Executive Summary

Key Numbers

Sources: The Edge Malaysia, New Straits Times, Marketing-Interactive

Four numbers show where this bill stands. It reaches cabinet in June 2026, and its protection spans two axes: training-data inputs and AI outputs. At the same time, Malaysia has allocated RM2 billion (about USD 490 million) to its own AI infrastructure and set a deadline to become an AI-driven nation by 2030. The point folded into these four numbers is that regulation and investment point the same way.

At the center of the bill sits an idea that fits in a single sentence: the data that went into building an AI and the results an AI produces are both treated as someone's property. Prime Minister Anwar Ibrahim referred to this structure directly during parliamentary questions on 24 February 2026. One side is the input, the copyrighted works used to train the model: text, images, audio, video. The other side is the output, the content an AI system generates. Rather than keeping these apart, the bill treats the two as a single intellectual-property question.

The input question is familiar. Who holds the rights to the works a model learned from, and was that use legitimate? It is the very point that copyright disputes over generative AI are fighting out around the world. The output question is relatively new. Who owns the copyright to the writing, pictures, and music an AI produces? The Malaysian bill puts both in its sights at once, with enforcement designed to fall to the Intellectual Property Corporation of Malaysia (MyIPO). It leans on the existing Copyright Act 1987 as its base, with the new law supplementing it in the AI context.

IP is not the only thing the bill addresses, of course. It also brings an AI risk-classification framework, full-lifecycle oversight from development through deployment and monitoring, and mandatory incident reporting. The picture is meant to cover the whole AI ecosystem, data centers included. Even so, the mark that sets this bill apart from other regulation is the dual IP structure. Clauses for managing risk exist in other countries too, but the attempt to define both inputs and outputs in the language of property rights is uncommon.

"Southeast Asia's first" is a phrase to use carefully. The country that passed a binding AI law earliest is Vietnam. It finalized its law in December 2025, began phasing it in from March 2026, and bundled in amendments to its intellectual-property and cybersecurity laws as well. Singapore takes a different road. Instead of compelling through law, it builds trust through voluntary frameworks like AI Verify, and in January 2026 it became the first in the world to release a governance framework for agentic AI.

So Malaysia's "first" has to be stated more narrowly and precisely than Vietnam's. It means the first case where dedicated AI-governance legislation puts IP protection for both training-data inputs and AI outputs at the center of its frame. Vietnam included IP amendments too, but did not make them the law's headline. Malaysia raises IP not as a side branch but as a pillar. Even within Southeast Asia, the emphasis differs.

That emphasis binds together with Malaysia's other moves in one direction. Kuala Lumpur secured the secretariat of the ASEAN AI Safety Network, allocated RM2 billion to sovereign AI cloud infrastructure in the 2026 budget, and runs ILMU, its own AI model trained on domestically licensed data, inside sovereign infrastructure. It even halted new permits for non-AI data centers and redirected them toward AI use only. An IP-centered bill sits atop a current that aims to bring the ownership and control of data into the national fold.

Set beside the EU AI Act, the contrast comes into focus. The EU bans or restricts high-risk uses on a risk basis and begins enforcement in August 2026. Its center of gravity is "what should we prevent." Malaysia asks first, "whose are this data and these results?" Anwar himself says his country's approach differs from the West's. He describes it as weighing moral considerations alongside legal detail, which, translated into the language of data, comes close to putting ownership ahead of control.

If the bill passes, where does the weight of day-to-day data work move? The most direct change is that managing the provenance of training data becomes an obligation rather than a choice. Once training data falls within the reach of intellectual property, where you sourced it and what rights govern it become basic items of compliance. A model trained on data with possible copyright infringement carries legal risk by that very fact. Data quality stops being a matter of model performance alone and connects to a matter of legal risk.

Change follows on the output side as well. Once the copyright ownership of AI-generated work is spelled out, you have to settle in advance, within contracts and workflows, who holds the rights to those results. At the same time, the position of those who supply data shifts. When rights attach clearly to the data used in training, the bargaining power of whoever holds that data rises. Data gets a price when it becomes something to trade, and to be priced, its ownership has to be clear. Making that ownership clear is exactly what the bill sets out to do.

Here the familiar equation "regulation equals prohibition" begins to wobble. Read regulation only as a list of burdens, and this bill looks like one more constraint. Yet regulation that establishes ownership is also regulation that creates assets. The structure resembles how land became a tradable asset once title registration appeared. The more the owner of data is fixed by law, the more an unsorted heap of data gains room to turn into a sorted data asset. Malaysia's choice leans toward using regulation as a tool for creating data value.

The bill is still at the draft stage, of course, and its clauses can change as it passes through cabinet and parliament. How the principle of protecting both inputs and outputs as IP actually works in enforcement also remains to be seen. Even so, the direction is clear. The regulatory question around AI is widening past "is it safe?" to "whose is it?", and those who handle data need their provenance and rights organized well enough to answer either one. Whether regulation demands prohibition or proof of ownership, the kit is the same: well-organized, traceable data.

News & Media

• 1.New Straits Times. (24 February 2026). "PM: AI governance bill to tackle accountability and ethics of AI use." nst.com.my
• 2.The Edge Malaysia. (2026). "AI Legislative Framework To Be Presented To Cabinet In June 2026 – Gobind." theedgemalaysia.com
• 3.Marketing Interactive. (2026). "Malaysia's AI Governance Bill to reportedly focus on ethics, accountability and IP." marketing-interactive.com

Industry & Policy Reports

• 4.KPMG Malaysia. (April 2026). From Capacity to Capability: Malaysia's AI Governance Imperative. KPMG Malaysia.
• 5.ISEAS–Yusof Ishak Institute. (2026). "ASEAN AI Governance: Navigating a Patchwork of Approaches." ISEAS Perspective (FULCRUM).