The first seven months of 2026 have produced a volume of legislative activity that technology companies in Malaysia will reckon with for years. Lawmakers passed laws on cybercrime to promote online safety and competition, often within days of each other. Other bills in the pipeline include AI governance and amendments to the copyright law to include AI generated contents.
Beyond legislative changes, this mid-year review also examines the ongoing regulatory uncertainty surrounding the Network School in Johor, which has emerged as a critical test case for the nation’s appetite for novel tech ecosystems. For founders and investors building in AI, crypto, or digital platforms, the cumulative effect is a regulatory architecture that touches every layer of the stack.
Online Safety Act (ONSA)
ONSA took effect on 1 January 2026, converting voluntary compliance into a statutory licensing regime. Platforms with eight million or more Malaysian users are automatically deemed licensed; Child Protection and Risk Mitigation Codes followed on 1 June with fines of up to RM10 million (approximately US$2.44 million). For startups distributing through Facebook, TikTok, or WhatsApp, ONSA changes the content-moderation calculus overnight. Singapore’s code-based approach under IMDA is less prescriptive; Malaysia opted for statutory duties comparable to the EU’s Digital Services Act.
Cybercrimes Bill 2026
Passed by the Dewan Rakyat on 1 July, the Bill creates offences for deepfakes and AI-generated intimate images, with extraterritorial reach and penalties of up to seven years and RM500,000 (approximately US$121,951). For AI and blockchain startups, prosecutors must prove criminal intent; AI-generated content is not automatically unlawful. Singapore’s Online Criminal Harms Act 2023 handles the same problem through directions to disrupt criminal content rather than new offences.
Competition and communications reform
On 2 July 2026, the Dewan Rakyat passed the Competition (Amendment) Bill, the most significant antitrust overhaul in Malaysia since 2012. It expands the scope from “commercial activity” to “any economic activity,” effectively capturing digital platforms that previously operated outside the regulatory perimeter. It also arms the Malaysia Competition Commission (MyCC) with enhanced investigative powers, including new incentives for whistleblowers.
This was followed on 15 July 2026 by the passage of two further bills that consolidate state control over digital infrastructure. The Communications and Multimedia (Amendment) Bill 2026 fuses national security mandates into the existing Universal Service Provision framework.
A concurrent amendment to the MCMC Act expands the commission’s remit and lifts the contract-value threshold for projects requiring ministerial sign-off to RM50 million (approximately US$12.20 million). For incumbents and new entrants alike, the message is clear: the state is preparing for a new era of infrastructure consolidation, one where connectivity, competition policy, and national security are increasingly seen as indivisible.
Also Read: 163,000 workers, 37% training: Malaysia’s AI skills gap in focus
AI Governance Bill
The National AI Office released its public consultation paper on 10 July, with submissions due by 31 July. The Bill introduces a risk-classification framework by potential harm, with incident reporting and harm assessment. Its standout feature, treating both AI training data and AI outputs as intellectual property, would be an ASEAN first.
Vietnam’s AI Law (effective 1 March 2026) imposes binding obligations on developers but does not go this far on IP. If enacted, Malaysia may become the region’s most AI-rights-protective jurisdiction, a factor AI/ML founders and their VCs should weigh.
MyIPO Copyright Act Amendments: AI Content
MyIPO opened a public consultation in July 2026 on a three-pillar framework for AI and copyright: transparency, fair terms, and compensation for use of copyrighted works as training data. The orphan works provisions allow startups training LLMs to use older, out-of-commerce works with a clearer legal pathway. The outcome may feed into the AI Governance Bill’s IP provisions, since both tracks address the same question of ownership in generative AI.
Malaysian Media Council Act 2025
The MMC is a self-regulatory body with a mandate to set ethical standards and manage complaints. Its 21-member board covers legacy outlets, independent journalists, and freelancers, relevant to any content platform or digital media startup in Malaysia.
Yet a critical gap remains. Unlike Australia, which enacted the News Media Bargaining Code requiring Google and Meta to pay for journalistic content, Malaysia has no equivalent revenue-sharing mechanism. This affects digital-first media startups whose work is distributed through platforms prioritising AI-generated content over accredited reporting. The MMC has also not articulated an AI news strategy, despite the Reuters Institute finding that 12 per cent of under-35s use AI platforms as primary news sources. Platforms themselves fall under MCMC.
SC Digital Asset Guidelines
The Securities Commission’s revised Guidelines on Recognised Markets took effect on 20 May 2026, tightening client asset safeguards and governance for digital asset exchange operators. Six DAX operators are now approved. For crypto and blockchain startups, a regulated pathway gives Malaysia an edge over jurisdictions still deliberating, but the direction is towards tighter oversight.
The SC has also been active on enforcement, maintaining an Investor Alert List similar to MAS in Singapore. Binance was added for operating without registration, and Bybit, on the list since July 2021, was ordered in December 2024 to shut down its Malaysian operations, which it did. Notwithstanding this, both entities have since secured indirect market exposure by investing in local exchanges.
Also Read: Malaysian SMEs grapple with a growing “confidence gap” in AI adoption
Consumer Credit Act 2025 and BNPL Regulation
The Consumer Credit Act 2025 (CCA), gazetted on 31 December 2025 and in force since 1 March 2026, establishes the Consumer Credit Commission (CCC) as the new regulator for non-bank credit activities in Malaysia. For the first time, Buy Now Pay Later (BNPL) providers, Atome, Grab PayLater, SPayLater, and others, along with leasing firms, factoring companies, debt collection agencies, licensed moneylenders, and pawnbrokers, must obtain a CCC licence to operate.
Licensing opened on 1 June 2026 with a six-month transition period (until approximately 30 November 2026) for existing providers. Banks and entities already regulated by Bank Negara Malaysia are excluded. The CCC has issued BNPL-specific standards covering affordability assessments (required for credit limits above RM1,000), white-labelling arrangements, pricing methodologies, late payment practices, merchant conduct, and digital authentication requirements, including Shariah compliance provisions.
For fintech founders, the CCA ends the regulatory arbitrage that BNPL operators previously enjoyed outside formal credit oversight. Compliance costs are rising, but the licensing framework also creates a moat that could consolidate the market around compliant players.
Other credit business models should take note, including earned wage access providers, whose products could fall within the Act’s definition of a credit facility depending on how repayment structures are designed.
Network School and regulatory grey zones
The controversy at Balaji Srinivasan’s Network School in Forest City, Johor, initiated in 2024, has become a live case study of regulatory uncertainty. While the project was meant to be a flagship drawcard for the Johor-Singapore Special Economic Zone, the tech community is now facing government investigations into immigration and local licensing.
Digital Minister Gobind Singh Deo recently stated that applications for the school followed proper procedures, despite the ongoing scrutiny. Previously, an immigration probe triggered by allegations that Israeli nationals used second passports to attend the tech community prompted PM Anwar Ibrahim to order the deportation of any Israeli citizens found.
While the Immigration Department found no evidence of Israeli participation, the episode exposed a deeper problem: no agency could say whether Network School was an educational institution, a co-living space, a tech incubator, or a tourism programme. The school has invested RM100 million (approximately US$24.39 million) and planned a RM500 million (approximately US$121.95 million) expansion, now shelved indefinitely.
For a tech founder or VC evaluating Malaysia, the question is whether this signals a political environment prepared to accommodate novel tech communities, or one where regulatory grey zones chill investment. It’s a stark contrast to Malaysia’s neighbours. Thailand, Indonesia, and other ASEAN countries are actively attracting remote talent with dedicated visas and clear rules, the very clarity the Network School has yet to receive in Malaysia.
PDPA and regional context
The PDPA amendments are now in force, with breach notification, DPOs, data portability, and a cross-border transfer framework in force. The penalty ceiling now reaches RM1 million (approximately US$243,902.44) or three years’ imprisonment.
Malaysia’s legislative sprint puts it behind Singapore in regulatory maturity and Vietnam on AI speed, but ahead of Indonesia and Thailand. Indonesia’s PDP law remains partially operational; Singapore and Thailand are more advanced on enforcement. For founders and investors, compliance with one ASEAN member’s rules does not guarantee compliance with another’s; the fragmentation is the story.
Also Read: The agentic shift: Why AI agents are rewriting the rules of ERP software in Singapore and Malaysia
Gig Workers Act 2025
In force since 31 March 2026, the Act covers 1.64 million workers and applies to any platform operator engaging gig workers, from delivery and ride-hailing to freelance services. Key highlights: mandatory SOCSO contributions (1.25 per cent deducted per job), written service contracts, protection against termination without just cause, and a right to human review when algorithmic decisions affect work opportunities or conditions.
The Act also establishes the Malaysian Gig Economy Council (MyGiG) to set minimum income rates by sector and region, but the Council has not yet been constituted, the Gig Workers Tribunal’s procedures are still pending, and minimum earnings remain undecided. For an investor, the existing compliance obligations are enforceable now; the coming minimum-earnings framework is the variable to watch.
Final thoughts
Malaysia is passing new regulations at a rapid pace, creating a landscape of escalating compliance costs. This rush to create new rules means the government may be missing the feedback needed to make them work effectively. For investors, this creates an environment where vigilance and pre-investment legal counsel are essential for any new business.
—
Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.
The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.
Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.
The post Mid-year 2026 look at Malaysia’s digital and technology regulatory updates appeared first on e27.