SEO Title: Using AI in Business in Malaysia: Legal Risks Companies Should Consider in 2026
Meta Description: Malaysian businesses are increasingly using AI tools. Learn about the legal risks involving confidentiality, personal data, copyright, contracts and corporate responsibility.
Artificial Intelligence (“AI”) is rapidly becoming part of everyday business operations.
Companies now use AI tools to:
Draft emails and documents;
Prepare marketing materials;
Analyse information;
Provide customer service;
Generate software code;
Assist with research; and
Automate internal processes.
AI can improve efficiency and reduce costs. However, businesses should also consider the legal risks associated with using AI.
The key issue is not simply whether a business should use AI. The more important question is how AI should be used responsibly and safely.
One of the most immediate risks arises when employees enter confidential information into an AI platform.
Examples may include:
Customer information;
Financial information;
Commercial contracts;
Business strategies;
Trade secrets;
Pricing information; and
Information relating to pending transactions.
Before using an AI tool, businesses should understand how the platform handles information submitted by users.
Employees should not assume that information entered into an AI system is automatically confidential.
Businesses should consider implementing internal policies that explain:
Which AI tools may be used;
What information may be entered;
What information must not be entered; and
Who is responsible for reviewing AI-generated content.
AI tools may process personal data.
For example, an employee may upload customer information to obtain assistance with drafting a response or analysing a complaint.
This may create personal data protection concerns.
Businesses should consider:
What personal data is being processed;
Why the data is being processed;
Whether the processing is permitted;
Who may access the information; and
Whether the AI provider is a third-party service provider.
The use of AI should therefore be considered together with the business's broader data protection obligations.
AI-generated information may be inaccurate.
AI systems can produce:
Incorrect facts;
Incorrect legal information;
Incomplete analysis;
Outdated information; or
Completely fabricated references.
Businesses should therefore not treat AI output as automatically accurate.
This is particularly important when AI is used to prepare:
Legal documents;
Financial information;
Technical advice;
Customer communications; or
Regulatory materials.
Human review remains important.
AI-generated content may create intellectual property questions.
Businesses should consider:
Whether the content generated can legally be used;
Whether third-party material has been incorporated;
Whether confidential information has been used;
Whether the business owns the relevant output; and
Whether the output may infringe third-party rights.
Businesses should be cautious when using AI to generate commercial content, software, designs or marketing materials.
Businesses should consider whether existing contracts address the use of AI.
For example, a commercial contract may contain obligations relating to:
Confidentiality;
Data protection;
Intellectual property;
Subcontracting; or
Information security.
Using an AI provider may involve sharing information with an external technology provider.
Businesses should therefore consider whether the use of AI is consistent with their existing contractual obligations.
A company should consider establishing a clear AI usage policy.
The policy may address:
Examples may include:
Drafting general content;
Brainstorming;
Summarising non-confidential information; and
Administrative assistance.
Examples may include entering:
Confidential information;
Sensitive personal data;
Trade secrets; or
Information subject to contractual restrictions.
Employees should understand when AI-generated material must be reviewed by a qualified person before being used.
The use of AI may also become a corporate governance issue.
Directors and management should consider:
How AI is being used;
What risks are involved;
Whether the company has appropriate controls; and
Whether employees are using AI responsibly.
A company that uses AI without proper controls may expose itself to operational, contractual, data protection and reputational risks.
Businesses should consider:
Creating an internal AI usage policy.
Identifying approved AI tools.
Prohibiting the submission of confidential information where appropriate.
Reviewing personal data risks.
Checking AI-generated content for accuracy.
Reviewing intellectual property risks.
Training employees.
Reviewing contracts with AI and technology service providers.
AI can provide significant benefits to Malaysian businesses, but it should not be used without proper consideration of legal and commercial risks.
The most effective approach is not necessarily to prohibit AI entirely. Instead, businesses should establish clear policies and controls that allow AI to be used responsibly.
Legal Disclaimer: This article is for general information only and does not constitute legal advice. The legal position may depend on the specific AI tool, the information processed and the circumstances of its use.
Malaysia