Malaysia’s National AI Office opened consultation on its draft AI Governance Bill on 10 July, with written feedback due 31 July. It would be the country’s first horizontal AI law: a risk-based framework that sorts systems into three tiers, unacceptable, high and low, overseen by a central authority handling safety, enforcement, and a regulatory sandbox where startups can experiment on a longer leash before the full rules bite.

The provision that matters most to anyone shipping AI into Malaysia sits away from the risk tiers. Prime Minister Anwar Ibrahim has called intellectual property the heart of the bill, and the framework proposes to treat both the data used to train a model and the content the model generates as intellectual property, with the Intellectual Property Corporation of Malaysia protecting inputs and outputs alike. Reporting on the draft has called the pairing an ASEAN first.

For a builder, that is the whole game. If you fine-tune on a dataset or push AI-generated products into Kuala Lumpur, the question of who owns the input and who owns the output may soon be answered by Malaysian statute rather than by your terms of service. Ownership and liability travel with it.

Malaysia is proposing to settle in a statute what Beijing settled in one judgment.

China has been living the alternative. In November 2023 the Beijing Internet Court, in Li v. Liu, granted copyright over an AI-generated image because the plaintiff had made enough aesthetic choices through Stable Diffusion’s prompts and settings to count as an author. The ruling was decided case by case, on the facts in front of one court, and it turns on the human effort behind the output. Malaysia is proposing to settle in a statute what Beijing settled in one judgment.

What is changing and what is not are worth separating. The consultation paper keeps intellectual property at the level of principle: data stewardship is one of five governance principles, and the black-letter rules on ownership are deferred to implementation. A builder who opens the paper expecting a clean ownership clause finds a statement of intent, with the text still to be written. That gap is exactly why the comment window is worth the afternoon, and why the Corporation’s eventual role is still soft enough to shape.

The case against reacting is real. This is a consultation, not a law; the final bill could soften the IP language or lose it entirely; and lawyering a draft that may still move burns the time a small team should spend shipping. Reading the paper costs an afternoon. Rebuilding a data-provenance policy around a clause that might not survive costs a sprint.

The provenance of your training data, quiet until now, becomes a line someone in Putrajaya can ask you to prove.

The direction, though, is set. Anwar took the bill toward Cabinet earlier this year and wants it before Parliament, and Malaysia is unlikely to be the last Southeast Asian state to legislate who owns what a model eats and what it makes. The provenance of your training data, quiet until now, becomes a line someone in Putrajaya can ask you to prove.1

Footnotes

  1. Feedback goes in through a web form and an email address, policy@ai.gov.my. The first draft of the region’s most ambitious AI-ownership regime is being crowdsourced through a Google Form. ↩