Anchor Sprint Logo
    Anchor SprintAgensi Digital AI
    Page background

    Responsible AI vs AI Governance: Malaysia's 7 AIGE Principles Explained (2026)

    Home / Blog / Responsible AI vs AI Governance: Malaysia's 7 AIGE Principles Explained (2026)
    November 5, 20269 min readInsightsAIComplianceMalaysia BusinessSingapore
    Screenprint illustration of a seven-pointed compass of responsible AI principles linked by a thread to a tabbed governance binder, a ticked checklist and an approval stamp

    In September 2024, Malaysia's Ministry of Science, Technology and Innovation (MOSTI) launched the National Guidelines on AI Governance and Ethics (AIGE). They are voluntary, but they can still appear in a customer's vendor form: how does your company follow AIGE?

    Responsible AI vs AI governance, the short answer: responsible AI (or ethical AI) is what you promise. AI governance is the record that proves you keep the promise.

    Your next step depends on where you are:

    • If nobody has written AI rules down yet, start with the seven AIGE principles below, and you get a short list of rules you can show a customer.
    • If you already have an AI policy, check it against the one control under each principle, and you find the gaps a vendor form would expose.
    • If you also sell into Singapore, read the short comparison with Singapore's framework. In our view, one set of controls can support both.

    Below: the seven principles with one control each, a Singapore comparison, and a one-page checklist.

    Ethical AI, responsible AI and AI governance: the promise and the record

    Think of food safety. "Food must be safe to eat" is the principle. The kitchen's fridge temperature log and supplier checks are the governance. An inspector walks past the mission statement on the wall and asks to see the log.

    AI works the same way. A principle such as "AI should be fair" is easy to agree with. It only becomes real when someone owns the decision and a log shows what happened when something went wrong. We call each such check or record a control, for example a named owner for every AI tool.

    (We use ethical AI and responsible AI interchangeably.)

    What the National Guidelines on AI Governance and Ethics (AIGE) are

    AIGE is MOSTI's set of national guidelines for the responsible development and use of AI in Malaysia. The MyGovernment portal says it "aims to strengthen public trust, reduce ethical risks, and enhance AI adoption across various sectors".

    It is written for the public and policymakers, and for companies that build or supply AI.

    As of November 2026, it is a voluntary framework, not a law. Law firm Rahmat Lim & Partners described it as "not legally binding at this juncture". Treat it as a checklist your board and staff share, not a deadline.

    For where AIGE sits in Malaysia's wider AI plans, see our Malaysia AI action plan business guide.

    The 7 AIGE principles, and the control that proves each one

    The headings below follow the guidelines as reproduced by law firm Rahmat Lim & Partners. Each principle gets a plain-English meaning and one control you can show. The mapping from principle to control is our own reading, not an official MOSTI list.

    1. Fairness

    If AI screens CVs for a Kuala Lumpur retailer or scores customers for a Penang distributor, you need to know it is not quietly rejecting one group. The government portal's summary frames fairness as preventing "bias and discrimination in AI applications".

    What it means for you: know where AI touches decisions about people, and check those uses for unfair patterns before you rely on them.

    The control that proves it: one intake form for every new AI use. Its answers decide how risky the use is (its risk tier) and who must approve it. Add a question on whether the use makes decisions about people and how you will check for bias.

    2. Reliability, safety and control

    An AI tool that drafts replies is low risk. One that sends them to customers on its own is not. In the portal's words, this principle "ensures AI operates securely and responsibly".

    What it means for you: decide how much each AI system may do on its own, and keep a person able to review or stop it.

    The control that proves it: a register of AI systems that records each one's risk tier and how much it may do without a person checking (its autonomy level). Add a human review rule to your acceptable use policy.

    Building your own AI tools? Keep a record of how you tested them before launch, including deliberate attempts to make them misbehave.

    3. Privacy and security

    One rule prevents a lot of trouble: every kind of data carries a label saying which AI tools it may go into. Without it, picture a staff member pasting a customer list into a free chatbot. The government portal says this principle "focuses on protecting personal information from misuse".

    What it means for you: decide which data may go into which AI tool before staff start using it.

    The control that proves it: a data handling standard. It gives each kind of data one of five labels, and each label says which of four tiers of AI tool it may go into. Controls for Malaysia's Personal Data Protection Act (PDPA) sit on top. See the AI data handling standard preview.

    4. Inclusiveness

    Rules that only the IT team understands do not protect anyone. The portal describes the inclusivity principle as one that "promotes equal access and participation in AI development and usage". Inside a company, that starts with rules every employee can read, including staff who prefer Bahasa Melayu.

    What it means for you: write AI rules every employee can understand, not only the IT team.

    The control that proves it: a plain-language staff guide and a signed acknowledgement from every user, both available in English and Bahasa Melayu.

    5. Transparency and 6. Accountability

    Take one complaint. A customer chatting with your Singapore support line on WhatsApp gets a wrong answer and asks two questions: was that a person or a machine, and who is responsible?

    Transparency answers the first: the portal's summary "calls for clear explanations of AI processes and decision-making". Accountability answers the second: the portal says it "establishes responsibility for AI-generated outcomes". "The team" is not an answer.

    What they mean for you: tell people when they are dealing with AI, and record incidents instead of quietly fixing them.

    The controls that prove them:

    • disclosure rules in your AI acceptable use policy, plus the wording customers actually see
    • a named owner for every entry in the AI system register
    • an incident log of what went wrong and what you changed so it does not happen again

    7. Pursuit of human benefit and happiness

    The portal calls it the human benefit principle, which "ensures AI is used for social well-being while preventing harm or misuse".

    What it means for you: use AI where it helps people and measure whether it does. Stop or change it when it causes harm.

    The control that proves it: a tracker that scores each AI idea before it starts, then records what the pilot actually delivered, plus a set date to review each use again.

    A note on wording: the government portal words some headings differently, for example "privacy and data security" and "inclusivity". Check the official text where exact phrasing matters.

    How Singapore's Model AI Governance Framework compares

    If you also sell into Singapore, the same register and incident log can, in our view, answer much of a Singapore client's vendor questionnaire built around the Model Framework.

    Singapore's voluntary counterpart is the Model AI Governance Framework. It comes from the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC), and its second edition was released on 21 January 2020.

    It rests on two guiding principles. First, organisations using AI in decision-making should ensure the process is "explainable, transparent and fair". Second, "AI solutions should be human-centric". It then sets out four areas of practice:

    • Internal governance structures and measures
    • The level of human involvement in AI-augmented decision-making
    • Operations management
    • Stakeholder interaction and communication

    How the two line up, in our reading (AIGE's privacy and inclusiveness principles are not among Singapore's two guiding principles):

    • Fairness and transparency in AIGE match Singapore's first guiding principle.
    • AIGE's reliability, safety and control principle and its human benefit principle match Singapore's second principle and its area on human involvement.
    • Accountability in AIGE matches Singapore's area on internal governance structures.

    The framework says adopting it requires "tailoring the measures to address the risks identified for the implementing organisation". In our view, a company in Johor Bahru that also serves Singapore clients can run one register and one incident log for both, scaled to its risk. For Singapore's other instruments, see our AI governance framework hub.

    One-page AIGE checklist

    Print this and tick it off with your AI owner.

    1. We have a list of every AI tool and system in use, including tools staff found on their own.
    2. Each one has a named owner.
    3. Each one has a risk tier and an autonomy level.
    4. New AI uses go through one intake form before they start.
    5. Higher-risk uses have a written risk and impact assessment.
    6. Staff know which data may go into which tool.
    7. Every user has signed the acceptable use policy, in a language they read comfortably.
    8. Customers are told when they are dealing with AI.
    9. AI incidents and near misses are logged and closed.
    10. Each use case is reviewed on a set schedule, and its benefits are tracked.

    If you can tick all ten with a record, not a promise, you have moved from responsible AI to AI governance.

    Templates for these controls

    You can build these controls yourself from the checklist above.

    If you would rather start from templates, each one has a matching document in the Anchor Sprint AI Governance Kit (v1.0: 48 editable templates and 422 controls, 53 of them in the Lite tier). The free Lite pack covers the register, intake form, acceptable use policy, data handling standard and incident log, and the staff guide is free to read without sign-up:

    Member documents, which are not in the free pack, go deeper:

    • a risk and impact assessment
    • release checks before a tool goes live
    • red-team testing (deliberately trying to make an AI tool misbehave)
    • AI literacy training
    • a review and recertification procedure

    Download the free AI governance Lite pack.

    If you want help putting these controls in place, our team can review your current AI use with you.

    Konsultasi percuma

    Turn Your AI Principles Into Evidence

    We help Malaysian and Singapore companies set up the register, policy, owners and incident process that show how they follow AIGE and Singapore's Model AI Governance Framework.

    Talk to Our Team

    This article explains voluntary guidelines and is not legal advice. If your organisation is regulated, have your pack reviewed by Malaysian or Singaporean counsel.

    Frequently asked questions

    What is the difference between responsible AI and AI governance?

    Responsible AI, or ethical AI, means the principles you commit to, such as fairness, transparency, accountability and privacy. AI governance is how you put them into practice: an approved tool, a policy, a register, named owners and an incident process, with evidence that they work.

    What are the seven principles of Malaysia's AIGE?

    Fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and pursuit of human benefit and happiness, as reproduced by law firm Rahmat Lim & Partners. The government portal words some of them differently, for example "privacy and data security" and "inclusivity".

    Is AIGE mandatory in Malaysia?

    No. MOSTI's AIGE is a voluntary framework. As of November 2026 it is guidance, not law; law firm Rahmat Lim & Partners described it as "not legally binding at this juncture". It can still be a useful benchmark: a customer or auditor may use it as a reference point. For the separate, proposed law, see our explainer on the Malaysia AI Governance Bill.

    Is there an AIGE certification?

    We found no AIGE certification scheme on the official pages we checked; AIGE is published as voluntary guidelines, and using our templates does not make a company "AIGE certified". The templates help you keep the records that show how you apply the principles.

    Is ethical AI the same as responsible AI?

    For practical purposes, yes. Both describe principles for how AI should behave. AI governance is the separate, practical layer that shows you follow them.

    How does AIGE compare with Singapore's Model AI Governance Framework?

    Both are voluntary. Singapore's framework has two guiding principles (decisions should be explainable, transparent and fair, and AI should be human-centric) and four areas of practice. In our reading they cover similar ground to AIGE's seven principles, so one set of controls, scaled to your risk, can support both.

    Sources

    Dikuasakan oleh EzyChat