When a company connects an AI model to business data, it needs a clear way to oversee how that system operates. If an output causes a problem, the team should be able to investigate what happened, contain the impact and decide what to change.
Malaysia's proposed AI Governance Bill brings these questions into focus. On 29 October 2026, Digital Minister Gobind Singh Deo told the Dewan Rakyat that the Bill had been completed and would be submitted to the Cabinet in the near future, with tabling planned for early 2027, Bernama reported.
The final text has not been published. What follows draws on the public consultation the National AI Office ran in July 2026, so details may change before the Bill reaches Parliament. For an overview of the proposed risk tiers and the bodies that would oversee them, see our earlier piece on the Bill.
Developers and deployers
The consultation distinguishes between developers and deployers. Developers materially shape an AI system's capabilities or behaviour, including through training, adaptation, integration or modification. Deployers decide how the system operates in practice, including its configuration, monitoring and suspension.
A company using a third-party AI system may fall within the proposed deployer role. If its integration work materially shapes the system, it may also fall within the developer role. Using an external model does not, by itself, determine the company's classification.
Rahmat Lim & Partners' analysis of the consultation explains these proposed roles. The framework also proposes proportionate requirements based on the nature, context and potential harm of the system.
AI incident reporting
The consultation proposes an incident reporting framework covering failures, weaknesses, misuse, unexpected effects and near misses that cause or could cause AI-related harm. Proposed reports would include the incident's nature, foreseeable harm, containment measures and, where applicable, root cause and remediation.
For engineering teams, a useful preparation step is to check whether an output can be traced through the deployment. Can the team identify the model version, relevant inputs, data sources and configuration? Can it see whether a person reviewed or overrode the result, or whether the system triggered a downstream action?
These are practical recommendations for incident readiness. They should not be read as a confirmed statutory logging checklist under the proposed Bill.
Existing PDPA obligations
An AI incident involving personal data may also constitute a personal data breach under Malaysia's Personal Data Protection Act 2010. Organisations should assess their existing obligations rather than wait for the proposed AI legislation.
Under the Commissioner's Data Breach Notification Guidelines, where the applicable notification criteria are met, the data controller must notify the Personal Data Protection Commissioner as soon as practicable and no later than 72 hours. The guidelines state that this period runs from the occurrence of the breach, while the worked examples compute it from the point the controller becomes aware of it. Teams planning an incident response should assume the shorter window.
Where notification to affected individuals is required, it must be made without unnecessary delay and no later than seven days after the initial notification to the Commissioner. The criteria for notifying the Commissioner and affected individuals are not identical.
An incorrect AI output does not automatically constitute a personal data breach. The team needs to assess what happened, what data was involved and which reporting obligations apply.
The proposed AI framework may introduce additional reporting duties. Its consultation envisages coordination with existing sectoral mechanisms, but the detailed interaction with other requirements remains to be clarified.
Logs and traceability
Debug logs can help identify errors, but they may leave gaps in a later investigation. Requests may be missing, records may expire too quickly, or changes to prompts and configuration may be difficult to reconstruct.
Choose a recent AI output and trace it through the system. Identify the model, relevant data sources, configuration and any human intervention. Where the system can take actions, check whether those actions are recorded too.
Keep records proportionate to the potential impact. Avoid collecting full prompts or customer data by default when less sensitive records would support the investigation. Minimise or redact personal data where appropriate, restrict access and set retention periods that reflect investigation needs and applicable privacy requirements.
Reviewing current deployments
Begin by listing the AI tools your organisation uses, including those purchased directly by business teams. Record who owns each deployment, what data it accesses, what decisions or actions it supports and who monitors it.
Then review one system that affects customers or employees. Check how concerns are escalated, who can suspend the system, how evidence is preserved and who assesses notification obligations.
A short walkthrough can expose gaps in ownership, monitoring and incident response while the proposed legislation is still being developed.
How Mandrill Tech can help
Mandrill Tech helps organisations build and operate enterprise data platforms and Generative AI systems. Our work can support clearer deployment ownership, traceable data flows and practical monitoring and incident response arrangements.
Our Lestar platform applies that pattern to sensitive business data: supplier and customer names are masked and tokenised before analysis, the mappings are restricted to authorised users, and access is logged. Mandrill Tech is ISO/IEC 27001 certified.
Preparing for AI governance starts with understanding the systems your company runs, and having the records and people needed to investigate when something goes wrong.
If you are reviewing an AI deployment, talk to Mandrill Tech about what its records would support during an investigation. We can work through the gaps in logging, ownership and access with your team while the legislation is still being finalised.
