Malaysia gave public agencies an AI rulebook in 2025. The self-assessment was the important part

Malaysia's National Digital Department launched a dedicated rulebook for public-sector AI on 27 February 2025. Developed with the Malaysia Digital Economy Corporation, the guidelines were aimed at agencies, department heads, chief digital officers, ICT managers and civil servants deciding how AI should enter government work.[1]

The document did more than list ethical aspirations. Its six chapters and three appendices covered who is responsible, how risk should be managed, how an agency should approach adoption and how it can assess the likely scope and impact of a proposed use case. Bernama described the complete reference as 158 pages.[1][3]

For the public, the self-assessment is the most consequential part. It creates a point before procurement or deployment where an agency should be able to explain the problem, the people affected, the data involved, the possible harm, the human decision owner and the evidence that AI is actually a better option.[1][3]

The launch audience included state secretaries, department heads, chief digital officers, public-sector ICT managers and industry partners. That matters because these are the people who translate broad policy into a system specification, procurement decision, operating procedure and frontline service.[1]

The programme paired the document launch with public-sector use cases and a forum on AI ethics and governance. The structure recognised that responsible adoption needs both practical examples and a way to challenge them. A useful system is not responsible merely because it automates an existing task faster.[1][2]

An AI model cannot be the accountable owner of a public decision. An agency needs named people who approve the use case, control access, verify data quality, monitor performance, respond to incidents and decide when the system must be changed or stopped. Vendors may support those tasks, but they cannot absorb the public body's duty to citizens.[1][3]

That is why accountability, transparency and fairness matter together. Accountability names who must answer. Transparency gives reviewers enough information to understand the system and its limits. Fairness requires the agency to examine whether errors or exclusions fall unevenly on particular groups.[3]

Using AI to organise internal meeting notes is not equivalent to using it to rank benefit applicants, flag a person for investigation or recommend a medical or licensing outcome. The affected rights, data sensitivity, reversibility and cost of an error are different. Risk assessment has to begin with the decision and the people exposed to it, not with the brand name of the tool.[1]

A credible assessment should ask how often the system is wrong, whether those errors can be detected, what happens before human review and how someone can challenge an outcome. It should also consider security, data leakage, model drift, vendor dependence and whether staff will defer to the system simply because it appears technical.[1][3]

The self-assessment template gives agencies a repeatable starting point, but a checklist can become ceremonial if every project passes. The record should show what evidence was considered, which risks were reduced, which controls remain, who approved the residual risk and why a non-AI option was rejected.[1]

For higher-impact systems, agencies should be able to publish a non-sensitive summary before or soon after deployment: the purpose, data categories, human review, performance measures, affected groups, complaint route and stop conditions. That public trail would turn the 2025 guidance into something Malaysians can verify rather than only trust.[1][3]