By Farlina Said, Institute of Strategic and International Studies (ISIS) Malaysia
At a glance
- Online Safety and Data Governance Transition to Implementation: The Online Safety Act became effective in January 2026, accompanied by subsidiary regulations and new statutory codes. Meanwhile, revised data protection guidelines and cybersecurity measures are evolving existing frameworks into more actionable responsibilities for organisations and digital platforms.
- AI Governance Moves Towards Formal Regulation: Malaysia is advancing from general AI principles to a more structured regulatory framework. The AI Governance Bill is anticipated by the end of 2026.
- Domestic Digital Capability Becomes Strategic Priority: Enhancing domestic digital capabilities has emerged as a crucial focus area. Malaysia Digital 2030, AI Nation 2030, and the third phase of the Malaysia Digital Economy Blueprint focus more on fostering domestic innovation, nurturing talent, enhancing computing capacity, and promoting local technology development.
Share this insight
2026 began with challenges to global economic growth, driven by escalating conflict in West Asia. Energy shocks, inflation caused by rising fuel and electricity prices, and disruption in supply chains would reportedly dip global growth to the lowest rate since Covid-19, according to the World Bank. In Malaysia, austerity measures were announced by Prime Minister Anwar in March 2026, which included limitations to government spending, overseas travel and an encouragement for work-from-home arrangements.
In light of these economic challenges and the desire to spur development, Malaysia’s approach to tech governance has evolved from establishing frameworks to focusing on formal regulations and operational implementation. Laws that were introduced or amended in prior years have started to take effect and are being complemented by new guidelines and implementation measures in various areas such as online safety, data protection, and cybersecurity. At the same time, two strategies launched in the first half of 2026, Malaysia Digital 2030 and the AI Nation 2030 Action Plan, signal a growing effort to enhance Malaysia’s local technological capacity within a globally connected digital economy.
Key Policy Trends
AI Governance: Moving Towards Formal Regulation
Malaysia is moving from AI strategies and principles towards a more formal governance structure. The AI Nation 2030 Action Plan has the goal of achieving up to 1.2% incremental gross domestic product (GDP) growth attributable to AI and supporting the creation of up to 300,000 new jobs. It galvanises approaches to maximise impact of AI to benefit society and the economy.
In line with this strategic direction, the AI Governance Bill is expected to see the light of day by the end of 2026. The AI governance bill is expected to introduce a principles-based and risk-based approach though mechanisms for enforcement are still being consolidated. A public consultation paper released in July touts a sectoral-based approach. If enacted, the framework is intended to complement existing laws, provide greater legal and regulatory clarity, and foster responsible, trustworthy AI innovation.
Cybersecurity and Data Protection: Consolidating Operational Readiness
The country is enhancing the execution of its cybersecurity and data protection framework, focusing more on operational readiness and essential standards for organisations and critical infrastructure. Malaysia enters the third phase of the Malaysia Digital Economy Blueprint, which focuses on “Made by Malaysia” goals that could position the country as a leader in digital content and cybersecurity services in the regional market. This continues from earlier phases that builds infrastructure, strengthens legislative frameworks for cybersecurity and data sharing, as well as prepares the government to be adopters and regulators of digital technology. The Blueprint, shaped during pandemic and written prior to the mass commercialisation of OpenAI’s ChatGPT, is complemented by the Digital Action Plan 2030 also known as Malaysia Digital 2030 (MD2030). MD 2030 added trust and security as a strategic thrust for digital economy development to the Malaysia Digital Economy Blueprint iteration. The addition could be a reflection of Malaysia’s current legislative frameworks to govern digital spaces.
In cybersecurity, efforts are under way to complete the baseline among critical infrastructure operators while an updated cyber crisis management plan was circulated in early 2026. This ties into the latest National Cyber Security Strategy which has the goal of building cyber resilience and safeguarding Malaysia’s national interest as the 2025-2030 objective. Legislative reform is also continuing. The Cyber Crime Bill was passed mid-2026 to replace the Computer Crimes Act 1997. The Bill addresses contemporary and emerging threats driven by rapid advancement of technologies, including cross-border cybercrime.
On data protection, following amendments to the Personal Data Protection Act in 2025, Personal Data Protection Commissioner’s release of three guidelines in April 2026. The Data Protection Impact Assessment (DPIA) Guideline helps organisations identify and manage risks associated with their personal data processing activities. The Data Protection by Design (DPbD) Guideline sets out how data controllers and data processors can apply the DPbD approach. The Automated Decision-Making and Profiling (ADMP) Guideline provides guidance on automated decision-making and profiling, including appropriate safeguards. These documents translate the amended PDPA’s accountability orientation into more practical expectations for organisations.
Digital Platforms: Translating Online Safety Rules into Platform Obligations
Malaysia is moving from broad statutory requirements on online safety towards more prescriptive obligations for digital platforms. Social media platform governance, empowered by the Online Safety Act and the Communications and Multimedia Act have moved towards prescriptive codes to strengthen online safety mechanisms for risk and children.
The Online Safety Act 2025 (Act 866) came into effect on 1 January 2026, alongside four subsidiary instruments. The Online Safety (Period) Regulations describe timelines for compliance actions and responses. The Online Safety (Fees) Regulations establish fee structure for applicable communications and multimedia service providers. The Online Safety (Form of Undertaking) Regulations outlines formal commitments that service providers might require to submit to the Malaysia Communications and Multimedia Commission (MCMC). The Online Safety (Online Safety Appeal Tribunal) Regulations lays out the processes for appealing certain regulatory decisions. At a high level, the regime requires platforms to manage risks associated with harmful content and to establish operational mechanisms. These include user-safety guidance, reporting and assistance channels, safeguards for child users, procedures to render priority harmful content inaccessible.
Furthermore, a risk mitigation code and child protection code were introduced this year by MCMC under the same Act, while the safety codes around instant messaging recently closed for public consultation. These statutory codes require licensed providers to take stronger precautions against harmful content, scams, and manipulated media. Therefore, it connects content governance with cyber-fraud prevention, information integrity, and user protection.
These developments suggest that the country is advancing towards more detailed expectations for how providers identify, mitigate and respond to online harms.
Cross-cutting Governance Trends
Capability Building: Strengthening Domestic Digital Capability
Above policy development suggests Malaysia focuses more on strengthening domestic digital capability while remaining closely integrated with global technology markets and investment flows. The “Made by Malaysia” goals, set out in the third phase of the Malaysia Digital Economy Blueprint, aim to transition the country from digital consumer to producer, including by positioning the country as a leader in digital content and cybersecurity services in the regional market. Furthermore, this ambition is reinforced by Malaysia Digital 2030 and AI Nation 2030. The MD 2030 places greater emphasis on domestic innovation, talent and technological capability, while the AI National 2030 seeks to strengthen national AI capability by expanding computing access, creating governed national datasets, and enabling domestic AI models.
Global Integration: Balancing Foreign Investment and Domestic Capability
This domestic capability-building agenda is being pursued within a digital economy that is significantly connected to international investment. A Malaysia Digital Economy Corporation (MDEC) white paper in assessing the vibrancy of Malaysia’s digital economy, breaks down registered Malaysia Digital status companies into three clusters: global business services, infotech and creative content and technologies. It indicated that investments in the global business services (GBS) cluster are heavily driven by foreign firms. Differences in figures for investments between the largely foreign-dominated firm category and domestic players can be rather stark as GBS which positions Malaysia as a destination for outsourced or shared services earns RM288.05billion in investment between 2H 2022 and 2H 2025 while collectively, the infotech and creative content clusters amount to RM53.53billion. At the same time, inflows of foreign and domestic investment and sustained demand in AI, data centre and semiconductor contributed to Malaysia’ resilient first quarter of 2026, thus cementing the digital economy and ICT-related activities as a contributor to Malaysia’s economic performance. This creates a tension between pursuing economic growth and building local champions.
Digital Infrastructure: Strengthening Resilience for Continued Growth
The rapid expansion of the country’s digital economy is also adding a further challenge to the digital infrastructures that sustain the growth. In early 2026, Malaysia’s largest utility company, Tenaga Nasional Bhd (TNB), stated that 36 data centre projects are in operation with 23 projects in varying stages of completion. This translates to differing assessments of resource consumption where Minister of Energy Transition and Water Transformation, Datuk Seri Fadillah Yusof mentioned that as of April, data centres were consuming 54% of approved electricity consumption capacity and 51.4% of approved water demand. These pressures highlight that strengthening domestic digital capability also requires sufficient energy, water and infrastructure resilience to support continued digital growth.
Moving Forward
In the first half of 2026, Malaysia took steps toward establishing more formal regulations and operational guidelines in key areas like online safety and data protection, while the governance of AI was still in the initial phases of regulatory development. Additionally, the first half 2026 also featured policies to entrench foundations for Malaysia’s future digital economy activities
Looking ahead, the second half of 2026 would see greater clarity on AI governance structures while tensions between building domestic innovation capability will still draw tensions with reliance on foreign services and operators. In some ways, sovereignty could be a theme for the second half of 2026, though its definition would not be in the forms of building closed ecosystems or fully indigenous ecosystems. Rather, the AI Nation imagined has to be fortified by local players to diversify overdependence.
The views and recommendations expressed in this article, published in September 2026, are solely of the author and do not necessarily reflect the views and position of the Tech for Good Institute.
