What AI training do Malaysian employees need, and which rules apply?
By Bodhih Training Solutions, Bengaluru · UpdatedThe short answer
Malaysia has no AI-specific statute. The National Guidelines on AI Governance and Ethics, introduced in September 2024, are voluntary and aligned with the ASEAN guide. The binding rules come from the Personal Data Protection Act 2010 as amended in 2024: new cross-border transfer rules since 1 April 2025, and data protection officers and mandatory breach notification since 1 June 2025. Train employees on both.
Which Malaysian rules apply to AI at work?
Malaysia has chosen voluntary AI guidelines alongside a strengthened data protection law.
| Rule or guidance | What it covers | Who needs to know it |
|---|---|---|
| National Guidelines on AI Governance and Ethics (September 2024) | Voluntary principles for developers, deployers and users of AI, aligned with the ASEAN Guide on AI Governance and Ethics | Leaders, risk owners and project teams |
| PDPA 2010, as amended in 2024 | Personal data put into or produced by AI tools; the security principle now also binds data processors | Everyone who handles personal data |
| Data protection officer (from 1 June 2025) | Data controllers and processors that meet the Commissioner's criteria must appoint a DPO | Management and the DPO |
| Breach notification (from 1 June 2025) | Personal data breaches must be notified under the amended Act and the Commissioner's guideline | IT, security and anyone who may spot a breach |
| Cross-border transfers (from 1 April 2025) | The whitelist is gone; transfers depend on the protection in the destination or another listed condition | Procurement, IT and anyone adopting an overseas AI tool |
What should Malaysian employees learn?
A practical curriculum by audience:
- Everyone: what data must never go into an AI tool, how to check output for errors and invented facts, and how to report a suspected data breach quickly.
- Managers: how to approve a new use, who is accountable for it, and how to handle a mistake.
- HR and recruiters: bias in screening tools, employee data in AI systems, and keeping a person in the decision.
- Procurement and IT: where an AI tool stores data and whether the transfer meets the amended PDPA.
- Leaders and the DPO: the national guidelines, the PDPA duties and where AI changes jobs.
How do you roll it out?
Publish a short AI acceptable-use policy first, then train against it. Start with a course of a few hours for everyone, add role-specific training for HR, managers and technical teams, and measure before and after on tasks people really do. Repeat when your policy changes or the Commissioner issues a new guideline; more are expected on impact assessments, privacy by design and automated decision-making.
Is AI training a legal requirement in Malaysia?
No Malaysian law names an AI course that every employer must run, and the national guidelines are voluntary. Training is how staff learn the PDPA duties that are binding, such as spotting and reporting a breach, and the policy you publish.
Courses that fit
Responsible AI and Data Privacy course
Lead your team’s AI use safely and lawfully: the 2026 rules, three Scenario Sims and a real AI register entry.
AI course · onlineAI for HR course
Eight HR work products built with AI on your own work, a proctored exam and a credential anyone can verify.
AI course · onlineAI at Work Essentials course
Four hours of hands-on AI literacy for every employee, with a measured before-and-after score.
Related reading
Sources
Checked on 2026-11-14. Laws and prices change; confirm on the official page before you rely on a figure.
More from the Bodhih family
Train managers to approve AI use safely
Responsible AI and Data Privacy for Managers: about 11 hours, self-paced, with a verifiable credential. $119, or company seats.
Questions people ask next
Does Malaysia have an AI Act?
No. As of the date shown, AI is covered by voluntary national guidelines and by existing laws such as the PDPA.
Are the National Guidelines on AI Governance and Ethics mandatory?
No. They are voluntary and non-binding.
When did the PDPA amendments take effect?
In three phases in 2025: 1 January, 1 April (including cross-border transfer rules) and 1 June (data protection officers, breach notification and data portability).
Which Bodhih courses cover this?
AI at Work Essentials ($59) is the short course for everyone. Responsible AI and Data Privacy for Managers ($119) covers policy, risk and privacy decisions. Applied AI: HR ($199) covers fair use of AI in people decisions. Company seats are available.
Is this legal advice?
No. It summarises public sources as of the date shown. Take advice from a Malaysian lawyer or your data protection officer.