Finding the Right Balance: Governing AI in a Rapidly Evolving Future
As Malaysia progresses toward a more AI-driven future, navigating the complexities of AI governance is becoming more pressing. In KRI’s latest report titled "AI Governance in Malaysia: Risks, Challenges and Pathways Forward", we outline key AI-related risks, governance challenges and strategies for a more effective governance approach. This report draws on in-depth interviews and a roundtable discussion with stakeholders and subject matter experts.
AI’s rapid advancement presents both opportunities and challenges. While it has the potential to transform industries and drive economic growth, weak or insufficient governance can lead to unintended consequences. The task ahead is not just to regulate AI but to do so in a way that supports sustainable and responsible innovation. This article explores these insights from our report, looking at how Malaysia can build a regulatory ecosystem that is both adaptable and accountable.
Finding the line between under-governing and over-governing
Effective AI governance requires balancing innovation with regulation to drive technological progress while mitigating risks such as bias, privacy violations and misuse. In Malaysia, developing a regulatory framework that supports innovation without compromising accountability requires carefully navigating challenges related to scope, enforcement and adaptability.
Achieving this balance is especially important in managing AI-related risks. Our report identifies three key risk areas: the risk of being left behind, the risk of unintended harm, and the risk of malicious AI. Overregulating may lead to the risk of being left behind, as excessive constraints can slow AI adoption and hinder competitiveness. Conversely, underregulating increases exposure to unintended harm and malicious AI use, leaving industries and society vulnerable. These risk classifications point toward the need for a regulatory framework that not only fosters innovation but also provides safeguards against ethical, economic and security concerns.
An agile and fit-for-purpose AI regulatory framework is needed
Acknowledging the tension between allowing freer innovation and the need for regulation and oversight, our report recommends an agile approach that has the flexibility for refinement and course correction. This approach requires considering a whole spectrum of regulatory mechanisms alongside legislation, to form a coherent and comprehensive regulatory framework.
Such a framework would include a combination of hard laws and softer standards and guidelines that would outline parameters for AI governance, such as roles and responsibilities of actors, as well as safeguards against the high-risk usage. The regulatory framework would evolve alongside Malaysia’s advancement in its level of AI development and adoption. A balance between guidance and enforcement compatible with the country’s AI readiness would be ideal. As detailed in our report, most AI policy stakeholders in Malaysia support a lighter approach at the current time.
It is also important to acknowledge that laws do not only have a role to constrain but are also important tools to enable adoption and use of AI. For example, updated intellectual property laws that delineate lawful and ethical use of AI could support and incentivise innovation.
Further considerations for Malaysia’s legal framework for AI
To properly transition into an AI era, Malaysia will need to adapt its legal framework to support responsible use of AI in time. For this, our report puts forth the following considerations:
Firstly, governance experts can work with the current system, identifying and filling gaps in existing laws. Most stakeholders that we engaged with prefer a sectoral approach (e.g. health and financial sectors) for regulations, as it recognises the context in which AI is applied, as well as the different risks, requirements and preparedness of each sector. Different sectors may therefore move at different paces for adoption and regulation.
Secondly, if and when a horizontal law such as an AI Act is to be put in place, stakeholders have suggested a modular approach, with a basic framework law that can be read together with components including sectoral regulations and standards. These components can be updated as the technology advances or as impacts evolve, without the need to go through a lengthy parliamentary process to amend the law.
Thirdly, the judiciary will have a role in shaping the direction of AI regulation as well, when they set legal precedents and create case laws in their decisions on AI-related cases.
Fourthly, it is important to ensure that the legal system is coherent, from the aspects of horizontal and sectoral laws, local and international laws, as well as regulations across different layers of the AI technology stack (e.g. application, data, model development, infrastructure).
Fifthly, oversight mechanisms would be important to monitor AI impacts but their efficacy will likely rely on legal requirements for algorithmic transparency or other forms of mandatory reporting.
Lastly, this framework should also take into account the intersections between policy, law and other regulatory tools such as incident reporting repositories and ISO standards. This will ensure that the legal system works seamlessly within the larger regulatory framework.
Conclusion
Ultimately, an agile regulatory framework will enable Malaysia to address the three categories of AI risks identified within our report. Striking the right balance is key as overregulation could stifle growth and deter investment, while inadequate oversight may create accountability gaps.
While we recommend a softer approach at the current time for Malaysia, the country may have to transition to tighter rules and laws in the longer term. A robust regulatory framework will be crucial to build the public’s trust in AI technologies and provide legal certainty for local companies to develop and use AI, as well as the ability to sell to countries with more stringent regulations. Society at large will also benefit from safeguards put in place to deter unintended harms and malicious use of AI, ensuring a sustainable and responsible technology-driven future.
