AI governance · Malaysia & Singapore
AI Governance in Malaysia & Singapore
A practical guide for companies whose staff already use ChatGPT, Claude, Copilot or Gemini: what AI governance is, which rules apply in 2026, which tier fits you, and a 90-day plan built on free, editable templates.
Updated 31 October 2026 · Based on AI Governance Kit v1.0
- editable templates
- 48editable templates
- controls, each with an ID
- 422controls, each with an ID
- tiers: Lite, Standard, Regulated
- 3tiers: Lite, Standard, Regulated
- day plan to a stable Lite setup
- 90day plan to a stable Lite setup
Short answer
What is AI governance?
AI governance is the set of rules, roles and records that decide which AI an organisation may use, for what, with which data, and who is accountable when something goes wrong. In practice it starts with five things: an approved AI tool, an acceptable use policy, a register of the AI in use, a named owner for each AI system, and a way to report incidents.
Why now
AI rules in Malaysia and Singapore are moving from voluntary to expected
Most organisations already use AI tools, and many now connect them to email, files and business systems, or let agents act in a browser. That moves AI risk from "what did someone type" to "what can this system do on our behalf".
Regulators are converging on the same expectations: know what AI you run, classify its risk, name a human owner, control third parties, and report incidents.
| Instrument | Status (Oct 2026) | What it expects |
|---|---|---|
| Malaysia: National Guidelines on AI Governance & Ethics (AIGE) | Status (Oct 2026)Voluntary, in effect | What it expectsSeven principles, including accountability, transparency and privacy |
| Malaysia: PDPA 2010, as amended in 2024 | Status (Oct 2026)In force | What it expectsData Protection Officer, 72-hour breach notification, cross-border transfer rules |
| Malaysia: AI Governance Bill | Status (Oct 2026)Draft (consultation) | What it expectsDeveloper and deployer duties, harm tiers, incident and near-miss reporting |
| Malaysia: JPDP AI & Personal Data Framework | Status (Oct 2026)Draft (consultation) | What it expectsPrivacy by design and impact assessment across the AI lifecycle |
| Singapore: Model AI Governance Framework for Agentic AI | Status (Oct 2026)Voluntary, in effect | What it expectsBound agent risks upfront, human accountability, technical controls |
| Singapore: MAS AI Risk Management Guidelines | Status (Oct 2026)Final, applies from 2027 | What it expectsAI inventory, risk materiality, lifecycle controls (financial institutions) |
Status as at October 2026, from the AGK Pre-read v1.0. Draft laws change during consultation: check the current text before relying on it.
What good AI governance covers: five building blocks
Whatever the regulator, the same five building blocks come up. Each one maps to a document you can adopt this quarter.
01
Know what AI you run
A register of every AI tool and system, including the ones staff found on their own.
AGK-TPL-01, AGK-PRC-07
02
Classify the risk
Label data from Public to Secrets and decide which AI tool tier may see each label.
AGK-STD-A02
03
Name a human owner
An AI sponsor, an AI Governance Lead and an owner for every AI system.
AGK-001
04
Control third parties
Approved tools only, configured to a baseline; connectors and agents approved before use.
AGK-POL-02
05
Report incidents
A log, a clear route to report, and the 72-hour personal data breach clock.
AGK-TPL-06
How the kit is built
Five levels, from board principle to platform setting
Each level answers a different question and changes at a different speed. Policies stay stable for years. Vendor settings change monthly, so they live at the bottom, where updating them never needs board approval.
POL · Policy
Why and what
Approved by: Board or CEO
STD · Standard
Testable controls, each with an ID
Approved by: AI Governance Committee
PRC · GDL · Procedure and guideline
Step-by-step how, owners and timelines
Approved by: AI Governance Lead
TPL · Template
The registers and forms that hold the evidence
Approved by: Document owner
ANX · Vendor annex
Exact settings per AI platform; the only place vendors are named
Approved by: AI Platform Administrator
Two tracks on a shared core
Core
Charter, acceptable use, risk and data policy, intake, incidents and review. Every organisation needs these.
Track A: using AI tools
For organisations using vendor AI tools: platform baseline, data handling, connectors, browser agents and skills.
Track B: building AI
For teams building AI applications or agents: lifecycle, agent identity and access, evaluation, guardrails and monitoring.
One requirement, followed down the levels
- 1. Policy
AI agents shall not take irreversible actions without human approval.
- 2. Standard
Each write or act tool on a connector is set to "needs approval" or "blocked".
- 3. Procedure
How a request to enable a write tool is triaged, approved and logged.
- 4. Template
The registry row records the tool, its setting and the approver.
- 5. Vendor annex
The exact per-tool permission setting on each AI platform you use.
Adoption tiers
Which tier are you: Lite, Standard or Regulated?
Every control in the kit is tagged with the lowest tier it applies to, so a 50-person company and a bank use the same documents at a different depth.
| Tier | Fits | What you adopt | Typical time |
|---|---|---|---|
| Lite | FitsOrganisations starting out with vendor AI tools, with no in-house AI builds | What you adoptAbout 20 documents and 53 controls (39 from day one, 14 once features such as connectors are switched on) | Typical timeAbout 90 days; policy, data rules and approved tool in the first three weeks |
| Standard | FitsMid-market companies switching on connectors and agents, building AI, or with AI touching customers or people decisions | What you adoptAll of Core and Track A, plus Track B where you build | Typical timeThree to six months, depending on how much AI you build |
| Regulated | FitsFinancial institutions under BNM or MAS, healthcare, EU exposure, or ISO/IEC 42001 certification planned | What you adoptThe full kit, including Regulated-only controls and an ISO/IEC 42001 Statement of Applicability | Typical timePlan with counsel; have the pack reviewed by Malaysian or Singaporean lawyers |
Two-minute tier check
Answer yes or no to each question.
Recommended tier
Lite
You use vendor AI tools and do not build AI in-house.
Start with AGK-001 Lite Quick Start and the 90-day plan.
Get the free Lite packHow the result is worked out
- Yes to question 1: Regulated. Start with AGK-000 and the ISO/IEC 42001 Statement of Applicability.
- Otherwise, yes to any of questions 2, 3 or 4: Standard. Start with AGK-000 and the Governance Charter.
- No to questions 1 to 4: Lite. Start with AGK-001 Lite Quick Start and the 90-day plan below.
- Yes to question 5: adopt the connector and browser-agent standards before switching those features on.
- Yes to question 6: compare what you have with the acceptable use policy template rather than starting from scratch.
Logic from the AGK Pre-read v1.0 two-minute check.
Six decisions leadership makes in week 1
Nothing else moves until these are made. Each takes one conversation, not a project.
- 1
Who owns AI?
Name an AI sponsor (executive) and an AI Governance Lead.
AGK-POL-01
- 2
Who decides?
Form a three-person committee: sponsor, Governance Lead, Data Protection Officer.
AGK-POL-01
- 3
How much risk is acceptable?
One paragraph of risk appetite: what AI may and may never be used for.
AGK-POL-01
- 4
Which AI tool is approved?
Confirm the platform staff should use instead of personal accounts.
AGK-GDL-C01
- 5
Time and budget
About half a day a week for the Governance Lead in the first 90 days, plus licences.
AGK-001
- 6
What we say about jobs
A short, honest statement on how AI affects roles, before staff ask.
AGK-GDL-C03
The first 90 days
A 90-day AI governance plan for organisations starting out
This is the Lite path from AGK-001. Each step ends with something approved, configured or populated. Standard and Regulated adopters follow the same order and add the remaining documents.
Week 1
Name the owners
AI sponsor, AI Governance Lead and a three-person committee. Agree the risk appetite in one paragraph.
AGK-001 · POL-01
Weeks 1–2
Find the AI already in use
Staff survey, expense data, network and SaaS discovery, with a 30-day amnesty for self-declared tools.
AGK-PRC-07 · TPL-01
Week 2
Set the rules
Approve the acceptable use policy and data rules. Every user acknowledges before access.
AGK-POL-02 · STD-A02 · GDL-A01 · TPL-07
Weeks 2–3
Configure the platform
Apply the baseline with the vendor annex. Block personal AI accounts on company devices.
AGK-STD-A01 · ANX
Weeks 3–4
Communicate and train
Key messages, staff FAQ, champions, a safe channel for concerns, fundamentals training.
AGK-GDL-C03 · STD-C01
Weeks 4–6
Pick the first use cases
Run a two-hour workshop, score ideas on value, feasibility and risk, pilot two or three quick wins.
AGK-GDL-C02 · TPL-12
Weeks 4–6
Be ready for problems
Intake form, incident log, who to call, and the 72-hour breach clock.
AGK-PRC-01 · PRC-04 · TPL-03 · TPL-06
Weeks 6–12
Pilot, measure, decide
Track benefits. Adopt the connector or browser standards before switching those features on.
AGK-TPL-12 · STD-A03 / A04
Day 90
Review
The committee reviews what is in use, incidents, benefits and next quarter. Move to Standard when you build agents or scale.
Minutes · updated register
Frameworks
Built on ISO/IEC 42001, risk-managed with NIST, mapped to Malaysian and Singapore rules
The kit does not invent its own framework. It follows one international management-system standard for structure, one risk framework for method, and maps every document to the rules that apply in Malaysia, Singapore and beyond.
| Framework | What it is | How the kit uses it |
|---|---|---|
| ISO/IEC 42001:2023 | What it isThe international AI management system standard | How the kit uses itGives the kit its plan–do–check–act cycle, policy and roles; the 38 Annex A controls are mapped in a ready Statement of Applicability |
| NIST AI RMF 1.0 and Generative AI Profile | What it isUS risk management framework: Govern, Map, Measure, Manage | How the kit uses itShapes how risks are identified, assessed and treated in the procedures |
| Malaysia AIGE | What it isNational Guidelines on AI Governance & Ethics | How the kit uses itPrinciples mapped to the policies |
| Malaysia PDPA 2010 (as amended) | What it isPersonal data protection law | How the kit uses itData handling controls, DPO role, breach notification, cross-border transfers |
| Malaysia draft AI Governance Bill and JPDP framework | What it isDraft law and draft personal data framework | How the kit uses itMapped as drafts, so the kit is ready if they pass |
| Singapore Model AI Governance Frameworks | What it isIMDA/PDPC frameworks, including the framework for agentic AI | How the kit uses itAgent autonomy levels, human accountability, technical controls |
| MAS AI Risk Management Guidelines | What it isSupervisory guidelines for financial institutions | How the kit uses itAI inventory, risk materiality and lifecycle controls at the Regulated tier |
| OWASP Top 10 for LLM and Agentic Applications | What it isSecurity threat lists for AI applications and agents | How the kit uses itThreats and adversarial testing |
| EU AI Act | What it isEU regulation on AI | How the kit uses itRelevant articles where your AI outputs reach the EU |
Free to read now, no sign-up
Start here, then get the Lite pack when you are ready to adopt.
Kit pre-read (PDF)
Ten minutes: paths, tier check, leadership decisions, 90-day plan and document map.
- Safe AI Use Guide for Staff
The plain-language guide every employee should read. Full text online.
- AI acceptable use policy template
What the policy must cover, an excerpt, and the data × AI tool matrix.
Read it - Template library
Preview every free template in your browser before you download.
Read it
Free AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 733 KB
Get the free Lite governance pack
Templates for governance purposes, not legal advice.
AI Governance Hub
Need the full kit? Join the AI Governance Hub
The Lite pack gets you started. The AI Governance Hub is the membership for teams that need the full kit and want to keep it current. It is launching soon: join the waitlist and we will contact you before it opens.
| Feature | Free | Member |
|---|---|---|
| Templates | 12 Lite documents | All 48 documents, with version history |
| Pre-read and tier check | ||
| 90-day planner with owners and evidence | ||
| Policy assistant: a pack tailored to your company | ||
| MCP connection: staff ask Claude, ChatGPT or Copilot and get answers from your own policy | ||
| Online AI system, connector and incident registers | ||
| Regulation and vendor-setting update alerts |
Member features are planned for launch and may change.
RM 2,400
per organisation per year
AI governance FAQ
What is AI governance?
AI governance is the set of rules, roles and records that decide which AI an organisation may use, for what, with which data, and who is accountable when something goes wrong. It usually starts with an approved AI tool, an acceptable use policy, an AI system register, named owners and an incident process.
Is AI governance required by law in Malaysia?
There is no AI-specific law in force in Malaysia as at October 2026. The PDPA 2010, as amended in 2024, already applies whenever AI processes personal data, including breach notification within 72 hours. The AI Governance Bill and the JPDP AI and personal data framework are drafts under consultation, and the national AIGE guidelines are voluntary.
What applies in Singapore?
Singapore's Model AI Governance Frameworks, including the framework for agentic AI, are voluntary and in effect. Financial institutions should plan for the MAS AI Risk Management Guidelines, which are final and apply from 2027.
Do we need all 48 documents?
No. A Lite adopter uses about 20 documents and 53 controls. The rest are added when you switch on connectors or browser agents, build agents, or become regulated. The two-minute tier check tells you where you are.
How long does AI governance take to set up?
At the Lite tier, about 90 days to reach a stable state, with the most important steps (policy, data rules, approved tool) done in the first three weeks. Standard takes three to six months, depending on how much AI you build.
Do we need ISO/IEC 42001 certification?
Not to start. The kit follows the standard's structure, so if certification becomes necessary, often because a customer asks for it, the Statement of Applicability is already started.
Does the kit only work with Claude?
No. Policies and standards are vendor-neutral. Vendor annexes cover Claude, OpenAI, Microsoft and Google; you use the annexes for the platforms you run.
Will governance slow down AI adoption?
It should do the opposite. Clear rules and an approved tool remove the uncertainty that stops people trying AI, and the adoption roadmap picks the use cases worth doing first.
What does it cost to run?
Mainly time: about half a day a week for the AI Governance Lead and an hour a month for the committee at the Lite tier. Some controls need AI platform licences with admin features such as single sign-on and audit logs.
