National Guidelines on AI Governance and Ethics
Malaysia · Guideline · Ministry of Science, Technology and Innovation
Our summary
These guidelines establish responsible AI practices for Malaysia aligned with the National Artificial Intelligence Roadmap 2021-2025. They apply to three main stakeholder groups: end users, government policymakers, and technology developers, requiring adherence to seven principles including fairness, reliability, privacy, inclusiveness, transparency, accountability, and pursuit of human benefit in the development and deployment of AI systems.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
19 sections
Jump to a chapter
Section 2 Understanding AI
This section serves as the introductory chapter covering foundational concepts including the case for AI adoption in a transforming world, ethical considerations, trust-building, global and national perspectives on responsible AI, and the concept of human-friendly AI platforms.
Section 1 Introduction
Section 3 National Guidelines For Stakeholders
This section outlines guidelines structured in three parts addressing different stakeholders: end users of AI systems, policymakers in government and organizations, and industry sector players including developers and technology providers, with each part specifying relevant principles and actions.
Section 4 Benchmarking And
This section covers policy guidance for government policymakers, including responsible AI principles, appropriate actions, the role of independent advisory bodies, and alignment with sustainable development and environmental, social, governance goals.
Part C National Guidelines For Developers
4 sections
This section provides guidelines for sector players in technology development and supply, including introduction to their role, responsible principles, permitted actions, sector case demonstrations, codes of ethics, and alignment with sustainability and corporate responsibility objectives.
Section 5 Conclusion
Malaysia's National Guidelines on AI Governance and Ethics commit the country to responsible AI deployment aligned with international standards and incorporating fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability, with consumer rights including objection, explanation, data deletion, and collective remedies. The guidelines establish practices for AI development and deployment encompassing systems that learn, reason, process language, and perceive through techniques such as learning algorithms, language processing, robotics, and vision systems, aligned with Malaysia's National Artificial Intelligence Roadmap 2021-2025 and aiming to benefit society, government, and industry. These guidelines will be updated as technology and ethical standards evolve.
Section 1 Introduction
The guidelines address AI's expanding role across society, with generative AI defined as technology creating new content from learned patterns. They were developed with seven key considerations: ensuring public inclusion, building trust through responsible governance, maintaining simplicity, aligning with national, regional and global practices while drawing on local knowledge, reflecting inter-agency and stakeholder coordination, serving as a reference for sector-specific guidelines, and remaining a living document regularly reviewed and updated in Malay and English. The guidelines aim to support the Malaysia National AI Roadmap 2021-2025, facilitate Responsible AI according to seven AI Principles, build trustworthiness in AI, manage risks from developing and deploying AI technology, and maximize AI's benefits for national productivity, economic growth and competitiveness.
Section 2 Understanding AI
This section introduces AI terminology, development, and real-world applications in Malaysia, identifies ethical risks and trust deficits from a 2021-2022 study where 87% of respondents disagreed that AI applications are secure, 84% that users and consumers have privacy safeguards, 84% that there is dedicated governance structure, and 92% that policies address AI development, and outlines seven responsible AI principles (fairness, reliability and safety, privacy, transparency, inclusiveness, human benefit, and accountability) that developers and deployers are encouraged to adopt voluntarily alongside existing laws, with requirements including avoiding bias, ensuring safe and fail-safe operation, obtaining consent before using personal data, disclosing AI system use in decisions with training data characteristics and biases, providing equitable access and benefit for all stakeholders and vulnerable groups through inclusive development and culturally sensitive tools, and enabling human oversight and accountability in compliance with regulations and ethical principles. The guidelines ground these principles in Malaysian Rukun Negara values and Islamic teachings, and introduce implementation support platforms including KRSTE.my for knowledge management, MyGDX for data integration, and MOSP for research data accessibility, with AI untuk Rakyat as an online awareness programme.
Section 3 National guidelines for stakeholders
A shared responsibility framework organizes national guidelines around three stakeholder groups-end users (individuals and organizations using AI products), policy makers (government officials responsible for formulating AI policies and ensuring ethical practices), and developers-where single entities may hold multiple roles; the guidelines establish clear delineation of roles and responsibilities while raising stakeholder awareness of responsible AI use and their rights. AI ethics addresses moral issues in the development, use and impact of AI to prevent problems from unethical design, misuse or wrong application, drawing in Malaysia's context from the Rukun Negara national principles and religious teachings emphasizing compassion, justice and fairness, which must adapt to contemporary challenges.
Part A A2.0 responsible AI for the end users
These guidelines establish seven AI principles for responsible AI use including fairness, reliability and safety, privacy and security, and inclusiveness to prevent discrimination and ensure equal benefit distribution. Consumers must have rights to information, object to processing, receive explanations, data deletion, human interaction instead of AI, compensation for damages, collective redress in court, and complaint or legal action options; companies and developers must immediately disclose generative AI use, obtain explicit user consent for training on personal data, establish quality standards and liability for harmful outputs, and maintain ethical guidelines and bias checks. AI governance requires policymakers to identify key stakeholders, align with national strategy through vertical coordination bodies like BNM, SC, MOHE, MoH, and Ministry of Communication and horizontal bodies like AG, JPDP, NACSA, monitor and enforce compliance, safeguard personal data through privacy laws and secure storage, prevent monopolies, manage job displacement, establish standards for safe and reliable systems in critical areas like healthcare and finance, and distribute economic benefits equitably while building public trust and aligning with international standards.
Part B Translating and Implementing the 7 AI Principles of Responsible AI
Policymakers and organizations should implement seven principles of responsible AI-fairness through unbiased data collection and bias audits, reliability through certification standards, privacy through data protection laws and informed consent, inclusiveness through diverse representation and community impact assessment, transparency through disclosure of algorithms and data sources, accountability through legal frameworks and clear job assignments, and pursuit of human benefits through ethical guidelines-supported by data governance frameworks managing organizational data assets and data ethics frameworks that ensure transparent data handling, prior approval before data collection, strong protective measures, compliance with privacy laws, and protection of personal information rights. Open-source data sharing with protected sensitive information supports continuous improvement of AI datasets, enables detection of biases and malfunctions, reduces legal liabilities, and enhances cybersecurity, while all AI implementation in Malaysia must follow ethical standards and existing laws to protect stakeholder rights including privacy, equal treatment, and communication freedoms, and to ensure AI systems in critical sectors including healthcare, manufacturing, transport, urban development, and justice are safe, trustworthy, and answerable.
Appendix 2 Responding to the Global Calls
Appendix 3 Example of Related Law to Support Responsible AI
Appendix 4 Standard for Responsible Development, Deployment
This appendix lists 24 ISO and ISO/IEC technical standards covering AI system life cycle processes, performance assessment, risk management, trustworthiness, bias, robustness, ethical concerns, governance, quality, management systems, and related big data standards that organizations may reference for responsible AI development and deployment.
Appendix 5 Sample Standard Matrix to Mitigate Risks
This appendix presents five types of standards - analytic and research, legal and regulatory, moral and ethical, technical and industry, and data and information security - and explains how each category of standards can be applied to reduce adversary risks by enhancing explainability, governance, fail-safes, technical specifications, and data protection in AI systems.
Appendix 6 Overview of the RAIIA Tools Used for Responsible AI Impact
Appendix 7 Example of Performance Index for Each AI Principle
This appendix illustrates seven performance indices for assessing AI systems: an inclusiveness index measuring training data and development team diversity, a fairness index evaluating outcome distribution across demographic groups, a transparency index examining documentation and disclosure, a privacy index gathering user feedback on privacy experiences, a safety index assessing environmental factors, an accountability index reviewing compliance throughout the AI lifecycle, and a human-centered and happiness index measuring urban well-being factors.
Appendix 8 Example of Code of Ethics
Developers and adopters of AI must ensure fair treatment, transparency, employee privacy, and freedom from bias in the workplace; include safeguards against uncontrolled behavior and meet legal safety requirements in health and safety contexts; and maintain strong safety practices and appropriate testing. They must identify potential biases, scrutinize training data sources, check for discrimination based on protected characteristics, maintain data protection and cybersecurity, ensure human oversight, monitor AI regularly, understand AI decision-making, protect confidential information and intellectual property, and respect privacy and personal data rights through staff training and vendor requirements. AI systems using personal data must comply with applicable data protection laws such as the GDPR, which grants data subjects a right not to be subject to decisions based solely on automated processing including profiling that produces legal effects; developers must apply security measures like encryption and access controls and be transparent by explaining decisions to users and disclosing when they are interacting with AI.
Appendix 9 Example of Performance Index for Each AI Principle
The section provides example metrics for assessing AI systems across multiple dimensions: demographic parity and distribution of outcomes across groups for fairness; diversity in training data and development teams for inclusiveness; user feedback and consent for privacy; examination of proper functioning throughout the AI lifecycle for accountability; availability of comprehensive documentation and disclosure of capabilities for transparency; and environmental and urban quality factors for safety and human-centered happiness.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.