Executive summary
Technology is meant to deliver services that could unlock human and societal potential. Yet, much as cars have taken the lives of people, the current digital age has exacerbated social divisions, introduced social ails and caused great monetary losses. The world is catching up with emerging technologies, particularly artificial intelligence (AI), which has evolved faster than expected.7 AI is becoming highly entrenched in society, from personal consumption to shaping business practices. As with any tool, there are positive and negative consequences, depending on how it is used. In the case of AI, the risks that constitute its usage are unique in that they could be complicated, especially where AI systems could be trained and layered in a manner that is unexplainable and unpredictable. Hence, the need to enhance governance to be forward looking and to include research and development (R&D) that could keep pace with the dizzying changes.
This white paper starts with the central question of “How should Malaysia govern AI?”. To answer this, we first need to dissect “what is Malaysia in regard to AI”, a question which does not have fixed metrics or quantifications. This requires examining Malaysia’s position in AI maturity and value chain. While through the years, documents, such as the Malaysia Digital Economy Blueprint,8 10-10 Malaysian Science, Technology, Innovation and Economy (MySTIE) Framework,9 National Science and Technology Policy 2021-2030,10 AI Roadmap 2021-202511 and National Industrial Master Plan (NIMP) 203012 outlined ambitions, these could not gauge fully where Malaysia stood in the AI value chain.
It would also require the nation to address challenging questions about technology adoption. Questions, such as, is Malaysia prepared with the resources needed to cultivate an AI industry? Does the nation have plans, procedures and oversight mechanisms to address environmental implications? Might there be a solution to talent shortages or ambivalence towards AI? Are there institutional mechanisms in place to address, research and find solutions to social harms? Could the nation navigate the difficult realm of cyber diplomacy to project Malaysia’s ambitions abroad and participate in tables where such rules are made? Responding to the multi-faceted challenges requires various collaborative governance efforts. Yet, it may require a captain to steer the ship in a direction forward.
Charting the way forward, the paper draws lessons from the past. While hard laws are in vogue now, the recent spate of policies for AI governance and cultivation started in 2016. These set the foundations for an AI industry in countries like China, Japan, Canada and the United Kingdom. Building infrastructure and increasing pools of data continued with policies accruing AI knowledge through education, R&D and growing talent. These are complemented by the final ingredient to build an AI industry: data. With all materials in place, this led these countries to focus on governance in the realms of ethics, privacy and guardrails. Most nations have opted for soft laws to address nascent adoption and deployment. These approachesintroduced principles for system development. Such approaches differ from nations pursuing risk-focused assessments. Yet, in terms of implementation, nations have varying approaches, with Indonesia, Australia, China, Japan and the UK opting for sectoral-focused oversight. Thisapproach could be useful where government agencies already have jurisdiction.
At the time of writing, Malaysia’s AI governance ecosystem consisted of unconnected players, which undermined efforts to utilise resources effectively. The Ministry of Science, Technology and Innovation (MOSTI), Ministry of Digital, Ministry of Communications and corresponding agencies, such as MyDIGITAL, MDEC and MCMC, have introduced policies and programmes to grow the AI ecosystem. These efforts cover principles of ethics for developers, adoption and awareness as well as constructing forums on potential standards and guidelines. The existence of Malaysia’s present players is considered alongside trends in AI governance. It then analyses Malaysia’s history with governance in the digital sphere and aims to identify governing structures to facilitate AI ambitions, socio-economic goals and aspirations.
This paper answers the question of governance as follows:
- First, Malaysia should not pursue hard regulations in haste. At the current stage, due processes would have to be constructed for legislation, lest laws are introduced which could impact on innovation or weaken trust between user, industry and government. Strengthening existing hard laws could be possible, especially for critical issues and risks within the realm of crime and discrimination. For instance, the Road Transport Act 1987 defines responsibility and insurance policies in the case of road accidents. However, deaths from autonomous vehicles powered by technologies like AI still have many jurisdictional gaps and liability issues. While such technologies have existed in their respective sectors since the turn of the millennium, gaps in Malaysia’s laws, such as the Personal Data Protection Act exempting government, might not prevent incidences regarding bias in government algorithms from occurring in Malaysia. Lastly, in misuse of deepfakes that affect the safety and security of individuals including children, laws such as Child Act 2001, Sexual Offences Against Children Act 2017, and related penal codes are insufficient to safeguard Malaysians.
- Second, leadership is needed from cultivating the AI industry to building a harms repository and mitigating risks of AI in society. This policymaking body must have a vision for Malaysia’s AI development and to operationalise this vision, the body must be endowed with the mandate to lead and coordinate. This body must be able to engage with multiple stakeholders to oversee the whole ecosystem. It must conduct stocktaking exercises, determine data-sharing requirements, conduct programmes on AI awareness, safety and ethics and embark on cross-collaboration efforts for security purposes. Additionally, as talent development will continue to be a challenge, ensuring upskilling and reskilling programmes across sectors is imperative. To galvanise efforts in a single direction, the body might want to pursue a national AI project which could strengthen the AI industry. This could include things like producing smart-home appliances as was done by Japan or China or other projects laid out in the National AI Roadmap, such as AI Personalised Learning System to help with overcrowded classrooms and teacher shortages. The body should also consider sectoral-based governance, especially drawing from Malaysia’s cybersecurity and data-protection experience. This could encourage sectoral lead approaches and shared accountability, which would make regulations more effective.
- Third, to prepare for the unintended consequences of AI, Malaysia could consider setting up its own AI safety institute. The body should conduct research into the trusted development and safe deployment of AI, while advising the government on current AI developments and providing policy insights into avoiding unintended consequences. The institute would need to have sandboxing capabilities, serve as a hub for information-sharing, and manage a repository of harms. This could allow AI policies to shift from sandboxes to safeguards, which could improve Malaysia’s ability to govern a thriving AI ecosystem.
- Lastly, Malaysia could also consider a centre of data governance and ethics that focuses on data innovation and management. As data will catalyse AI and fuel the digital economy, understanding data use and providing secure architectures for data sharing could cultivate digital sectors. While building a centre require resources and standardised data management practices, Malaysia could also consider exploring the introduction of a data strategy that could grow its shared data resources, link data resources in a research, development, commercialisation, innovation and enterprise (RDCIE) loop and map its data resources.
Often governance is misunderstood as relying solely on regulations. However, the workshop in June indicated that governance requires a cohesive direction from institutions and support from the ecosystem. Additionally, comprehensive consultation with all related agencies and stakeholders must be conducted should hard regulations be the intended outcome. Given the potential AI boom, it must be done in ways that do not dampen growth, innovation and ensure equity in the processes.
The paper is indebted to the workshop participants, including government agencies, academic institutions and think-tanks, civil society organisation and industry leaders. The central findings of the workshop are included in the appendix for consideration. The authors are also extremely grateful to the thriving community of academics, practitioners, industry players and members of government comitted to advancing progress in this space.
