AI Governance: A Practical Starter Guide for Businesses

AI governance is the set of rules, roles and checks a company uses to make sure its AI is used safely, legally and fairly. It answers simple questions: what AI do we use, who is responsible for it, what could go wrong, and how do we check?

It is not a type of AI. It is management, like financial controls, but for AI. This guide covers the main frameworks and how a business in Malaysia can start.

What AI governance actually covers

Good AI governance usually includes:

• An inventory. A list of every AI tool and model in use, including free tools staff use on their own.
• Ownership. A named person accountable for each AI system.
• Risk ratings. Sorting uses by how much harm they could do. A tool that drafts marketing posts is low risk. One that screens job applicants or approves loans is high risk.
• Policies. What data can go into AI tools, what needs human review, what is banned.
• Testing and monitoring. Checking accuracy, bias and security before launch and over time.
• Records. Enough documentation to explain decisions to customers, auditors or regulators.

You don't need all of this on day one. But you need to know which of your uses are high risk.

The EU AI Act and its timeline

The EU AI Act is the world's first broad AI law. It matters outside Europe too. If a Malaysian company offers an AI system in the EU, or its AI output is used there, it may be covered.

The law sorts AI by risk:

• Unacceptable risk: banned, such as social scoring.
• High risk: allowed with strict duties, such as AI used in hiring, credit or critical infrastructure.
• Limited risk: transparency duties, such as telling people they are talking to a chatbot.
• Minimal risk: no extra duties, such as spam filters.

Key dates:

Date	What applies
1 August 2024	The Act entered into force
2 February 2025	Bans on prohibited practices and AI literacy duties
2 August 2025	Rules for general-purpose AI models (like large language models)
2 August 2026	Most remaining rules, including many transparency duties
2 December 2027	High-risk rules for stand-alone systems (Annex III), after the 2026 delay
2 August 2028	High-risk rules for AI built into regulated products (Annex I)

The last two dates changed in 2026. The EU passed a "Digital Omnibus" amendment that postponed the high-risk deadlines. It was published in the Official Journal in July 2026. The general transparency duties still start on 2 August 2026, but generative AI systems already on the market before then have until 2 December 2026 to label their output. Check the current text if you rely on a specific date.

NIST AI Risk Management Framework

The US National Institute of Standards and Technology (NIST) published the AI Risk Management Framework (AI RMF 1.0) in January 2023. It is voluntary and free.

It is built around four functions:

1. Govern: set up the culture, roles and policies.
2. Map: understand the context and what could go wrong.
3. Measure: test and track the risks.
4. Manage: decide what to do about them and act.

NIST also published a companion profile for generative AI in July 2024. For many companies, the AI RMF is the easiest place to start because it is practical and costs nothing.

ISO/IEC 42001

ISO/IEC 42001:2023 is the international standard for an AI management system. It was published in December 2023.

Think of it like ISO 27001 for information security, but for AI. It sets out how to run AI governance as an ongoing system: policies, risk assessment, controls, internal audits and improvement. Unlike NIST's framework, a company can be certified against it by an accredited auditor.

It suits companies that sell AI products or services and want to show customers they take governance seriously.

Malaysia's National Guidelines on AI Governance and Ethics

On 20 September 2024, Malaysia's Ministry of Science, Technology and Innovation (MOSTI) launched the National Guidelines on AI Governance and Ethics (AIGE). The guidelines are voluntary. They give guidance to the public, policymakers and developers, and technology providers.

The AIGE sets out seven principles:

1. Fairness
2. Reliability, safety and control
3. Privacy and security
4. Inclusiveness
5. Transparency
6. Accountability
7. The pursuit of human benefit and happiness

Voluntary does not mean irrelevant. The PDPA still applies whenever AI processes personal data. And the AIGE gives Malaysian companies a local reference point when customers or partners ask how they manage AI.

A binding law is also on the way. As of September 2026, Digital Minister Gobind Singh Deo said the draft AI Governance Bill was complete and could be tabled in Parliament by the first quarter of 2027. Details may change before it is passed.

How the frameworks fit together

Framework	Type	Best for
EU AI Act	Law	Anyone selling AI into the EU
NIST AI RMF	Voluntary framework	A free, practical starting point
ISO/IEC 42001	Certifiable standard	Proving governance to customers
Malaysia AIGE	Voluntary national guidelines	Local principles and expectations

You don't have to pick one. Many companies use the NIST functions as a working method, the AIGE principles as values, and ISO/IEC 42001 if they need certification.

A simple starter plan

For a mid-sized business, say a Penang manufacturer or a KL insurance agency:

1. List your AI uses. Ask every team. Include ChatGPT-style tools, AI features in software you already pay for, and anything built in-house.
2. Name an owner. One senior person responsible for AI governance overall, and an owner for each important system.
3. Rate the risk. Flag anything that affects people's jobs, money, health or legal rights as high risk.
4. Write a one-page AI use policy. Cover approved tools, what data is off-limits, and when a human must check output.
5. Add security checks. Prompt injection and data leaks are real risks. See AI and cybersecurity.
6. Review twice a year. Tools and laws change quickly.

If you are planning a wider rollout, our enterprise AI roadmap covers strategy and operations. If AI agents are involved, read AI agents vs chatbots first, because agents that take actions need tighter controls.

My advice: AI governance doesn't have to be heavy. Start with a list, an owner and a short policy. That puts you ahead of most companies.

Quick answers

What is AI governance in simple terms?

It is how a company manages its AI: who owns it, what rules apply, what risks exist and how they are checked. It is a management practice, not a technology.

Does the EU AI Act apply to Malaysian companies?

It can, if you place AI systems on the EU market or your AI's output is used in the EU. Companies serving only Malaysian customers are generally outside its scope.

Is Malaysia's AIGE mandatory?

No. The National Guidelines on AI Governance and Ethics are voluntary. A separate AI Governance Bill is being prepared, but as of October 2026 it has not yet been passed. Laws like the PDPA still apply when AI uses personal data.

Should we start with NIST AI RMF or ISO/IEC 42001?

Most companies start with the free NIST AI RMF to build habits. Move to ISO/IEC 42001 if customers or partners want certified proof.