Western frameworks effectively do, risks the same drift into slow-walked compliance that has already drawn criticism elsewhere: EFF and ARTICLE 19 have pushed the European Commission for clearer, less discretionary process in the EU's own DSA trusted-flagger mechanism, precisely because vague timelines let platforms under-enforce (EFF). Malaysia's answer — hard hourly deadlines backed by real fines — is a legitimate response to a genuine enforcement gap, not regulatory theater.
The Proportionality Question
But the mechanics MCMC itself is now complaining about are the strongest evidence the current design is miscalibrated. A regulator spending 19.7 years of cumulative staff time filing takedown paperwork is not a sign of a well-functioning statute; it is a sign that the enforcement burden was placed on the wrong party for the law's first six months and is only now being corrected. The RM10 million ceiling and the RM100,000 daily accrual are steep enough to functionally exclude smaller platforms and regional competitors from serving the Malaysian market at all, entrenching incumbents with compliance departments large enough to absorb one-hour SLAs — the opposite of the open, competitive digital economy MyDigital was built to foster. Minister Fahmi's own framing at IRC 2026 conceded the tension: "We do not want to give the signal that we are against technology or investment. But we want technology and investment that not only bring benefits, but also prevent harm" (FMT). That balance is achievable, but a one-hour permanent-removal clock backed by personal director liability is a blunt instrument for getting there — particularly absent any published data on wrongful-takedown or appeal rates that would let outsiders judge whether speed is coming at the cost of accuracy.
What Comes Next
The fix Fahmi is already gesturing toward — shifting detection onto platform-side AI systems rather than MCMC-initiated referrals — is the right direction, but it needs to be paired with published accuracy metrics and an appeals mechanism robust enough to survive hour-long deadlines, not just deadlines fast enough to survive scrutiny. Malaysia has genuinely moved from studying global models to running its own; the next test of Act 866 is whether MCMC can show that speed, scale and proportionate treatment of smaller platforms are all improving together — not just the takedown count.