Closing section · 4.30 to 5.00 pm
Governance, Risk and Accountability
You will produce: an AI use checklist for your division. The rules here apply to all four tools.
PDPA: what changed and why it matters
The main changes under the Personal Data Protection (Amendment) Act 2024, brought into force in stages during 2025.
Data controller
The new term for a data user. Processors you engage now carry direct duties too.
Higher penalties
Breaching the principles can bring a fine of up to RM1 million or up to three years in prison.
Breach notification
Since 1 June 2025, significant breaches must be reported to the Commissioner and affected people told.
Data protection officer
Required for large-scale processing, for example personal data of more than 20,000 people.
Pasting trainee or staff personal data into a public AI tool counts as processing, and the data may leave Malaysia. This is general information, not legal advice.
What can go into an AI tool?
| Level | Examples | Rule |
|---|---|---|
| Open | Published prospectus, public programme information, press releases | Any approved tool |
| Internal | Draft papers, minutes, SOPs, total enrolment figures | Institutional accounts only, with names removed |
| Restricted | IC numbers, results, staff HR files, payment details, disciplinary cases | Never in a public AI tool |
When the AI gets it wrong
Hallucination
Fluent, confident and false. Commonest with figures, names, references and regulations.
Bias
Outputs mirror patterns in the training data. Take care with shortlisting, appraisals and trainee selection.
Accountability
The officer who signs or sends remains responsible. “The AI wrote it” is no defence.
National guidance
Malaysia's AI governance and ethics guidelines (MOSTI, 2024) set seven voluntary principles, including fairness and accountability.
The seven principles: fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and pursuit of human benefit and happiness.
Your turn
A divisional AI use checklist
- 1Approved tools are listed and staff know them.
- 2Data levels are defined: open, internal, restricted.
- 3No personal data goes into public AI tools.
- 4A named person reviews every AI-assisted output.
- 5Figures, names and references are checked at source.
- 6AI use is disclosed where it matters, such as board papers.
- 7Errors and near misses are reported without blame.
- 8The checklist is reviewed every six months.
Tick what your division already has. Circle the item you would put in place first. This checklist is the seed of an internal AI use policy.
Quick check
Reflection prompts. Answer them out loud at your table before moving on.
- 01Which tool answers only from the documents you upload?
- 02True or false: trainee IC numbers may go into a free chatbot if you delete the chat afterwards.
- 03What is the maximum fine for breaching the PDPA's data protection principles?
- 04Which checklist item would your division find hardest to put in place?