BLOG

Malaysia’s AI Mission: Bringing Together Ambition, Realities, and Legal Frameworks

During a recent coffee break, my Italian PhD colleague turned to me with a friendly smile and said, "I thought of you while reading a feature in Italian media (Corriere della Sera) about Malaysia's exciting plans to become a top ten global powerhouse in artificial intelligence!" As someone living in Brussels, my current research focus has mostly been on the serious side of International Criminal Law, so news from Southeast Asia can sometimes feel a bit distant. But my colleague's comment really attracted my interest and brought it closer to home!

Reading international coverage of Malaysia’s national strategy offers a valuable perspective. Malaysia is currently at a critical turning point. The National AI Action Plan outlines a pathway for the country to become one of the world's top ten AI nations by 2030. This plan aims to contribute 1.2% annually to the gross domestic product and create up to 300,000 high-value jobs directly related to AI (National AI Action Plan 2026-2030, page 14). At the same time, Malaysia is establishing itself as the leading data centre capital in Southeast Asia. However, a candid assessment shows that digital transformation cannot depend solely on technology and foreign investment. Effective leadership means thoughtfully addressing major ecological constraints, ensuring computational sovereignty, and building a strong legal and institutional framework to guide autonomous systems.

Capital Inflows and Talent Value

Malaysia's technological transformation is underpinned by unprecedented capital mobilisation. CNA Insider reported that in 2025, Malaysia accounted for 32% of all AI-related investments across ASEAN, exceeding RM3.3 billion (US$759 million). By mid-2025, cumulative investment applications across the digital and data infrastructure sector eclipsed an astonishing US$35.5 billion. During the first half of 2026, Malaysia recorded RM95.8 billion (US$23.45 billion) in approved investments in data centres and cloud computing, nearly 44% of the economy-wide total of RM218.5 billion (US$49 billion) for the six-month period. This capital wave is rapidly restructuring the domestic labour economy. Unlike historical industrial shifts characterised by low- cost labour assembly lines, the national AI roadmap targets high-skilled intellectual capital. Projections highlight an emerging compensation divide, while the baseline national monthly wage hovers near RM2,900 (approximately €590), entry-level specialised AI engineering roles command roughly RM7,000 (€1,400), and salaries scale to upwards of RM32,000 (€6,400) per month for senior architects and research scientists. This salary premium can help address Malaysia's historical "brain drain" by giving top Malaysian computer scientists, legal scholars, and engineers a strong economic reason to build their careers at home or return to the country.

However, high salaries at the top cannot hide the structural displacement risks facing middle-tier knowledge workers. TalentCorp’s assessments, covering 949 distinct job profiles across ten key economic sectors, show that automation is unlikely to eliminate entire occupations. Instead, it will significantly reshape the tasks within them. In response, public efforts have focused on adult education and expanding access to digital skills. Grassroots initiatives such as AI Untuk Rakyat have introduced hundreds of thousands of citizens to the basics of machine learning, while specialised programs like Jelajah AI MyMahir (JAM) aim to provide 22,000 Malaysians with structured reskilling. Public-private partnerships are also helping to meet this challenge at scale. For example, Microsoft’s AI for MY Future initiative aims to equip 800,000 Malaysians with practical AI skills through interactive modules and hands-on workshops. The central policy message is straightforward: AI may not replace workers outright, but those who know how to use it will have an advantage over those who do not.

The Ecological Challenge, Data Centres, Energy, and Water

The greatest challenge facing Malaysia's digital ambitions lies in the physical infrastructure that supports cloud and computing clusters. Although artificial intelligence may seem like an intangible, cloud-based phenomenon, it depends on vast concrete facilities filled with high-density server racks that require enormous amounts of reliable electricity and cooling water.

Between 2021 and mid-2025, 143 data centre and cloud computing projects, worth RM144.4 billion, were approved, a notable breakthrough. The southern state of Johor has seen much of this expansion, hosting roughly 50% of the nation's data server installations, a report suggested that Johor’s data centre projects could consume 40% of the state’s electricity demand by 2035, an increase of around 24%. The demand for resources is significant. Data centre energy consumption in Malaysia is projected to surge to over 5,000 MW by 2035, i.e., 40 per cent of Peninsular Malaysia’s present power capacity, or 11.1 per cent of Malaysia’s projected power capacity in 2035. Data centres currently consume roughly 7% of Malaysia's total electricity generation capacity. If expansion continues without limits, that figure is projected to reach an extraordinary 31% by 2035. A standard 50-megawatt (MW) hyperscale data facility uses about as much electricity each day as 40,000 households and consumes the daily water volume of 2,600 families for evaporative cooling. Across centres in southern Johor, growing competition for local resources has raised concerns about maintaining grid stability and ensuring reliable municipal water supplies during seasonal dry spells. The administration’s subsequent intervention imposed a moratorium on non-AI data centres and prioritised dedicated AI compute infrastructure to reduce pressure on the national power grid and water supply.

The EU AI Act as a Blueprint and Key Principles of the EU Framework

From my perspective in Brussels, I have been following the exciting developments in European technology policy, and I think there is something Malaysia can learn from them. With the recent enactment of the EU Artificial Intelligence Act (Regulation 2024/1689), the European Union has set up the world's first comprehensive and legally binding framework for artificial intelligence. Instead of waiting for problems to arise in the market or for people to face issues, the EU has taken a proactive approach. They have created a precautionary, risk-based system that aims to foster legal certainty, build consumer trust, and ensure the global market functions smoothly. The AI Act defines 4 levels of risk for AI systems, namely unacceptable risk, high risk, limited risk, and minimal risk. Unacceptable risk refers to a level of danger or potential harm that exceeds legal, regulatory, or ethical boundaries, necessitating immediate prohibition or risk-reduction measures. Systems that pose a clear threat to safety, livelihoods, and individual rights are categorised as having unacceptable risk and are strictly prohibited. Examples of such risks include cognitive-behavioural manipulation (such as voice-activated toys that encourage dangerous behaviour in children), the untargeted scraping of facial images for biometric categorisation, and government social-scoring systems.

The EU AI Act replaces a fragmented patchwork of domestic rules with a single standard.
Businesses gain a clear, long-term framework that supports major capital commitments, with regulatory requirements harmonised across borders. The framework explicitly prohibits systems that present an "Unacceptable Risk." Examples include cognitive-behavioural manipulation, such as voice-activated toys that encourage dangerous behaviour in children, the untargeted scraping of facial images for biometric categorisation, and government social scoring systems. 

AI systems used in critical infrastructure, credit scoring, education admissions, employment shortlisting, and judicial assessment must pass rigorous pre-market conformity assessments. They need high-quality training datasets to prevent bias, comprehensive technical documentation, automatic activity logging, and continuous human oversight. Frontier foundation models must publish detailed summaries of the copyrighted content used to train them, ensure generated content carries a legible watermark to help tackle deepfakes, and disclose technical performance metrics. Recognising that heavy compliance burdens can disadvantage emerging enterprises, the EU framework requires regulatory sandboxes: supervised testing environments where startups can trial novel algorithms before commercialising them at full scale.

Algorithmic Accountability, Countering Rogue Agents and the Role of AI Forensics

The discussion about AI risks has really grown lately. In both Europe and the United States, there is a big focus on what is called Agentic AI. This refers to smart systems that can operate autonomously, performing tasks such as planning, using various tools, handling financial transactions, and making decisions with minimal human intervention. 

Recent investigations launched in the United States and inquiries within the European Union follow instances where autonomous agents exhibited unanticipated behaviours: executing unauthorised trades, fabricating data trails, or evading internal policy controls. When an algorithmic agent operates autonomously, determining proximate cause and civil liability becomes extraordinarily complex.

To help prevent serious system drift, regulators are taking a closer look at statutory safeguards. One example is the "Kill Switch" Architecture, where mandatory structural backdoors and hardcoded operational overrides let human supervisors quickly cut off an agent's network access and execution permissions if it begins to drift or cross established boundaries.

The lack of independent watchdogs that audit algorithms is also clear. In Europe, non-profit technical organisations such as AI Forensics help shed light on difficult algorithms by investigating and reverse-engineering them, uncovering platform manipulation, bias, and automated disinformation across major platforms. Malaysia currently lacks an equivalent domestic mechanism. Without independent civil society and academic research institutes equipped to conduct forensic audits on live algorithms, the public remains reliant on corporate assurances. Establishing a domestic technical audit ecosystem is vital to holding both multinational tech companies and localised sovereign platforms publicly accountable.

A Legal and Institutional Blueprint for Malaysia 

To pursue its economic vision responsibly, Malaysia can build a legal framework tailored to its needs, one that supports innovation while providing strong institutional safeguards. Relying solely on piecemeal provisions in the Personal Data Protection Act (PDPA) or broad executive guidelines is unlikely to be enough.

First, the Malaysian Government must codify a dedicated "Malaysian Artificial Intelligence Act". The Parliament should advance a comprehensive statute adapting the best elements of the EU AI Act's risk-tiered framework to Malaysia's socio-economic conditions. The Government must prohibit automated systems that undermine constitutional liberties, enact arbitrary social scoring, or conduct indiscriminate mass biometric profiling, and subject high-risk applications, such as automated hiring portals, to mandatory pre-deployment auditing, robustness testing, and continuous human oversight.

Next, the establishment of AI Malaysia Berhad and the Malaysia AI Safety Institute represents an important foundation. However, their mandates must be elevated beyond executive coordination. Give the agency independent regulatory oversight, the ability to issue administrative subpoenas, and clear statutory authority to audit models, impose fines for non-compliance, and require non-compliant deployments to stop immediately.

The Personal Data Protection Act would benefit from targeted reforms to better address automated processing. The Malaysian government should introduce safeguards for cross-border data transfers to help ensure that personal records are not processed in foreign jurisdictions without equivalent privacy standards. It should also establish statutory algorithmic rights, giving citizens the right to receive meaningful explanations when automated systems make significant administrative or economic decisions.

Moreover, more safeguards are needed to protect Malaysian journalists, creative artists, and cultural custodians from having their copyrighted output harvested without remuneration or consent. Formulate clear statutory definitions of ownership of works produced by autonomous systems versus those produced by human-assisted generative workflows, thereby establishing legal certainty for commercial enterprises.

Lastly, to help translate technological advances into broader social progress, modern employment policies should account for automation. Consider updating the Employment Act to require reasonable notice and consultation when automated platforms may lead to significant organisational restructuring.

Conclusion

When my colleague first shared Malaysia’s AI ambitions over coffee here in Brussels, I was struck by how closely our technological futures are connected. The data centres and cooling towers taking shape across Johor are rooted in local priorities, while the need to govern the autonomous systems they support reaches far beyond national borders. By drawing on comprehensive frameworks like the EU AI Act, not simply copying them, but adapting their lessons into a sovereign legal blueprint, Malaysia can make its digital leap both economically competitive and institutionally secure. Becoming a top-ten AI nation will take more than attracting foreign investment and building computing capacity; it also requires thoughtful legal preparation to protect citizens in an increasingly automated world.

Reference

1) 'Agentic AI, Explained' (MIT Sloan) <https://mitsloan.mit.edu/ideas-made-to-matter/agentic-ai-explained

2) Biji-biji Initiative, 'Microsoft AI Teach' (Biji-biji Initiative) <https://biji-biji.com/microsoft/microsoft-ai-teach/#

3) 'Building Resilience Through Localisation: Malaysia’s Next Chapter' (Malaysian
Investment Development Authority) <https://www.mida.gov.my/building-resilience-
through-localisation-malaysias-next-chapter/

4) 'Civil Liability for the Actions of Autonomous AI in Healthcare: An Invitation to Further
Contemplation' (2024) Humanities and Social Sciences Communications
<https://www.nature.com/articles/s41599-024-02806-y

5) 'Community-Based AI Training to Benefit Over 22,000 Nationwide, Says Ramanan' The Star (17 January 2026) <https://www.thestar.com.my/news/nation/2026/01/17/community-based-ai-training-to-benefit-over-22000-nationwide-says-ramanan

6) Congressional Research Service, Data Centers and Their Energy Consumption: Frequently Asked Questions (CRS Report R48646) <https://www.congress.gov/crs_external_products/R/PDF/R48646/R48646.1.pdf

7) Corriere della Sera Sette (25 September 2026) via PressReader <https://www.pressreader.com/italy/corriere-della-sera-sette/20260925/281968909606866

8) 'Data Centers and AI Energy Consumption: The Surge in Electricity Demand' (Global
Electricity) <https://www.globalelectricity.org/data-centers-energy-consumption/

9) 'Data Centre Electricity Use Set to Surge to 31% by 2035' The Sun <https://thesun.my/news/malaysia-news/people-issues/data-centre-electricity-use-set-to-surge-to-31-by-2035/

10) 'Data Centres in Malaysia’s Johor Told to Wait for Water "Until Mid-2027"' South China Morning Post <https://www.scmp.com/week-asia/health-environment/article/3333109/data-centres-malaysias-johor-told-wait-water-until-mid-2027

11) Digital 2030 (MD2030) | Towards an AI Nation' (MyDigital) <https://www.mydigital.gov.my/#

12) 'Electricity Consumption of Data Centres Expected to Surge to 31 Pct by 2035' BERNAMA <https://www.bernama.com/en/news.php?id=2575423

13) 'Europe's Banks Bet on AI, but Regulators Warn of Mounting Risks' The Brussels Times <https://www.brusselstimes.com/eu-affairs/2343902/europes-banks-bet-on-ai-but-
regulators-warn-of-mounting-risks

14) Government of Malaysia, AI Nation 2030: National AI Action Plan 2026–2030 (2026)
<https://strapi.naio.okie.my/uploads/AI_Nation_2030_National_AI_Action_Plan_2026_20
30_Eng_V_290726_49cb382621.pdf

15) 'Intelligent Financial System: How AI is Transforming Finance' (2025) ScienceDirect
<https://www.sciencedirect.com/science/article/abs/pii/S1572308925001019

16) 'JB Data Center Expansion' (Wood Mackenzie) <https://www.woodmac.com/press-
releases/jb-data-center-expansion/

17) Liu NP, 'The Governance Operating System: A Physical Constitution for Sovereign Cyber- Physical AI, Part III - Division of Labour, Supervision, and the Edge-Cloud Split' (2026) SSRN Working Paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7410598

18) 'Malaysia’s Next Phase of Growth: From Regional Data Centre Hub to a Sustainable
Regional AI Compute and Data Centre Hub' The Edge Malaysia <https://theedgemalaysia.com/content/advertise/malaysias-next-phase-of-growth-from-regional-data-centre-hub-to-a-sustainable-regional-ai-compute-and-data-centre-hub

19) Microsoft, 'ASEAN Foundation, Biji-biji Initiative, and Microsoft Collaborate to Shape an AI-Enabled Economy for Malaysia Through AI TEACH Malaysia Program' (Microsoft
Malaysia News Center, 8 February 2024) <https://news.microsoft.com/en-my/2024/02/08/asean-foundation-biji-biji-initiative-and-microsoft-collaborate-to-shape-
an-ai-enabled-economy-for-malaysia-through-ai-teach-malaysia-program/

20) Microsoft, 'Microsoft Launches Initiative for AI Skilling Opportunities for 800,000
Malaysians by 2025' (Microsoft Malaysia News Center, 10 December 2024) <https://news.microsoft.com/en-my/2024/12/10/microsoft-launches-initiative-for-ai-skilling-opportunities-for-800000-malaysians-by-2025/

21) Ministry of Digital Malaysia, 'AI Malaysia Pemacu Utama Menuju Negara AI 2030'
(Ministry of Digital) <https://www.digital.gov.my/en-GB/siaran/AI-Malaysia-Pemacu-Utama-Menuju-Negara-AI-2030

22) 'Non-AI Data Centre Investments Curbed Over Water, Energy Concerns, PM Tells Dewan Rakyat' The Edge Malaysia <https://theedgemalaysia.com/node/793763; accessed 4 October 2026.

23) 'Opinion — Malaysia’s Data Centre Boom: From Investment Surge to Sustainable Growth' The Edge Malaysia <https://theedgemalaysia.com/node/809202

24) 'PM: Govt Restricts Non-AI Data Centre Approvals Over Energy, Water Concerns' New Straits Times (13 February 2026) <https://www.nst.com.my/news/nation/2026/02/1384108/updated-pm-govt-restricts-non-ai-data-centre-approvals-over-energy

25) Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L1689

26) Saini S, 'Why Are AI Data Centers Using So Much Electricity?' (TED-Ed) <https://ed.ted.com/lessons/why-are-ai-data-centers-using-so-much-electricity-sajan-saini

27) Singapore Consensus 2026 (2026) <https://aisafetypriorities.org/files/Singapore_Consensus_2026.pdf

28) TalentCorp Malaysia, Impact Study of Artificial Intelligence, Digital and Green Economy on the Malaysian Workforce: Volume 1 <https://www.talentcorp.com.my/images/uploads/publication/192/Impact-Study-of-Artificial-Intelligence-Digital-and-Green-Economy-on-the-Malaysian-Workforce-Volume-1-1750748111.pdf

29) 'U.S. FTC Opens Industry Probe Into Risks From Autonomous AI Agents' BPDATA AI
News <https://news.bpdata.com/article/u-s-ftc-opens-industry-probe-into-risks-from-autonomous-ai-18aa4570

30) 'Who’s Liable When AI Agents Go Rogue?' MIT Technology Review (28 September 2026) <https://www.technologyreview.com/2026/09/28/1145197/whos-liable-when-ai-agents-go-rogue/