Malaysia has passed the Artificial Intelligence Regulation Bill 2025, a comprehensive 92-article statute that will take effect on 1 July. The legislation, which emerged from a 14-hour parliamentary debate concluding early Thursday, marks the first legally enforceable artificial intelligence framework in Southeast Asia. Its development followed a year of closed-door sessions involving the Digital Ministry, industry stakeholders, and international law firms.
The law applies across the entire AI ecosystem, from data centers that train models to consumer applications. Foreign providers are not exempt; any AI system offered to Malaysian users must have a locally incorporated entity assuming legal liability.
Cloud service providers that lease graphics processing units must still ensure their customers submit required risk disclosures. Digital Minister Gobind Singh Deo stated after the vote that those earning revenue in the country must follow domestic rules. The regulatory framework classifies AI systems into four risk categories: minimal, limited, high, and unacceptable. Minimal-risk applications, such as spam filters and basic chatbots, require only a one-time registration.
High-risk systems—including credit-scoring tools, medical imaging software, and mass-market generative models—must undergo conformity assessments, maintain internal risk registers, and allow regulators to audit training data with 48-hour notice. Prohibited uses include real-time biometric identification in public spaces, social-credit scoring, and subliminal manipulation.
Penalties for violations are substantial. First-time breaches carry fines of RM 50 million or 5 percent of local revenue, whichever is higher. Repeat or intentional violations double the penalty to 8 percent of annual local turnover.
These penalties apply to firms whose models cause verifiable societal harm. The legislation has received mixed reactions.
The KL Tech Index reached a record high on Thursday, with investors welcoming the regulatory clarity. However, civil-society groups have criticized broad national-security exemptions, arguing they could restrict open research. The law does not specify oversight mechanisms for university laboratory work that falls under security carve-outs.
Malaysia’s move comes as neighboring countries pursue less aggressive approaches. Singapore has issued voluntary guidelines, Thailand continues studying the issue, and Indonesia has draft regulations without a final text.
Malaysia aims to position itself as a regional hub for data centers and AI infrastructure. Enforcement challenges remain. The Digital Ministry has pledged to establish a dedicated AI regulator, but the agency has not yet been created.
The 1 July start date leaves companies limited time to register systems, classify applications, and establish internal risk registers. The 48-hour notice requirement for training-data audits poses particular logistical difficulties for firms operating large language models with extensive document repositories.
Industry observers anticipate a possible grace period, though the current law does not include one.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Malaysia Passes Southeast Asia’s First Binding Artificial Intelligence Law”, “description”: “Malaysia has passed the Artificial Intelligence Regulation Bill 2025, a comprehensive 92-article statute that will take effect on 1 July. The legislation, which”, “datePublished”: “2026-06-22T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Sebastian Smith”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://infopulsetoday.com/wp-content/uploads/sites/4/rehomed/s24/2026/06/companion_1259.jpg”}
