Business & Infrastructure / AI news for Malaysia
From the archive · Event date 27 March 2026
TM became Malaysia's first ISO 42001-certified telco. Here's what that means
The certification covers how an organisation manages AI risks, responsibilities and controls. It is a governance signal, not proof that every TM AI product is accurate or effective.
In brief
- Telekom Malaysia announced on 27 March 2026 that it had obtained ISO/IEC 42001:2023 certification through its AI Centre of Excellence, describing itself as Malaysia's first certified telecommunications company under the standard.[1]
- TM said SIRIM QAS International independently validated the management system and linked the certification to governance, ethical safeguards and AI risk management.[1]
- The announcement did not publish an audit report, list every AI system inside the certification scope or provide accuracy, safety and business-outcome results for individual products.[1]
TM announced an independently validated AI management-system certification
Telekom Malaysia said it had become the first Malaysian telecommunications company certified to ISO/IEC 42001:2023, the international management-system standard focused on artificial intelligence. TM attributed the work to its Artificial Intelligence Centre of Excellence and said the management system was independently validated by SIRIM QAS International. The official release was datelined Kuala Lumpur, 27 March 2026.[1]
The milestone is meaningful, but its meaning needs to be precise. ISO 42001 is about how an organisation establishes responsibilities, manages risks and reviews its AI processes. A certificate does not automatically prove that every model is unbiased, every output is correct, or every AI service creates value. Customers still need to test the exact system, data and operating environment they intend to use.[1]
The certification is about an AI management system, not a blanket product guarantee
TM said the certification indicates that its AI systems are developed and deployed with governance, ethical safeguards and risk management. The company positioned those controls as a foundation for organisations building AI-enabled solutions and linked them to its ambition to become a Digital Powerhouse by 2030. Group chief executive Amar Huzaimi Md Deris described the milestone as a way to strengthen trust and scale AI with more transparent principles.[1]
For a customer, the useful interpretation is narrower. A management-system audit can show that documented processes, accountability and continual improvement exist within a defined scope. It does not replace product acceptance testing. A chatbot still needs answer-quality checks; a computer-vision system still needs false-positive and false-negative measures; an agentic workflow still needs permission limits, logs and a safe way for people to stop or reverse actions.[1]
Malaysian buyers should ask what sits inside the certified scope
The public release did not include the certificate schedule, audit findings or a system-by-system inventory. Buyers should therefore ask which TM entity, teams, processes and services are covered; when the certificate expires; how surveillance audits work; and whether a proposed customer solution is governed by the same certified management system. They should also request the controls that matter to their own risk, including data access, model changes, human approval and incident handling.[1]
Certification and performance answer different questions. Governance evidence can show that risks are identified and assigned. Operational evidence must show that the deployed system works under real conditions. A responsible procurement process needs both: the organisation-level controls behind the service, and a product-level test tied to the buyer's data, users, failure modes and business baseline.[1]
TM continued to cite the certification in its wider AI programme
TM later referred to the certification at its 41st annual general meeting in May 2026, placing it alongside AI-ready data centres, cloud, cybersecurity, GPU services and internal AI adoption. The company again cited the credential in its August 2026 anniversary update, where it connected trusted AI to local infrastructure and capability building. Those follow-ups show that TM treats the management system as part of a broader corporate programme rather than a one-off award.[2][3]
The next useful evidence would connect that programme to specific outcomes. TM could publish the number of systems brought through the management process, the types of risks found, how incidents are handled, and examples where controls changed or stopped a deployment. Customer case studies should then report the business baseline, reliability result and operating owner without exposing confidential security details.[1][2][3]
Why Malaysia should care
TM supplies connectivity, infrastructure and digital services to Malaysian organisations. Its certification can influence what enterprise and public-sector buyers ask from AI vendors, but buyers still need product-level evidence. A management-system certificate should prompt better questions about ownership, risk controls, monitoring and incident response; it should not replace testing of the exact system being purchased.
Malaysian enterprise buyers
TM has organisation-level evidence for an AI management system, but the public release does not prove the performance of a specific service.[1]
Practical move: Request the certificate scope and test the proposed product against your data, users and failure thresholds.
AI governance and technology teams
The certification creates a local reference point for documented AI ownership, safeguards and risk management.[1]
Practical move: Compare your own approval, monitoring, change-control and incident process with the evidence required from certified suppliers.
Public-sector and regulated organisations
A certified supplier may strengthen procurement evidence, but sector duties and use-case risks still need separate controls.[1]
Practical move: Keep the management-system certificate as one input; require use-case assurance, data controls and accountable human oversight as well.
What Malaysians can do now
- Ask for the exact certificate scope, validity period and surveillance-audit arrangements.
- Run product-level tests for accuracy, reliability, security and business effect before deployment.
- Document who owns model changes, incidents, human approval and the decision to stop a system.
What we still do not know
The public announcement did not disclose the audit scope or product-level results.
- The exact TM entities, services, systems and lifecycle processes included in the certified scope.
- Any audit observations, corrective actions or surveillance schedule associated with the certification.
- How many customer or internal AI systems had completed the management process and what measurable outcomes followed.
Sources
- 1.TM Leads in Trusted AI as Malaysia's First Telco Certified with ISO/IEC 42001:2023 Telekom Malaysia, 27 March 2026
- 2.TM Reinforces Long-term Value Creation at its 41st AGM Telekom Malaysia, 28 May 2026
- 3.TM Marks 80 Years of Connecting Malaysia Telekom Malaysia, 26 August 2026
