Securities Commission Malaysia’s proposed AI oversight rules for listed companies.

What the Securities Commission proposed

The Securities Commission Malaysia opened a public consultation from 3 to 31 July 2026 on proposals to strengthen the corporate governance ecosystem, as part of the Capital Market Masterplan 2026-2030. Among the proposals: expectations for board oversight of technology, including disclosure on the use and governance of technology and artificial intelligence, to be added to the Malaysian Code on Corporate Governance.

The proposal applies to companies listed on Bursa Malaysia, with expectations that scale by technology intensity, meaning digitally intensive sectors would face more detailed requirements than others. As at this writing, the consultation window has closed and no expectation is yet in force; the requirement takes effect only through a future MCCG revision.

◇

A consultation is not a rule yet, but boards that wait for the final MCCG revision will be drafting disclosure language under deadline pressure.

What boards would need to own

The proposal, as consulted, points toward four things a board would need in place: a named board-level owner for AI and technology oversight, a governance process the board actively conducts rather than one delegated silently to the technology function, an annual disclosure describing how AI is used and governed, and a baseline level of board competency in AI and data governance.

• Name who on the board owns AI and technology oversight, whether that is the audit committee, risk committee or a dedicated technology committee.
• Define, in writing, what “governed” means for your organisation: approval gates, a system register, an incident process.
• Draft the annual disclosure language now, against your actual AI inventory, rather than after the MCCG revision is final.
• Identify any gap in board-level AI literacy and address it before disclosure becomes mandatory.

A different regulator, a different lens

This is not the same proposal as Bank Negara Malaysia’s direction for financial institutions, which centres on risk management in technology and AI adoption inside banks and insurers. The Securities Commission’s proposal targets listed-company governance and disclosure, and applies to any Bursa Malaysia-listed company using AI with a material effect on its business, not only financial institutions.

A listed bank or insurer sits under both: BNM’s technology risk expectations for its regulated activities, and the Securities Commission’s board-level disclosure expectations as a listed entity. The two should be reconciled in one governance structure rather than treated as separate compliance exercises.

Building a disclosure a board can defend

The organisations that will find this straightforward are the ones that already maintain an AI system register: what is deployed, who owns it, what data it touches, and what human approval sits over its consequential actions. The disclosure the Securities Commission is contemplating is, in substance, a public summary of that register and the process behind it.

Rehearsing that disclosure now, against a real inventory rather than a description of intent, is the difference between a board that can answer a follow-up question from an auditor or a journalist, and one that is quoting language from a policy document nobody has tested.

Timeline and what to watch

The consultation ran from 3 to 31 July 2026 through mccg@seccom.com.my and the Securities Commission’s website. No expectation is currently in force. The next milestone to watch is the revised Malaysian Code on Corporate Governance itself, which will set the actual effective date and final wording of the AI and technology oversight requirement.