Global AI lawNo AI-specific law — data-protection, cyber-security and online-safety law bind

AI Laws in Malaysia

Malaysia has not enacted an AI statute, and that is a measurement over the whole register rather than a summary: the Attorney General’s Chambers publishes the complete Laws of Malaysia series as its own PDF export, and the words “artificial intelligence”, “kecerdasan buatan” and “algoritma” appear nowhere across roughly 700 principal Acts — nor anywhere in the separate Amendment Acts series. Malaysia established a National AI Office in December 2024 and MOSTI published National Guidelines on AI Governance & Ethics in 2024, both of which are policy and neither of which creates an obligation. What binds a business deploying AI in Malaysia is the digital stack that does exist: the Personal Data Protection Act 2010 (Act 709), whose seven Personal Data Protection Principles — General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access — govern any personal data used to train or run a system, and which was significantly amended in 2024; the Cyber Security Act 2024 (Act 854), which imposes duties on entities running National Critical Information Infrastructure; the Online Safety Act 2025 (Act 866), which regulates harmful online content and applies to platform providers; the Communications and Multimedia Act 1998 (Act 588), under which the MCMC licenses and regulates network and content services; and the Computer Crimes Act 1997 (Act 563).